When calling compact(), only the signature of the token is URL-encoded. The header and body can still have characters such as '=' in them.