How Entropy testing: manual vs. quantum-random works

What each button in the tool actually computes, step by step — with the real formulas.

Scope: 3 of NIST SP 800-90B's 10 non-IID estimators

NIST SP 800-90B ("Recommendation for the Entropy Sources Used for Random Bit Generation") defines ten different non-IID min-entropy estimators in section 6.3, each catching a different kind of statistical weakness. This tool implements three — Most Common Value (6.3.1), Collision (6.3.2), and Markov (6.3.3) — ported directly from NIST's own reference implementation rather than re-derived from scratch. It skips the other seven non-IID estimators and the whole IID permutation-testing track, and it runs on whatever short sequence you type or fetch, where NIST's own validation runs use at least 1,000,000 samples. Treat the numbers below as a faithful demonstration of how real entropy estimators work, not a certification result.

Min-entropy is also a stricter, more pessimistic measure than the Shannon entropy most people learn first: Shannon entropy is an average over the whole distribution, while min-entropy asks "how hard is it to guess the single most likely outcome?" — the question that actually matters for a cryptographic key, since an attacker only needs one correct guess. A source can have high Shannon entropy while still leaking enough structure to make min-entropy much lower.

H_{\infty} = -\log_2\left(\max_i p_i\right)

Min-entropy: driven entirely by the single most probable outcome, unlike Shannon entropy's average over the whole distribution.

Most Common Value Estimate — §6.3.1

The simplest estimator: count how often the most frequent symbol (0 or 1) occurs, then compute a 99%-confidence upper bound on its true probability rather than trusting the raw sample proportion directly — a short or lucky sequence could otherwise look more random than it really is. That conservative probability is converted straight to a min-entropy figure.

p_u = \min\left(1,\ \hat{p} + 2.5758\sqrt{\frac{\hat{p}(1-\hat{p})}{n-1}}\right)

H_{\infty} = -\log_2(p_u)

Collision Estimate — §6.3.2

Walks the sequence measuring how long it takes to see a repeated pair of consecutive symbols (a "collision"). For a binary alphabet this collapses to a fixed choice: if two consecutive bits already match, that's a 2-bit collision; otherwise the third bit is forced to repeat one of the first two, giving a 3-bit collision. The mean collision length across the whole sequence is converted to a probability, and then to min-entropy, with the same 99%-confidence downward adjustment used above.

\bar{X} = \frac{1}{v}\sum_{k=1}^{v} t_k \qquad \hat\sigma = \sqrt{\frac{\sum t_k^2 - v\bar{X}^2}{v-1}}

p = 0.5 + \sqrt{1.25 - 0.5\,\bar{X}'} \quad\text{(when } \bar{X}' < 2.5\text{)}

Markov Estimate — §6.3.3

Models the sequence as a first-order, 2-state Markov chain — tracking not just how often each bit occurs, but how often a 0 is followed by a 0, a 1 by a 0, and so on. From those transition probabilities, the estimator works out the min-entropy of the six most probable 128-bit repeating patterns a chain with those statistics could produce (all-zeros, alternating 0101..., and so on), and reports the worst of the six. A sequence that is unbiased bit-by-bit but has strong bit-to-bit correlation — more random-looking in isolation than it really is — gets caught here even when the Most Common Value estimate above doesn't catch it.

The six candidate patterns evaluated

↔ drag to resize

000...0 (all zeros)       0101...01 (alternating, starting 0)
011...1 (0 then all ones)  100...0 (1 then all zeros)
1010...10 (alternating, starting 1)   111...1 (all ones)

The estimator takes the minimum entropy across all six — the single worst-case pattern the observed transition probabilities could be hiding.

H_{000\ldots0} = -\log_2 P(0) - 127\log_2 P(0{\to}0)

H_{0101\ldots} = -\log_2 P(0) - 64\log_2 P(0{\to}1) - 63\log_2 P(1{\to}0)

The quantum-random source

The "Fetch from ANU QRNG" button calls this site's own server, which in turn calls the Australian National University's Quantum Random Numbers Server (qrng.anu.edu.au) — bits generated by measuring quantum vacuum fluctuations, a genuinely different trust model from a software CSPRNG. The call goes through this site's own API route rather than straight from your browser because ANU's service sends no CORS headers; a direct browser fetch is rejected by the browser itself before the request even reaches ANU. This is also a free, legacy, rate-limited endpoint that ANU has marked as being phased out in favor of a paid API — occasional failures reflect that upstream service, not a bug here.