Entropy Calculator
Shannon entropy of any text — a genuine static-analysis signal for spotting packed or encrypted data.
Entropy measures unpredictability, in bits. It is how you tell a random session token from a sequential ID, how packers and encryption announce themselves inside a binary, and how secret scanners decide that a long string in a repository is worth flagging.
How to use it
- Paste text or hex.
- Read the length and Shannon entropy.
- Compare a real random token against a word or a predictable pattern.
What to take away
Rough bands to carry in your head
English text sits near 4 bits per character. Base64 of random data approaches 6. Compressed or encrypted bytes approach 8 bits per byte, which is what makes high entropy suspicious inside an otherwise normal file.
High entropy is a hint, not a verdict
Secret scanners flag high-entropy strings and produce plenty of false positives on hashes, UUIDs and minified code. It narrows the search; it does not decide.
Low entropy in a token is a finding
A session identifier that is short, sequential or timestamp-derived can be guessed. Entropy is how you demonstrate that in a report.
Frequently asked questions
What is a good entropy for a session token?
At least 128 bits of real randomness from a cryptographically secure generator. Note that this measures the generator, not the string — a long token from a predictable source is still weak.
Why do malware analysts check entropy?
Packed and encrypted sections have near-maximum entropy while normal code does not, so an entropy graph across a binary shows immediately where the interesting parts are.
Does high entropy mean a string is encrypted?
No. Compressed data, random identifiers and encoded binaries all score high. It means "not ordinary text", which is a much weaker claim.
Where this fits in the course
This security tool pairs with Path 17 — Malware & RE — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Hash Identifier — Paste a hash and get likely algorithms, guessed from its length and character set.
- Leaked Secret Hunt — A public GitHub repo dump. Find the hardcoded API key an automated scanner would catch in minutes — before an attacker does.
- Malware Strings Triage Lab — A raw strings dump from a suspicious binary. Spot the IOCs — a C2 domain, a mutex, a registry key — before touching a disassembler.
- Password Strength — Rough entropy and crack-time estimate for a password, with feedback.