This is less a Marketo thing than a general reality about URLs (which I think all technical marketers need to understand so they don’t create broken links).
You can’t use just any character in a URL. URLs are by definition ASCII-only, meaning they can only include the small list of printable ASCII characters. All other characters need to be percent-encoded (a.k.a. URL-encoded/URI-encoded). Furthermore, if you’re trying to include a piece within a single query parameter, it can’t include any characters that would otherwise break the parameter into 2.
For example, you can’t include a literal & in a query param value, as the & represents the separator between parameters; it must appear as %26.
Another example is the + character, which is special to some servers, and not others — it represents a space, rather than a literal plus sign, on servers that use a loose decoding method. So it must be encoded as %2B. A hash sign/number sign, if meant literally, must be encoded as %23.
Marketo doesn’t guarantee that outputting a {{lead.token}} will conform to these requirements, and as fields support the full Unicode range, it’s easy to create a {{lead.token}} that isn’t valid in a URL. Most commonly it’s because of including a plus sign, hash sign, or ampersand, but weirder things happen as well.
To ensure a field is properly encoded you must pass it through $esc.url in Velocity. However, it’s possible that because of hard business rules, you know in advance that a field is safe to include as it would look the same after encoding. An example is a Number/Integer field — numbers are all ASCII. Another is an SFDC ID, as that’s known to be only ASCII numbers and letters. But freeform values are not inherently safe.
I’ve written many blog posts on these matters. You can start with these:
.png)