File Entropy Analyzer

Chart a file's entropy chunk by chunk to see where it is compressed, encrypted or padded - with a clear warning that high entropy is not evidence of anything malicious.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop a file to measure it

Up to 128 MB. Read in your browser.

Window size Applies to the next file you drop.

Entropy cannot tell encryption from compression

This is the first thing to say, because it is the conclusion people draw from this measurement more often than any other, and it is wrong.

Shannon entropy measures how unpredictable the bytes are, from 0 to 8 bits per byte. Encrypted data measures near 8 because good encryption produces output indistinguishable from random. So does compressed data, for the same reason - compression works by removing predictability. A ZIP, a JPEG, an encrypted volume and a block of random padding all sit at roughly the same number. There is no threshold that separates them, and any tool claiming a file is encrypted because its entropy is high is guessing.

What it is genuinely good for

Finding where inside a file the character of the data changes. A single number for a whole file says little; a chart of entropy across it says a lot. The shape worth looking for is a low-entropy file with a high-entropy block inside it - that is what an embedded archive, an encrypted payload, or a packed section of an executable looks like.

A uniformly high line, by contrast, usually just means the file is compressed, which for a ZIP or an MP4 is not news. The page compares against what the detected file type would normally show, so "high entropy, and that is expected for this format" is distinguished from "high entropy, and this format is not normally compressed".

The byte distribution is the other honest view

The histogram shows how often each of the 256 byte values appears. Text clusters hard in the printable ASCII range. Compressed and encrypted data spreads evenly across the whole range. A file that claims to be text and shows an even spread is worth a second look - and unlike the entropy number, the distribution shows you why.

On malware triage

Entropy is a standard first look at a suspicious binary, and it is genuinely useful there - packers leave a characteristic signature of a small low-entropy loader followed by a large high-entropy blob. But plenty of entirely legitimate software is compressed or packed for perfectly ordinary reasons, so high entropy is a reason to look closer, never a finding on its own.

Read locally

The file is read with FileReader and analysed in the page. Nothing is uploaded, which matters when the file being measured is a suspicious sample.

Frequently asked questions

My file measures 7.99. Is it encrypted?

Unknown, and that is the honest answer. Compressed archives, media files, encrypted data and random padding all measure about that. Check what the file type is first - if it is a ZIP, 7.99 is simply what a ZIP looks like.

What entropy does normal text have?

Around 4 to 5 bits per byte in English. Source code is similar. Anything below 2 is highly repetitive - padding, zeroes, or a sparse file.

Why does the window size matter?

It is the resolution of the chart. A small window finds small embedded regions but makes the chart noisy; a large one smooths over exactly the anomalies you might be looking for. 4 KB is a reasonable default for files up to a few megabytes.

Is the file uploaded?

No. It is read and measured entirely in your browser.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.