diff --git a/subcmds/sync.py b/subcmds/sync.py
index 674569c..7bbbe44 100644
--- a/subcmds/sync.py
+++ b/subcmds/sync.py
@@ -26,6 +26,8 @@
 import tempfile
 import time
 
+from urllib import quote as url_quote
+
 from pyversion import is_python3
 if is_python3():
   import http.cookiejar as cookielib
@@ -592,7 +594,7 @@
 
         if (username and password):
           manifest_server = manifest_server.replace('://', '://%s:%s@' %
-                                                    (username, password),
+                                                    (username, url_quote(password, safe='')),
                                                     1)
 
       transport = PersistentTransport(manifest_server)