Calculates Shannon entropy to classify strings: human text, encoded data, or random/encrypted.
Low (0-3): natural language. Medium (3-5): compressed or encoded. High (5+): likely encrypted or random.
Calculates the Shannon entropy of any string — a measure of randomness and information density. High entropy values indicate strings that are more likely to be cryptographic keys, tokens, or secrets. Low entropy values indicate human-readable or predictable strings.
A 256-bit random API key has high entropy (~7.5 bits per character). A password like "Summer2024!" has much lower entropy despite containing numbers and special characters.
Entropy analysis is used in secret scanning to identify potential credentials in codebases and configuration files. A high-entropy string in a config file is a candidate for manual review as a potential hardcoded secret.
It is also useful for evaluating token and session ID quality. A session identifier with low entropy may be predictable or guessable, which is a vulnerability in session management. Cryptographic randomness sources should produce values with consistently high entropy.