Entropy analysis
Measure the byte-level randomness of a file. High entropy suggests compression or encryption, not proof of either.
Runs on your device. The file is never uploaded.
Entropy analysis reports Shannon entropy over byte values, from 0 to 8 bits per byte, for the whole file and for each consecutive window. windowSize defaults to 256 bytes, and 0 asks for the overall figure alone. Above 7.5 the report calls it high, which fits compression as readily as encryption and names no algorithm.
Questions
What does the bits per byte figure mean?
It is Shannon entropy over the 256 byte values, so it runs from 0 to 8. Zero means every byte is the same. Eight means all 256 values are equally likely. The report labels above 7.5 as high and consistent with compressed or encrypted data, above 6.5 as moderate, and anything lower as consistent with structured or repetitive data.
Does high entropy prove the file is encrypted?
No, and this is the mistake to avoid in a report. Compressed archives, JPEG and PNG image data, video, random padding and key material all measure above 7.5. Entropy measures the byte distribution and nothing else: it cannot tell encryption from compression, cannot name an algorithm, and cannot show a key exists. It tells you a region is not plain text or plain structure. That is the whole claim.
Can low entropy prove a file is not encrypted?
No. A short encrypted payload inside a mostly zero-filled file drags the overall figure down, and encrypted data wrapped in base64 or hex sits well below 7.5 because the alphabet shrank. Read the per-window figures rather than the overall number when you are looking for a small region inside a large file.
What does the windowSize option do?
It sets the block size for the per-region breakdown, in bytes, defaulting to 256. Set it to 0 for the whole-file figure only. Blocks are consecutive and do not overlap, so a window of 256 reports offsets 0x0, 0x100, 0x200 and so on, each with its own entropy to three decimals. The breakdown is skipped when the file is not longer than one window.
Why did it refuse my windowSize?
Because it was not a whole number of 0 or more. The message is "windowSize must be a whole number of 0 or more". Decimals, negatives and text all hit it. The field is typed as text so that 0 can mean whole-file only rather than being confused with an empty box.
How do I find where an embedded blob starts?
Run this with a window small enough to resolve it, look for the offset where the per-window figures jump, then confirm at that offset. Scan for embedded files checks the same file for known signatures, and Hex viewer shows the bytes around the boundary with any signature annotated. Entropy locates the edge; the signature tells you what is on the other side of it.