Contact

Tools  /  Security  /  Entropy Calculator

SECURITY

Entropy Calculator

Shannon entropy, min-entropy, and pool-based theoretical maximum for any text, with a character-frequency histogram, class breakdown, and repeated-pattern detection.

More Security tools

Hash Identifier Random Token Generator UUID Validator OAuth URL Builder Basic Auth Generator Bearer Token Builder

What this tool does

Computes several real entropy measures for any pasted text -- not just a single bits-per-character figure, but the empirical Shannon entropy actually observed, the more conservative min-entropy (worst-case guessing difficulty), the theoretical maximum for whatever character pool the text actually draws from, and how far short of that maximum the real text falls.

Shannon entropy vs. min-entropy

Shannon entropy is the average information content per character, based on how often each character actually appears -- the textbook definition, and a reasonable average-case measure. Min-entropy is more conservative: it's based only on the single most frequent character (-log2(max probability)), which better reflects the worst case an attacker actually exploits -- guessing the most likely value first. Security guidance (including NIST SP 800-90B) generally prefers min-entropy for anything security-relevant, since Shannon entropy can overstate real unpredictability when a distribution is skewed.

Theoretical maximum and redundancy

The tool detects the smallest standard character pool that covers every character actually used (digits only, lowercase only, alphanumeric, printable ASCII, etc.) and computes what the entropy would be if every character in that pool were equally likely -- log2(pool size) per character. The gap between that theoretical maximum and the real observed entropy is the redundancy -- ordinary English text typically runs 60-80% redundant against its own alphabet, while a genuinely random string of the same pool approaches 0%.

Character-class breakdown and frequency histogram

Every character is classified as lowercase, uppercase, digit, symbol, whitespace, or other/Unicode, with counts and percentages -- plus a frequency histogram of the most common individual characters, useful for spotting an unexpectedly skewed distribution at a glance.

Repeated-pattern detection

Finds the longest substring that repeats anywhere in the text -- a password or key with an obviously repeating chunk has real entropy well below what a raw length × alphabet-size calculation would suggest, since the repeated portion carries no new information the second time.

What this is for

Useful for sanity-checking whether a generated key/token actually looks random, comparing the real information density of different texts, or just understanding why a password generator computes the entropy figure it does -- this tool shows the underlying math rather than a single opaque number.

Privacy

Every calculation happens entirely in your browser. Nothing is uploaded.

FAQ

Frequently asked questions

Why does this show both Shannon entropy and min-entropy?
Shannon entropy is the average-case information content based on each character's actual frequency -- a reasonable general measure. Min-entropy is based only on the single most frequent character and reflects the worst case an attacker actually exploits (guessing the most likely value first), which security guidance like NIST SP 800-90B generally prefers for anything security-relevant.
What does "redundancy" mean here?
How far the text's real observed entropy falls short of the theoretical maximum for its detected character pool (log2(pool size) per character). Ordinary English text is typically 60-80% redundant against its own alphabet; a genuinely random string from the same pool approaches 0% redundancy.
How is the character pool detected?
The tool checks the actual characters used against a list of standard pools (digits only, lowercase only, alphanumeric, printable ASCII, etc.) from smallest to largest and picks the smallest one that covers everything present -- the same convention a password generator would use to compute a realistic pool size.
Why does a repeated substring matter for entropy?
A string with an obviously repeating chunk carries less real information than its raw length suggests -- the repeated portion doesn't add new unpredictability the second time it appears. This tool finds the longest such repeat directly rather than leaving it to be noticed by eye.
Is a higher entropy number always better?
For something security-relevant (a password, key, or token), yes, generally -- but the figure only matters relative to what it needs to resist. 128 bits of min-entropy is effectively uncrackable for almost any purpose; 20 bits is weak no matter how it's measured.
Can I check a whole file instead of pasted text?
Yes -- use the upload button to load a text file's contents directly into the input.
Does this tell me if my password is good?
It tells you the real information-theoretic entropy of what you typed, which is one real input into password strength -- for a fuller pattern-aware strength check (common passwords, keyboard walks, leetspeak substitutions), use this site's dedicated Password Strength Checker.
Is anything I paste or upload sent anywhere?
No. Every calculation happens entirely in your browser -- this tool has no server component.
Theme Accent