String.contains() does not work with regular expressions, but with simple texts, so you are actually looking at the exact sequence "%25[^A-Za-z0-9]" in your string. Also,
^ means that it should match what is NOT in the character class, that is no alphanumeric character, and this is the opposite of what you want.
You can instead use the method
(As you see, I put all the regular expression in a single string. The compiler would have done that for you, but it's more clear)
String userPassword = "%25sdflk42"; System.out.println(userPassword.contains("%25"+"[A-Za-z0-9]*")); System.out.println(userPassword.matches(".*%25[A-Za-z0-9]*"));
This will print: