Indeed some special characters need to be URL-encoded for use in URL:
https://winscp.net/eng/docs/session_url#special

It seems that you have tried to use the password encoded for URL as a literal password in GUI, assuming the password contains an actual %, while it does not.

I apologize I found the issue. There are some “standard URL encoding” rules when passing a URL string (example: sftp://user:password@host). One rule is for passing a !.

The password in the GUI had a ! and the GUI was converting it to its hex value of %21 behind the scenes so I never saw it.

When you "Generate session URL/Code..." you see the conversion of ! to %21.

Using a % in the password in the GUI fails. And when I do a "Generate Session URL/Code…” it is replacing the % with a %25.

If I use just the % on a command line it works.

I tried to do a double % but it still fails from the GUI. Is there a setting somewhere?

I have it working on one site connection but that was created years ago on a previous version of WinSCP.