Are you specifying the password on WinSCP command line from a batch file? (i.e. a different use than your other question shows)
Then you need to use %%40, because % has a special meaning in batch files.
I've documented that:
https://winscp.net/eng/docs/session_url#special
WinSCP GUI can generate correct code with all the escaping done right for you:
https://winscp.net/eng/docs/ui_generateurl#script

I have an @-sign in my password. As such, I am putting %40 at that position in my password string in the open statement of my script file. However, the login to the system fails (invalid credentials) and the log file is showing that it thinks the password has a 0 character in that position. Any idea why special character substitution in passwords is failing?