Enter the actual password in JMeter’s proxy password field. Encoding depends on where that value is stored, rather than on the proxy requiring a different password.

For an illustrative password containing an ampersand:

LocationRepresentation
JMeter interface fieldtea&salt
JMX XML element texttea&salt
POSIX shell argument'tea&salt'

The XML parser turns the entity into a literal ampersand before JMeter uses the value. Shell quotes keep the ampersand inside one argument and are removed by the shell. Neither transformation changes the account’s password.

Percent-encoding is for URL components; applying %26 to a standalone password field can send those three characters instead. Typing an XML entity into the interface can likewise make it part of the password.

Prefer editing and saving the plan through JMeter. If editing JMX manually, preserve valid XML and verify the value after loading it.

Artiglyn mynjee