Why does a base64 encoded string have an = sign at the end

Q Does a base64 string always end with =?

A: No. (the word usb is base64 encoded into dXNi)

Q Why does an = get appended at the end?

A: As a short answer:
The last character (= sign) is added only as a complement (padding) in the final process of encoding a message with a special number of characters.

You will not have an = sign if your string has a multiple of 3 characters, because Base64 encoding takes each three bytes (a character=1 byte) and represents them as four printable characters in the ASCII standard.

Example:

(a) If you want to encode

ABCDEFG <=> [ABC] [DEF] [G]

Base64 deals with the first block (producing 4 characters) and the second (as they are complete). But for the third, it will add a double == in the output in order to complete the 4 needed characters. Thus, the result will be QUJD REVG Rw== (without spaces).

[ABC] => QUJD

[DEF] => REVG

[G] => Rw==

(b) If you want to encode ABCDEFGH <=> [ABC] [DEF] [GH]

similarly, it will add one = at the end of the output to get 4 characters.

The result will be QUJD REVG R0g= (without spaces).

[ABC] => QUJD

[DEF] => REVG

[GH] => R0g=

It serves as padding.

A more complete answer is that a base64 encoded string doesn't always end with a =, it will only end with one or two = if they are required to pad the string out to the proper length.

From Wikipedia:

The final '==' sequence indicates that the last group contained only one byte, and '=' indicates that it contained two bytes.

Thus, this is some sort of padding.

Its defined in RFC 2045 as a special padding character if fewer than 24 bits are available at the end of the encoded data.