maybe they were looking for extra special characters like 🁄 or ⶸ. Who am I kidding, RFC 1738 tells us that literally everything is unsafe and you know, we need to prepare for the inevitable occasion when the password somehow ends up inside an URL.

The characters "<" and ">" are unsafe because they are used as the delimiters around URLs in free text;
the quote mark (""") is used to delimit URLs in some systems.
The character "#" is unsafe
The character "%" is unsafe

It ends up with

Thus, only alphanumerics, the special characters
$ - _ . + ! * ' ( ) ,
are safe

[–] protogen420@lemmy.blahaj.zone 5 points 3 weeks ago (1 children)

I am going put null on my password and you aren't stopping me

[–] Baizey@feddit.dk 2 points 3 weeks ago

Also [object Object] is always a classic to mess with any js

[–] planish@sh.itjust.works 5 points 3 weeks ago

If the password is going in URLs you already have a problem.