Secret Entropy Checker

For general API keys and secrets: at least 128 bits of entropy (roughly 22+ random Base64 characters, or 32 hex characters). For symmetric encryption keys (AES-256): exactly 256 bits. For HMAC secrets (JWT HS256): at least 256 bits per NIST SP 800-107 recommendation.

Shannon entropy measures the unpredictability in a string. It's calculated per-character as H = -Σ p(c) × log₂(p(c)). For a string with total entropy bits = length × H, higher means harder to guess. A fully random Base64 string has ~6 bits/char; a string like 'aaaaaaa' has 0 bits/char.

High entropy is necessary but not sufficient. The secret must also be generated by a cryptographically secure random number generator (CSPRNG), not derived from a timestamp, username, or any predictable input. Use crypto.randomBytes() in Node.js, secrets.token_bytes() in Python, or /dev/urandom.

Raw bits = length × log₂(charset_size) — assumes all characters drawn randomly. Effective (Shannon) entropy = actual observed randomness, penalizing repetition and patterns. A good secret should have effective entropy close to its raw bit estimate.

Hex (0-9, a-f): 4 bits/char — easy to read but less dense. Base64 (a-z, A-Z, 0-9, +, /): ~6 bits/char — more compact, 43 chars = 256 bits. URL-safe Base64: same density, safe in headers/URLs. For most uses: generate 32 random bytes and encode as hex (64 chars) or Base64 (43 chars).