You're really going to hate it when you learn about JSON Web Tokens, which exist exactly to hack past this sort of problem.

Jwt is encoded and it is used for data without a server session.

I'm not a fan for jwt and it used more often than it should, but sometimes it makes sense.

But at least they’re base 64 encoded so you don’t have to worry about the special characters