I had this issue with MD5 hashes recently, but with even more constraints!
First, on top of using the MD5 hash in a URL, and sending that URL in an email, I also needed to use the MD5 hash in an actual email address. (Thus allowing the recipient to either go to the URL or reply to the email address.) Second, I couldn't translate to a period within the MD5 hash, because that character was already being used for something else.
I ended up using this translation (the translation from plus to plus is intentional):
tr,+=/,+-_,
That works fine for the email address. The only iffy part is the plus in the URL; I just made sure that the CGI script doesn't convert the plus to a space.