Entropy is a measure of how random a string looks. Secret scanners use it to flag strings that resemble generated keys, even when no known pattern matches. It catches unusual secrets, but it also flags hashes, identifiers and encoded data, so it is the noisiest detection method and needs tuning.
What entropy means here
Shannon entropy, in this context, scores how evenly the characters in a string are spread. A word like "password" scores low because few distinct characters repeat in a predictable way. A 40 character string of mixed letters and digits scores high.
Real keys are usually random, so they score high. That is the whole idea: if a string is long, random looking and sitting next to a name like "token", it might be a secret.
Two ways scanners find secrets
| Method | How it works | Strength | Weakness |
|---|---|---|---|
| Pattern rules | Match known formats, such as a fixed prefix and length | Few false positives | Misses formats it has no rule for |
| Entropy checks | Flag high randomness | Finds unknown formats | Many false positives |
Most good setups use both. Patterns give precise alerts for popular services. Entropy is the safety net for internal or custom secrets.
Why entropy flags harmless strings
Plenty of legitimate content is random looking:
- commit hashes and file checksums
- UUIDs and database identifiers
- base64 encoded images or fixtures
- lockfile integrity values
- minified or generated code
Entropy cannot tell a checksum from a password, because both look random. Context can: a variable named api_key is more suspicious than one named checksum.
How to tune it
The detect-secrets project documents separate detectors for base64 and hex strings, with default thresholds of 4.5 and 3.0. Raising a threshold means fewer alerts and a higher chance of missing a real key. Lowering it does the opposite. There is no right number, only a tradeoff you choose on purpose.
Practical steps:
- Exclude generated paths such as lockfiles, vendor folders and build output.
- Require a keyword nearby, such as key, secret, token or password, before alerting on an entropy hit.
- Use a shared set of obvious test values so fixtures are recognised. OWASP suggests standard test secrets across an organisation to cut false positives.
- Review a sample of alerts monthly and adjust.
- Keep pattern based detectors for the services you actually use at full strength.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how ongoing checks surface new findings over time, which is why tuning noise matters.
Quick check
Is a high entropy string always a secret?
No. Hashes, identifiers and encoded data are high entropy too. Treat it as a lead to check, not a verdict.
Can I turn entropy detection off?
You can, but you will lose coverage of custom secrets with no known format. Tuning is usually better than switching it off.
For fixtures, see fake credentials in test fixtures without scanner noise. You can also run a free Safeguard scan to see how findings are grouped.
Sources
Last reviewed: 19 October 2026.
