diff --git a/AK/URL.cpp b/AK/URL.cpp
index 8ecf1313d5..eedde74034 100644
--- a/AK/URL.cpp
+++ b/AK/URL.cpp
@@ -36,14 +36,14 @@ URL URL::complete_url(StringView relative_url) const
     return URLParser::basic_parse(relative_url, *this);
 }
 
-DeprecatedString URL::username() const
+ErrorOr<String> URL::username() const
 {
-    return percent_decode(m_username);
+    return String::from_deprecated_string(percent_decode(m_username));
 }
 
-DeprecatedString URL::password() const
+ErrorOr<String> URL::password() const
 {
-    return percent_decode(m_password);
+    return String::from_deprecated_string(percent_decode(m_password));
 }
 
 DeprecatedString URL::path_segment_at_index(size_t index) const
@@ -92,19 +92,21 @@ void URL::set_scheme(DeprecatedString scheme)
 }
 
 // https://url.spec.whatwg.org/#set-the-username
-void URL::set_username(StringView username)
+ErrorOr<void> URL::set_username(StringView username)
 {
     // To set the username given a url and username, set url’s username to the result of running UTF-8 percent-encode on username using the userinfo percent-encode set.
-    m_username = deprecated_string_percent_encode(username, PercentEncodeSet::Userinfo);
+    m_username = TRY(String::from_deprecated_string(deprecated_string_percent_encode(username, PercentEncodeSet::Userinfo)));
     m_valid = compute_validity();
+    return {};
 }
 
 // https://url.spec.whatwg.org/#set-the-password
-void URL::set_password(StringView password)
+ErrorOr<void> URL::set_password(StringView password)
 {
     // To set the password given a url and password, set url’s password to the result of running UTF-8 percent-encode on password using the userinfo percent-encode set.
-    m_password = deprecated_string_percent_encode(password, PercentEncodeSet::Userinfo);
+    m_password = TRY(String::from_deprecated_string(deprecated_string_percent_encode(password, PercentEncodeSet::Userinfo)));
     m_valid = compute_validity();
+    return {};
 }
 
 void URL::set_host(Host host)
diff --git a/AK/URL.h b/AK/URL.h
index 5894434e92..00e535ef18 100644
--- a/AK/URL.h
+++ b/AK/URL.h
@@ -77,8 +77,8 @@ public:
         No
     };
     DeprecatedString const& scheme() const { return m_scheme; }
-    DeprecatedString username() const;
-    DeprecatedString password() const;
+    ErrorOr<String> username() const;
+    ErrorOr<String> password() const;
     Host const& host() const { return m_host; }
     ErrorOr<String> serialized_host() const;
     DeprecatedString basename() const;
@@ -98,8 +98,8 @@ public:
     bool is_special() const { return is_special_scheme(m_scheme); }
 
     void set_scheme(DeprecatedString);
-    void set_username(StringView);
-    void set_password(StringView);
+    ErrorOr<void> set_username(StringView);
+    ErrorOr<void> set_password(StringView);
     void set_host(Host);
     void set_port(Optional<u16>);
     void set_paths(Vector<DeprecatedString> const&);
@@ -151,6 +151,9 @@ public:
 
     static bool code_point_is_in_percent_encode_set(u32 code_point, URL::PercentEncodeSet);
 
+    String const& raw_username() const { return m_username; }
+    String const& raw_password() const { return m_password; }
+
 private:
     bool compute_validity() const;
 
@@ -163,10 +166,10 @@ private:
     DeprecatedString m_scheme;
 
     // A URL’s username is an ASCII string identifying a username. It is initially the empty string.
-    DeprecatedString m_username;
+    String m_username;
 
     // A URL’s password is an ASCII string identifying a password. It is initially the empty string.
-    DeprecatedString m_password;
+    String m_password;
 
     // A URL’s host is null or a host. It is initially null.
     Host m_host;
diff --git a/AK/URLParser.cpp b/AK/URLParser.cpp
index 6707593091..8a90521d5d 100644
--- a/AK/URLParser.cpp
+++ b/AK/URLParser.cpp
@@ -1102,15 +1102,15 @@ URL URLParser::basic_parse(StringView raw_input, Optional<URL> const& base_url,
                     builder.clear();
                     // 3. If passwordTokenSeen is true, then append encodedCodePoints to url’s password.
                     if (password_token_seen) {
-                        builder.append(url->password());
+                        builder.append(url->m_password);
                         URL::append_percent_encoded_if_necessary(builder, c, URL::PercentEncodeSet::Userinfo);
-                        url->m_password = builder.string_view();
+                        url->m_password = builder.to_string().release_value_but_fixme_should_propagate_errors();
                     }
                     // 4. Otherwise, append encodedCodePoints to url’s username.
                     else {
-                        builder.append(url->username());
+                        builder.append(url->m_username);
                         URL::append_percent_encoded_if_necessary(builder, c, URL::PercentEncodeSet::Userinfo);
-                        url->m_username = builder.string_view();
+                        url->m_username = builder.to_string().release_value_but_fixme_should_propagate_errors();
                     }
                 }
 
diff --git a/Userland/Libraries/LibHTTP/HttpRequest.cpp b/Userland/Libraries/LibHTTP/HttpRequest.cpp
index a21587dcea..8af802ed06 100644
--- a/Userland/Libraries/LibHTTP/HttpRequest.cpp
+++ b/Userland/Libraries/LibHTTP/HttpRequest.cpp
@@ -252,9 +252,9 @@ Optional<HttpRequest::Header> HttpRequest::get_http_basic_authentication_header(
     if (!url.includes_credentials())
         return {};
     StringBuilder builder;
-    builder.append(url.username());
+    builder.append(url.username().release_value_but_fixme_should_propagate_errors());
     builder.append(':');
-    builder.append(url.password());
+    builder.append(url.password().release_value_but_fixme_should_propagate_errors());
 
