They have multiple encoding patterns.
Every time you save, a random encoding is used. The encodings have an id, which is also saved (unencoded). This makes it harder (
but not impossible) to manipulate your savecode.
I believe hashing is a more clever way to prevent code manipulation.
EDIT: What I meant by hashing is adding a 2-4 characters long checksum (also called a hash sum) to the savecode. This way people can try to edit their codes all they want but it will not have any effect because they will have no chance of finding out what the new checksum is.
If I made an RPG, I would save a hero this way:
Hero type: Archer, Code: A
Hero level: 45, Code: 45
Player gold: 19455, Code: 19455
Player wood: 6, Code: 6
Item in Slot#1: Empty, Code: null
Item in Slot#2: Crown of Kings +5, Code: Crwn
Item in Slot#3: Boots of Speed, Code: Btos
Item in Slot#4: Empty, Code: null
Item in Slot#5: Empty, Code: null
Item in Slot#6: Potion of health, Code: Poht
Quest 1 status: Completed, Code: 3
Quest 2 status: Completed, Code: 3
Quest 3 status: Started, Code: 2
Quest 4 status: Discovered, Code: 1
Quest 5 status: Not discovered, Code: 0
Type and level: A45-
Gold and wood: 19455-6-
Items: nullCrwnBtosnullnullPoht-
Quests: 33210
Full savecode: A45-19455-6-nullCrwnBtosnullnullPoht-33210
Get a checksum: md5
We don't even have to encode (turn the code into something players don't understand) their savecode, the hash sum takes care of potential cheaters.
Savecode: A45-19455-6-nullCrwnBtosnullnullPoht-33210-md5
We can optimize the item code by replacing 4 char strings with 1-2 char numbers: A45-19455-6-0-16-27-0-0-2-33210-md5
The checksum changes with every minor modification of gold or other variable:
The hero kills a creep (levels up, gets gold) and saves again: A46-19500-6-0-16-27-0-0-2-33210-xav
The hero kills another creep (gets gold) and saves again: A46-19515-6-0-16-27-0-0-2-33210-upt
The hero kills another creep (gets gold) and saves again: A46-19535-6-0-16-27-0-0-2-33210-dmz
The hero kills another creep (gets gold) and saves again: A46-19610-6-0-16-27-0-0-2-33210-awg
And the chance of getting a 3 digit checksum right is:
Characters: abcdefghijklmnopqrstuvwxyz1234567890 (36)
Digits: 3
Exponentiation: 36^3 = 46656
Chance: 1:46656
Calculating percent: 0.00002%
As you can see, it is pretty low.