diff --git a/README.md b/README.md
index f7e4b68..9efaefa 100644
--- a/README.md
+++ b/README.md
@@ -35,6 +35,8 @@ p.key()        # "1.2.3.4:8080:user:pass"  (canonical identity; "host:port" if a
 Auth-less (IP-authenticated) proxies are first-class: `"host:port"` parses and
 every render shape omits the credentials. The 4-part form splits on the first three
 colons, so a password may itself contain colons (`host:port:user:pa:ss:word`).
+`url()` / `aiohttp()` percent-encode the credentials, so reserved characters
+(`/ # ? @`) in a user or password still produce a valid URL.
 
 ## Sources