diff --git a/alloy b/alloy
new file mode 160000
index 00000000..2a3e6ca4
--- /dev/null
+++ b/alloy
@@ -0,0 +1 @@
+Subproject commit 2a3e6ca44c8b9589160d020a04cbc47dda567ebe
diff --git a/views/expr/surf.js b/views/expr/surf.js
index 5ebe7641..b5cad29d 100644
--- a/views/expr/surf.js
+++ b/views/expr/surf.js
@@ -46,7 +46,7 @@ $('al').onclick = function() {
     if (url.startsWith('https://') || url.startsWith('http://')) url = url;
     else if (url.startsWith('//')) url = 'http:' + url;
     else url = 'http://' + url;
-    frame.src = "https://" + domain + "/fetch/" + url;
+    frame.src = "https://" + domain + "/fetch/" + btoa(url);
     frame.style['visibility'] = "visible";
     frame.setAttribute('allow', 'fullscreen');
     frame.setAttribute('sandbox', 'allow-same-origin allow-scripts allow-popups allow-forms');
@@ -61,7 +61,7 @@ $('albp').onclick = function() {
     if (url.startsWith('https://') || url.startsWith('http://')) url = url;
     else if (url.startsWith('//')) url = 'http:' + url;
     else url = 'http://' + url;
-    window.location.href = "https://" + domain + "/fetch/" + url;
+    window.location.href = "https://" + domain + "/fetch/" + btoa(url);
     document.cookie = 'oldsmobile=badcar; expires=' + (Date.now() + 259200) + '; SameSite=Lax; domain=.' + auth + '; path=/; Secure;';
     return false;
 };