Which characters are allowed in the username and password for URL-based authentication?

I wish to know exactly which characters can go into the username and password parts of URL-based authentication (deprecated):

Wikipedia explains the following about URLs:

URI = scheme:[//authority]path[?query][#fragment]
authority = [userinfo@]host[:port]

An optional authority component preceded by two slashes (//), comprising: An optional userinfo subcomponent that may consist of a user name and an optional password preceded by a colon (:), followed by an at symbol (@). Use of the format username:password in the userinfo subcomponent is deprecated for security reasons. Applications should not render as clear text any data after the first colon (:) found within a userinfo subcomponent unless the data after the colon is the empty string (indicating no password).

Also, websites like the following explains how to percent-encode special characters (%XX):

https://support.brightcove.com/special-characters-usernames-and-passwords

I need it for creating a regular expression with a small number of false-positives.