Entropy / Randomness Analyzer

Overview

Computes the Shannon entropy of your input over its UTF-8 bytes, reporting bits per byte, a normalized randomness percentage, mean byte value, distinct byte count and a verdict from Low randomness to Encrypted/compressed. All analysis runs locally as you type, with no data leaving the page.

How It Works

Paste any text into the input box. Six cards update live: Shannon entropy in bits per byte, randomness as a percentage of the 8-bit maximum, the mean byte value, how many of the 256 possible byte values appear, the total byte count, and a verdict placing the input in one of four bands. Clear the box to reset. Nothing is uploaded or stored.

Step-by-Step Usage Guide

1. Paste the data - text, token, encoded blob - into the input area.
2. Read the entropy figure in bits per byte, where 8.0 is the theoretical maximum for uniformly distributed bytes.
3. Check the distinct byte count and mean byte for a quick structural picture beyond the headline number.
4. Interpret the verdict with input length in mind: short samples max out low no matter how random they are.

Technical Specifications & Standards

The measure is Shannon entropy over the byte distribution: for each of the 256 byte values, compute its frequency p and sum -p log2 p, giving a value between 0 and 8 bits per byte. The verdict thresholds band the result: above 7.5 the bytes look encrypted or compressed, above 5 high randomness, above 3 structured, otherwise low. Two calibration points prevent misreading the number. First, short inputs cannot score high: a ten-character string has at most ten distinct byte values, so its average entropy per byte is capped well below 8 regardless of how random it is - the verdict is pessimistic by construction on short samples, which includes most passwords. Second, high entropy is not evidence of encryption, and low entropy is not evidence of plaintext: a base64 blob of a JPEG reads as high-entropy text, while a short encrypted key can read as structured. The tool computes over UTF-8 bytes, so multi-byte characters add distinct byte values that inflate apparent randomness for non-ASCII text. Within those limits, the metric is genuinely useful for the intended checks: distinguishing compressed or encrypted payloads from human-readable data, gauging whether a generated key blob has the byte spread you expect, and comparing structure across samples.

Targeted Use Cases

• Checking whether an unknown blob is plausibly compressed or encrypted (near 8 bits/byte) versus human-readable.
• Comparing generated key material or token samples for the byte-level spread you expect from a good generator.
• Teaching Shannon entropy with live feedback - watch structured English text score low and random bytes score near the ceiling.
• Sanity-checking that an encoding step did not collapse your data's variability.

Notes & Gotchas

• Interpret scores against input length: entropy per byte needs sample size, and a 20-character string cannot reach the encrypted band even if truly random.
• Do not equate high entropy with encryption - base64 of an image also scores high. The number describes the byte distribution, not the content's meaning.
• Use it comparatively: the change in entropy between two samples often tells you more than either absolute value.
• For password strength, use a proper strength checker - this metric ignores dictionary structure entirely, which is where real passwords fail.

Frequently Asked Questions