diff --git a/src/api/src/main.py b/src/api/src/main.py
index 1ac749a..45c6883 100644
--- a/src/api/src/main.py
+++ b/src/api/src/main.py
@@ -38,6 +38,7 @@ async def download_book(
         )
 
     if username and password:
+        # username and password are URL-Encoded by the frontend. FastAPI automatically decodes them.
         try:
             cookies = await wp_get_cookies(username=username, password=password)
         except ValueError:
diff --git a/src/frontend/src/routes/+page.svelte b/src/frontend/src/routes/+page.svelte
index d68c849..491470d 100644
--- a/src/frontend/src/routes/+page.svelte
+++ b/src/frontend/src/routes/+page.svelte
@@ -19,7 +19,7 @@
     `/download/${story_id}?om=1` +
     (download_images ? "&download_images=true" : "") +
     (is_paid_story
-      ? `&username=${credentials.username}&password=${credentials.password}`
+      ? `&username=${encodeURIComponent(credentials.username)}&password=${encodeURIComponent(credentials.password)}`
       : "");
 </script>