It seems like the stanford.edu servers do not decode the hex in that URI **before they check with the username**, they do decode it later, you can see the headers. They could be using a CDN that decodes the URI and sends those headers, but they themselves may not decode it. According to the [URI specification (RFC3986)](https://datatracker.ietf.org/doc/html/rfc3986) [Section 2.1](https://datatracker.ietf.org/doc/html/rfc3986#section-2.1): ``` 2.1. Percent-Encoding A percent-encoding mechanism is used to represent a data octet in a component when that octet's corresponding character is outside the allowed set or is being used as a delimiter of, or within, the component. A percent-encoded octet is encoded as a character triplet, consisting of the percent character "%" followed by the two hexadecimal digits representing that octet's numeric value. For example, "%20" is the percent-encoding for the binary octet "00100000" (ABNF: %x20), which in US-ASCII corresponds to the space character (SP). Section 2.4 describes when percent-encoding and decoding is applied. pct-encoded = "%" HEXDIG HEXDIG The uppercase hexadecimal digits 'A' through 'F' are equivalent to the lowercase digits 'a' through 'f', respectively. If two URIs differ only in the case of hexadecimal digits used in percent-encoded octets, they are equivalent. For consistency, URI producers and normalizers should use uppercase hexadecimal digits for all percent- encodings. ``` and [Section 2.4](https://datatracker.ietf.org/doc/html/rfc3986#section-2.4): ``` For example, the octet corresponding to the tilde ("~") character is often encoded as "%7E" by older URI processing implementations; the "%7E" can be replaced by "~" without changing its interpretation. ``` 1. The URL containing `%7E` does not seem to be invalid. 2. It seems too common that `~` is encoded as `%7E`. Since stanford.edu's `Server:` header says that they are using `Apache`: `mod_userdir` in Apache seems to run before the URI is decoded. I have tested this, and this doesn't happen with the latest version. Apart from that, the URL seems to be encoded by markdown (as mentioned in the comments). For me, it only happens with Firefox, not with Chrome.