How does one encrypt or otherwise scramble URLs so something like an ISP or IT staff can't read them?

You generally can't - If the ISP or IT staff can't read them, neither can the destination server. One thing that you can do is encrypt the communications by using an intermediate machine.

For example, if you are at the office you can ssh into your home machine and tunnel X. Then open the web browser on your home machine, with the display on your office machine. You can then browse the web, while communications to-from your office remain (strongly) encrypted.

Doing this would require having or installing X on your office machine and setting up an ssh server on your home machine, all of which is freely available. There are many threads on both issues, so if this is a viable solution for you, search the forum.

I definetly do not think any ISPs allow this

Ok, awesome. So I would basically have a 'shell' or 'capsule' with ssh over any communications?

Yes, ssh will provide an encrypted tunnel through which X applications can be run remotely.

An even trickier method could be running ssh as a client and server. Could one not ssh to localhost and run the apps through there to the same effect as logging into another machine?

No, the encyption is then only over the local tcp connection (on machine1). The http requests that leave the machine are not encrypted in that case.

Or you could google for "anonymizer".

ok, would it work if connecting to the external IP instead of localhost? by the way, thanks for help

No, if by external IP you mean the IP address of machine1 outside the NAT.

Think about the path of the data. From the web browser to the web server, the data is not encrypted (assuming that you're not using an SSL transaction). From the SSH client to the SSH server, the data is encrypted. If the encrypted portion of the data path ends on machine1, then the browser running on machine1 will be sending unencrypted data from machine1.

The scenario I described in my original post will work because the encryption ends on machine2. The data from machine2 to the web server is then unencrypted. Assuming machine2 is at your home (or any remote location outside the domain of machine1), then those monitoring machine1 have no visibility to the data from machine2 to the web server. They can only see the encrypted stream leaving machine1. To further obscure this, you can put the SSH server running on machine2 on port 443 (the web server SSL port). The ssh session will then look like a (very long) SSL transaction with a web server to any monitoring equipment watching machine1. In that case, you need to specify the port with SSH:

ssh -p443 -Y userid@machine2