What Shannon entropy actually measures

Shannon entropy quantifies how unpredictable a string is based purely on how often each character appears, expressed in bits per character. A string that reuses very few characters (like "aaaabbbb") has low entropy because you could guess each next character with reasonable success; a string that draws evenly across a large alphabet has high entropy because no character is favored. Crucially, this measurement is blind to order and structure — it treats "password123" and a scrambled anagram of the same characters identically, since both have exactly the same character frequency distribution despite one being trivially guessable and the other only slightly less so.

A useful signal, not a verdict

Because entropy only sees frequency, it can be fooled in both directions: a low-entropy string can still be a fine secret if it's long enough, and a high-entropy string can still be predictable if it was generated by a weak or seeded random source rather than a cryptographic one. Where this measurement earns its keep is as a fast, first-pass filter — scanning a log or config file for strings that look suspiciously low-entropy for something claiming to be a random token or API key, which is a genuinely useful smell test even though it can never substitute for verifying the actual generation method behind a real secret.