Ampersand

&

A named entity — readable, and safe in any HTML document without declaring a charset.

&

The numeric form works everywhere a named one does, and exists for every character.

\0026

For a content property in a ::before or ::after rule. No semicolon, and mind the trailing space.

\u0026

Valid in a JavaScript or JSON string literal, so it survives files and pipelines that are not UTF-8 clean.

\u0026

The escape for a Python string literal.

%26

Percent-encoded UTF-8, for a query string or a path segment.

26

1 bytes on the wire. Seeing these as separate garbled characters means something decoded them as single-byte text.