diff --git a/.changeset/tidy-bobcats-prove.md b/.changeset/tidy-bobcats-prove.md
new file mode 100644
index 0000000000..ad73d547e0
--- /dev/null
+++ b/.changeset/tidy-bobcats-prove.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Encode the OAuth state parameter using URL safe chars only, so that providers have an easier time forming the callback URL.
diff --git a/plugins/auth-backend/src/lib/oauth/helpers.ts b/plugins/auth-backend/src/lib/oauth/helpers.ts
index 9f250a0285..bc6fcf1004 100644
--- a/plugins/auth-backend/src/lib/oauth/helpers.ts
+++ b/plugins/auth-backend/src/lib/oauth/helpers.ts
@@ -19,7 +19,7 @@ import { OAuthState } from './types';
 
 export const readState = (stateString: string): OAuthState => {
   const state = Object.fromEntries(
-    new URLSearchParams(decodeURIComponent(stateString)),
+    new URLSearchParams(Buffer.from(stateString, 'hex').toString('utf-8')),
   );
   if (
     !state.nonce ||
@@ -40,7 +40,7 @@ export const encodeState = (state: OAuthState): string => {
   searchParams.append('nonce', state.nonce);
   searchParams.append('env', state.env);
 
-  return encodeURIComponent(searchParams.toString());
+  return Buffer.from(searchParams.toString(), 'utf-8').toString('hex');
 };
 
 export const verifyNonce = (req: express.Request, providerId: string) => {