As per RFC1738 > The user name (and password), if present, are followed by a >commercial at-sign "@". Within the user and password field, any ":", >"@", or "/" must be encoded.
[1] https://datatracker.ietf.org/doc/html/rfc1738#section-3.1