Tiny Online Tools
What entropy tells you
Shannon entropy measures how unpredictable a run of bytes is, on a scale from 0 (every byte the same) to 8 bits per byte (bytes are as random as they can be — like a coin flip repeated eight times per byte). This tool computes entropy over a sliding window across the whole file and plots it as a line chart, so you can see at a glance where a file's "randomness" changes.
- Near 8: typically compressed data, encrypted data, or already-packed/obfuscated code — a hallmark reverse engineers look for when triaging an unfamiliar binary.
- Roughly 4–6.5: typical of executable code or general-purpose data.
- Near 0: padding, alignment gaps, or long runs of a single byte value (often zero).
Section overlay
When this tool recognizes the file's format — ELF, PE (Windows), Mach-O (macOS/iOS), or WebAssembly — it reuses the site's own verified format parsers to overlay each section or segment's real byte range behind the entropy curve, so you can see exactly which section is compressed, which holds code, and which is padding. This overlay only appears when the format is confidently detected and parses cleanly; on an unrecognized or partially-parseable file, you still get a full entropy plot, just without section context — and the tool says so plainly rather than pretending otherwise.
Choosing a window size
A smaller window (64–256 bytes) reacts quickly to short high-entropy regions, like an embedded compressed resource inside an otherwise plain executable, at the cost of a noisier plot. A larger window (1–4 KB) smooths the curve, better for a broad, whole-file picture.
Typical uses
Spot a packed or obfuscated section in a suspicious executable, verify that a build's compressed asset actually landed at high entropy, or simply explore how "random" different parts of a file are.
Privacy
Everything runs locally in your browser using JavaScript. The file you choose is never uploaded anywhere.