It seems like the stanford.edu servers do not decode the hex in that URI **before they check with the username**, they do decode it later, you can see the headers. They could be using a CDN that decodes the URI and sends those headers, but they themselves may not decode it.

According to the [URI specification (RFC3986)](https://datatracker.ietf.org/doc/html/rfc3986) [Section 2.1](https://datatracker.ietf.org/doc/html/rfc3986#section-2.1):
```
2.1.  Percent-Encoding

   A percent-encoding mechanism is used to represent a data octet in a
   component when that octet's corresponding character is outside the
   allowed set or is being used as a delimiter of, or within, the
   component.  A percent-encoded octet is encoded as a character
   triplet, consisting of the percent character "%" followed by the two
   hexadecimal digits representing that octet's numeric value.  For
   example, "%20" is the percent-encoding for the binary octet
   "00100000" (ABNF: %x20), which in US-ASCII corresponds to the space
   character (SP).  Section 2.4 describes when percent-encoding and
   decoding is applied.

      pct-encoded = "%" HEXDIG HEXDIG

   The uppercase hexadecimal digits 'A' through 'F' are equivalent to
   the lowercase digits 'a' through 'f', respectively.  If two URIs
   differ only in the case of hexadecimal digits used in percent-encoded
   octets, they are equivalent.  For consistency, URI producers and
   normalizers should use uppercase hexadecimal digits for all percent-
   encodings.
```
and [Section 2.4](https://datatracker.ietf.org/doc/html/rfc3986#section-2.4):
```
   For example, the octet
   corresponding to the tilde ("~") character is often encoded as "%7E"
   by older URI processing implementations; the "%7E" can be replaced by
   "~" without changing its interpretation.
```

1. The URL containing `%7E` at the start does not seem to be invalid.
2. It seems too common that `~` is encoded as `%7E`.

Since stanford.edu's `Server:` header says that they are using `Apache`: `mod_userdir` in Apache seems to run before the URI is decoded. I have tested this, and this doesn't happen with the latest version.

Apart from that, the URL seems to be encoded by markdown (as mentioned in the comments).

For me, it only happens with Firefox, not with Chrome.

Fun fact: I was actually working with URL encoding/decoding in my own HTTP server when I saw this issue.