     // FIXME: change to TRY() and make method fallible
     auto token = MUST(encode_base64(MUST(builder.to_string()).bytes()));
diff --git a/Userland/Libraries/LibWeb/Fetch/Fetching/Fetching.cpp b/Userland/Libraries/LibWeb/Fetch/Fetching/Fetching.cpp
index cd0fbcd0f9..b61f747539 100644
--- a/Userland/Libraries/LibWeb/Fetch/Fetching/Fetching.cpp
+++ b/Userland/Libraries/LibWeb/Fetch/Fetching/Fetching.cpp
@@ -1455,7 +1455,7 @@ WebIDL::ExceptionOr<JS::NonnullGCPtr<PendingResponse>> http_network_or_cache_fet
                 //    true, set authorizationValue to httpRequest’s current URL, converted to an `Authorization` value.
                 else if (http_request->current_url().includes_credentials() && is_authentication_fetch == IsAuthenticationFetch::Yes) {
                     auto const& url = http_request->current_url();
-                    auto payload = TRY_OR_THROW_OOM(vm, String::formatted("{}:{}", url.username(), url.password()));
+                    auto payload = MUST(String::formatted("{}:{}", MUST(url.username()), MUST(url.password())));
                     authorization_value = TRY_OR_THROW_OOM(vm, encode_base64(payload.bytes()));
                 }
 
@@ -1612,10 +1612,10 @@ WebIDL::ExceptionOr<JS::NonnullGCPtr<PendingResponse>> http_network_or_cache_fet
                 auto password = DeprecatedString::empty();
 
                 // 3. Set the username given request’s current URL and username.
-                request->current_url().set_username(move(username));
+                MUST(request->current_url().set_username(username));
 
                 // 4. Set the password given request’s current URL and password.
-                request->current_url().set_password(move(password));
+                MUST(request->current_url().set_password(password));
             }
 
             // 4. Set response to the result of running HTTP-network-or-cache fetch given fetchParams and true.
diff --git a/Userland/Libraries/LibWeb/HTML/BrowsingContext.cpp b/Userland/Libraries/LibWeb/HTML/BrowsingContext.cpp
index 3a83011df3..27fc4ed910 100644
--- a/Userland/Libraries/LibWeb/HTML/BrowsingContext.cpp
+++ b/Userland/Libraries/LibWeb/HTML/BrowsingContext.cpp
@@ -42,8 +42,8 @@ static bool url_matches_about_blank(AK::URL const& url)
     // A URL matches about:blank if its scheme is "about", its path contains a single string "blank", its username and password are the empty string, and its host is null.
     return url.scheme() == "about"sv
         && url.serialize_path() == "blank"sv
-        && url.username().is_empty()
-        && url.password().is_empty()
+        && url.raw_username().is_empty()
+        && url.raw_password().is_empty()
         && url.host().has<Empty>();
 }
 
diff --git a/Userland/Libraries/LibWeb/HTML/HTMLHyperlinkElementUtils.cpp b/Userland/Libraries/LibWeb/HTML/HTMLHyperlinkElementUtils.cpp
index 594f4d6d88..f1d6a08fbd 100644
--- a/Userland/Libraries/LibWeb/HTML/HTMLHyperlinkElementUtils.cpp
+++ b/Userland/Libraries/LibWeb/HTML/HTMLHyperlinkElementUtils.cpp
@@ -97,7 +97,7 @@ DeprecatedString HTMLHyperlinkElementUtils::username() const
         return DeprecatedString::empty();
 
     // 3. Return this element's url's username.
-    return m_url->username();
+    return m_url->username().release_value().to_deprecated_string();
 }
 
 // https://html.spec.whatwg.org/multipage/links.html#dom-hyperlink-username
@@ -114,7 +114,7 @@ void HTMLHyperlinkElementUtils::set_username(DeprecatedString username)
         return;
 
     // 4. Set the username given this’s URL and the given value.
-    url->set_username(username);
+    MUST(url->set_username(username));
 
     // 5. Update href.
     update_href();
@@ -134,7 +134,7 @@ DeprecatedString HTMLHyperlinkElementUtils::password() const
         return DeprecatedString::empty();
 
     // 4. Return url's password.
-    return url->password();
+    return url->password().release_value().to_deprecated_string();
 }
 
