b2KIT

Entropy Analyzer

Calculate Shannon entropy of text, files, or byte sequences. Visualize entropy distribution to detect encrypted or compressed data.

Tested tool guide Tested browser tools Checked August 16, 2026

What Entropy Analyzer does, with a checked example

Paste text, drop in a file, or type a byte sequence, and this tool reports the input's Shannon entropy in bits per byte: how evenly its byte values spread across the 0-255 range, from 0 (one byte repeated) to 8 (all values equally likely). A distribution view plots each byte value's share of the input, so encrypted or compressed payloads stand out as a flat band near the top. The thing most users get wrong: entropy ignores order, so a repeating pattern and a shuffled string made of the same characters score identically. A high number means no byte-level regularity, nothing deeper.

Worked example

A concrete input and expected output from the current implementation.

Input

the quick brown fox jumps over the lazy dog

Expected output

43 bytes, 27 distinct byte values; Shannon entropy 4.39 bits per byte of a maximum 8; total entropy 188.6 bits.

The 43 bytes use 27 distinct values: the space appears 8 times, 'o' 4 times, 'e' 3 times, 't', 'h', 'u', and 'r' twice each, and the remaining 20 letters once each. With N = 43 and count c per symbol, H = -sum(p*log2(p)) = (8*log2(43/8) + 4*log2(43/4) + 3*log2(43/3) + 8*log2(43/2) + 20*log2(43)) / 43 = 188.57 / 43 = 4.39 bits per byte, and total entropy is 43 * 4.39 = 188.6 bits. The eight spaces and repeated letters concentrate probability, pulling the score below the 8.0 a uniform byte stream would show, while most letters appear once, keeping it above 0. Ordinary English prose generally lands between about 4 and 4.5 bits per byte.

How the result is produced

1

Counting bytes, applying the formula

The tool tabulates how often each of the 256 possible byte values occurs, converts the counts to probabilities, and computes H = -sum(p*log2(p)), reported in bits per byte. All 256 values equally likely gives exactly 8; a single repeated byte gives 0. The formula is logarithmic, so a mid-range value like 4 is not 'half random' - it reflects a genuine spread among a few dozen symbols.

2

Reading the distribution view

The distribution view draws one bar per byte value, proportional to how often that value appears, so structure shows at a glance: plaintext clusters in a narrow band of letters and punctuation, while encrypted, compressed, or hashed data spreads evenly across all 256 positions. Files are read byte-for-byte as stored, so container headers, checksums, and framing count as ordinary bytes and can pull an otherwise high-entropy payload's score down.

Good uses

  • Triaging a suspicious file: a blob scoring near 8 bits per byte with an even spread is likely encrypted or compressed, while plaintext, source code, and structured formats score far lower - a quick way to decide whether a payload is worth unpacking or decrypting. Analysis runs entirely in the browser, so the file never leaves the machine.
  • Sanity-checking a random source: bytes from a sound random generator or a freshly derived key should sit close to 8 bits per byte on a long sample, so a visibly lower score flags bias or a weak seed before the data is trusted for cryptography.
  • Estimating compressibility: per-byte entropy sets the floor for byte-oriented coding, so text near 4.4 bits per byte cannot be squeezed much below about half its size by an entropy coder - a quick check on whether compressing a dataset is worthwhile.

Limits and checks

  • Entropy ignores order: 'abababab' and 'aaaabbbb' both return exactly 1 bit per byte, and a repeated block like '0123456789' scores log2(10) = 3.32 bits per byte despite being perfectly predictable. The score says nothing about pattern, only about frequency spread.
  • A high score is not proof of encryption: base64 text with uniform symbols scores exactly 6 bits per byte, image data and hashes land near the top, and any packed or compressed format does too. Short inputs are also capped - the maximum possible score is log2 of the number of distinct symbols, so a 3-byte input can never exceed about 1.58 bits per byte.
  • Results depend on how the input is symbolized: the same text measured as characters or as UTF-8 bytes gives different values, because non-ASCII characters expand to two or more bytes ('héllo' is six bytes, five characters), and file mode counts headers and padding as ordinary bytes. Compare only inputs measured the same way, or the verdict drifts.

Common questions

What score means a file is encrypted?

There is no clean threshold. Encrypted and well-compressed data typically score from roughly 7.9 up to just under 8 bits per byte on a large enough sample, with every byte value appearing about equally often, while plaintext and structured data score lower. But base64, images, hashes, and packed formats also reach the high end, so the number alone cannot prove encryption - it only shows the data has no byte-level regularity.

Why does my English text score about 4.4 instead of near 0?

Because the tool measures the spread of byte frequencies, not meaning or predictability. Letters and the space character appear with naturally uneven frequencies, and that spread works out to roughly 4 to 4.5 bits per byte for ordinary prose. The often-quoted figure of about 1 bit per character comes from predictive letter models that use surrounding context, which a pure frequency count never does.

References and verification

The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools