What special non-alphanumeric characters are NOT used in arcserver tokens?

[ArjunDongre]

As the title says, I am using ArcServer tokens generated by the server as a security layer in another program. I found out that the "-" character is sometimes used in the token string. Are there any special characters that are NOT to build a token that I can use to parse out a string that contains the token?

Thanks.

[JonathanQuinn]

What is the typical structure of the string?  Ampersands will be the character that separates each parameter from a request:

Ex.

https://server.domain.com/server/rest/services/SampleWorldCities/query/?where="1=1"&token=<token>&pa...

An ampersand will never be in a token string, so you can use that to split on.  You'll need to sort out if the URL requires decoding, though.