Kodi Community Forum

try if replacing the @ in your password with %40 helps.

found that info here: https://forums.vandyke.com/showthread.php?t=2457

Thanks for the suggestion. 
I'd already tried inserting the ascii hex in that format for each special character, collectively and individually for both the ! and the @.
The login still fails in each case (incorrect password), however, the correct username is now attempting login, rather than part of the password, which is shown in the FreeNAS logging.
(For these examples)
FWIW, I've also tested this scenario on a Windows10 box (Kodi 18B4, SFTP 1.01) with the same results, so it seems unrelated to platform.

So in summary:
Raw password used works initially, when Add network location... selected and SFTP credentials entered, hit ok, showing in "Browse for new share":
...allowing selection and successful traversal of subdirectories to browse for a new share.  FreeNAS log confirms:
Next step, hit OK after selecting subdirectory path, where the path now shows:
Which is rejected due to the incorrect user, illustrated by FreeNAS logs again.
After accepting the location, I get an unable to connect message just before setting content (obviously due to the user being incorrect), however, if I go back to the browse for new share and select the original:
I can still select (and successfully traverse) with a successful login. 

Hopefully this helps find a resolution.  Cheers.

So I did find a way to get past the bad handling of '@' symbols in the SFTP password, using the %40.  Not perfect, but here's how to do it.
Using a previously defined network location like in my previous post:
which can access this location without issues using:
Then when adding for instance a movie file location, going into Add Video Source/Browse/selecting sftp location, then drill down to directory containing movies, click OK.
Back on the "Add video source" screen, you can clearly see the path is borked.  In this case it shows:
If you clicked ok at this stage, it fails, however if you highlight the link and click into it, you will see:
If you then change this to:
The source will, after hitting ok, change to appear as:
and if ok is hit the connection now works and starts scanning in the library.

So in summary, adding the %40 to the network location password does not help, but does help when adding the source in this way.
Kind of odd, but at least there is a way around it.