Loading Shannon Entropy Calculator…
Nothing entered yet. Paste anything and its information density is measured here, in bits per character.
The exact figures are logarithms of the alphabet size. The English one is Shannon’s 1951 measurement of single-letter frequencies over the 26 letters and a space; the same paper puts English at nearer one bit per letter once the surrounding words are taken into account, which is a thing this page structurally cannot see.
This measures the string, not the way it was chosen. abababab scores exactly 1.000 bits per character, and so does a random string of eight coin flips — the first is guessed instantly and the second takes 256 attempts. Password strength comes from the size of the set the password was drawn from, which no amount of staring at the result can recover. Frequency counting sees no order, no repetition and no words: it would give the same answer to these characters in any arrangement at all.
Where it does earn its keep is triage. A 44-character run at 5 bits over base64 is a key or a token; the same length of log message sits well below that. High entropy in a field that should hold a name, or low entropy in a field that should hold a secret, is the signal — and a compression test is the natural next one, because a compressor finds the structure this measure is blind to.
Shannon entropy is the average surprise in a sequence of symbols. Count how often each character appears, turn the counts into proportions, and sum the negative of each proportion multiplied by its own base-two logarithm; the answer is how many bits of information one character carries on average, given the mix in front of you and nothing else.
The definition comes from Claude Shannon’s 1948 paper on communication, where it measures how much a message can be compressed before something is lost. Applied to one string, it is a fast way to ask whether the characters are spread evenly across a large alphabet or concentrated in a few — which is exactly the difference between a token and a sentence.
A string of forty-four characters can contain at most forty-four distinct symbols, so it can never demonstrate more than the base-two logarithm of its own length. Worse, counting frequencies from a small sample underestimates the true spread: with sixty-four possible characters and only forty-four drawn, several will be missing purely by chance.
The size of that undercount is known — roughly one less than the alphabet size, divided by twice the length and by the natural logarithm of two, a correction published by Miller in 1955. It matters here because a genuinely random base64 key of that length measures about five bits per character rather than six, and calling that eighty-three per cent of maximum would be an accusation of structure that the string does not deserve. This page compares against the corrected figure instead.
This is the measure’s best use. A field that should hold a name and instead holds forty characters near the ceiling for base64 is carrying a key, a token or ciphertext. A field that should hold a secret and reads like English is holding a placeholder somebody never replaced.
The alphabet matters as much as the number. English prose and a hexadecimal digest can land within a tenth of a bit of each other — around four bits per character — and mean entirely different things, because prose is drawn from a twenty-seven symbol alphabet it barely fills while the digest saturates a sixteen symbol one. That is why the reading here is always given as a share of what its own alphabet allows.
Order is invisible to it. The same characters shuffled into any arrangement give an identical result, so a repeating pattern and a random draw over the same symbols are indistinguishable — a string alternating two letters scores exactly one bit per character, and so does a genuine sequence of coin flips.
Shannon measured this limitation himself in 1951: single-letter frequencies put printed English at 4.14 bits per letter, while accounting for the surrounding words brings the real figure down to roughly one. Everything between those two numbers is structure that a per-character count is blind to. When that structure is what you are after, a compressor is the better instrument, since finding repetition is precisely what it does.
No, and this is the most common misreading. Entropy here describes the string you pasted; password strength describes the set it was drawn from. A password chosen by a person from a predictable pattern can score well and still be guessed in seconds.
Almost certainly not. At that length the measurement is capped by the sample itself, and the expected maximum shown beside the reading is the number to compare against rather than the alphabet’s theoretical ceiling.
It is a reasonable first filter and a poor last one. Real scanners combine an entropy threshold with pattern rules for known key formats, because entropy alone flags minified code and base64 images while missing short credentials entirely.
The base-two logarithm of the number of distinct symbols present: four for hexadecimal, six for base64, eight per byte for encrypted or compressed data. Reaching the exact figure requires a long string in which every symbol appears equally often.