entropy

A terminal treemap of a directory tree, colored by Shannon entropy per file. Blue is low entropy (plaintext, structured data). Red is high entropy (near-random byte distribution: encrypted, compressed, or packed).

Useful for spotting ransomware activity, verifying a backup is actually encrypted, or finding an accidentally-committed binary blob buried in a repo.

Compressed-but-not-encrypted formats (jpg, mp4, zip) also read as high entropy. This tool measures entropy, not encryption. Treat a red box as "worth a closer look," not "definitely encrypted."

Install

go install github.com/arshnah/entropy@latest

Or build from source:

git clone https://github.com/arshnah/entropy
cd entropy
go build -o entropy .

Usage

entropy [path]

Defaults to the current directory if no path is given. Entropy is computed over the first 256KB of each file (full read for smaller files), sized concurrently with a worker pool bounded by runtime.NumCPU().

Controls:

• tab / shift+tab (or j/k, down/up): move selection
• enter (or l, right): drill into the selected directory
• backspace / esc: go back up
• q / ctrl+c: quit

Box size is proportional to file/directory size (squarified treemap layout, same class of algorithm used by ncdu/WinDirStat). Box color is entropy, scaled 0 (blue) to 8 bits/byte (red). Box labels appear once a box is large enough to hold them; smaller boxes still carry the right color, just no visible name, check the footer after selecting one.

License

See LICENSE.