 // https://html.spec.whatwg.org/multipage/links.html#dom-hyperlink-password
@@ -151,7 +151,7 @@ void HTMLHyperlinkElementUtils::set_password(DeprecatedString password)
         return;
 
     // 4. Set the password, given url and the given value.
-    url->set_password(move(password));
+    MUST(url->set_password(password));
 
     // 5. Update href.
     update_href();
diff --git a/Userland/Libraries/LibWeb/HTML/NavigableContainer.cpp b/Userland/Libraries/LibWeb/HTML/NavigableContainer.cpp
index 4f4f0f5ccd..4f4d1b0488 100644
--- a/Userland/Libraries/LibWeb/HTML/NavigableContainer.cpp
+++ b/Userland/Libraries/LibWeb/HTML/NavigableContainer.cpp
@@ -215,8 +215,8 @@ static bool url_matches_about_blank(AK::URL const& url)
     // A URL matches about:blank if its scheme is "about", its path contains a single string "blank", its username and password are the empty string, and its host is null.
     return url.scheme() == "about"sv
         && url.serialize_path() == "blank"sv
-        && url.username().is_empty()
-        && url.password().is_empty()
+        && url.raw_username().is_empty()
+        && url.raw_password().is_empty()
         && url.host().has<Empty>();
 }
 
diff --git a/Userland/Libraries/LibWeb/ReferrerPolicy/AbstractOperations.cpp b/Userland/Libraries/LibWeb/ReferrerPolicy/AbstractOperations.cpp
index 9eb0309d87..48dc150bbd 100644
--- a/Userland/Libraries/LibWeb/ReferrerPolicy/AbstractOperations.cpp
+++ b/Userland/Libraries/LibWeb/ReferrerPolicy/AbstractOperations.cpp
@@ -175,10 +175,10 @@ Optional<AK::URL> strip_url_for_use_as_referrer(Optional<AK::URL> url, OriginOnl
         return {};
 
     // 3. Set url’s username to the empty string.
-    url->set_username(""sv);
+    MUST(url->set_username(""sv));
 
     // 4. Set url’s password to the empty string.
-    url->set_password(""sv);
+    MUST(url->set_password(""sv));
 
     // 5. Set url’s fragment to null.
     url->set_fragment({});
diff --git a/Userland/Libraries/LibWeb/URL/URL.cpp b/Userland/Libraries/LibWeb/URL/URL.cpp
index 05f1af05c7..7e68f93dca 100644
--- a/Userland/Libraries/LibWeb/URL/URL.cpp
+++ b/Userland/Libraries/LibWeb/URL/URL.cpp
@@ -224,7 +224,7 @@ WebIDL::ExceptionOr<String> URL::username() const
     auto& vm = realm().vm();
 
     // The username getter steps are to return this’s URL’s username.
-    return TRY_OR_THROW_OOM(vm, String::from_deprecated_string(m_url.username()));
+    return TRY_OR_THROW_OOM(vm, m_url.username());
 }
 
 // https://url.spec.whatwg.org/#ref-for-dom-url-username%E2%91%A0
@@ -235,7 +235,7 @@ void URL::set_username(String const& username)
         return;
 
     // 2. Set the username given this’s URL and the given value.
-    m_url.set_username(username);
+    MUST(m_url.set_username(username));
 }
 
 // https://url.spec.whatwg.org/#dom-url-password
@@ -244,7 +244,7 @@ WebIDL::ExceptionOr<String> URL::password() const
     auto& vm = realm().vm();
 
     // The password getter steps are to return this’s URL’s password.
-    return TRY_OR_THROW_OOM(vm, String::from_deprecated_string(m_url.password()));
+    return TRY_OR_THROW_OOM(vm, m_url.password());
 }
 
 // https://url.spec.whatwg.org/#ref-for-dom-url-password%E2%91%A0
@@ -255,7 +255,7 @@ void URL::set_password(String const& password)
         return;
 
     // 2. Set the password given this’s URL and the given value.
-    m_url.set_password(password);
+    MUST(m_url.set_password(password));
 }
 
 // https://url.spec.whatwg.org/#dom-url-host
diff --git a/Userland/Libraries/LibWeb/XHR/XMLHttpRequest.cpp b/Userland/Libraries/LibWeb/XHR/XMLHttpRequest.cpp
index fae5c8e383..2f16354190 100644
--- a/Userland/Libraries/LibWeb/XHR/XMLHttpRequest.cpp
+++ b/Userland/Libraries/LibWeb/XHR/XMLHttpRequest.cpp
@@ -389,10 +389,10 @@ WebIDL::ExceptionOr<void> XMLHttpRequest::open(String const& method_string, Stri
     if (!parsed_url.host().has<Empty>()) {
         // 1. If the username argument is not null, set the username given parsedURL and username.
         if (username.has_value())
-            parsed_url.set_username(username.value().to_deprecated_string());
+            MUST(parsed_url.set_username(username.value()));
         // 2. If the password argument is not null, set the password given parsedURL and password.
         if (password.has_value())
-            parsed_url.set_password(password.value().to_deprecated_string());
+            MUST(parsed_url.set_password(password.value()));
     }
 
     // 9. If async is false, the current global object is a Window object, and either this’s timeout is