John Walker (Autodesk co-founder, keeper of Fourmilab) wrote ent in the early '90s to answer a deceptively simple question: are these bytes actually random? Three decades later it still lives in every distro's repos (apt install ent, brew install ent) and still runs in a millisecond on a gigabyte file. Most developers have never heard of it.

The mainstream alternative is dieharder — a battery of statistical tests that takes hours to run and prints enough numbers to induce catatonia. ent gives you five diagnostics on one screen, right now, and that's usually enough.

The sample output tells you everything:

$ dd if=/dev/urandom of=r.bin bs=1M count=10 status=none
$ ent r.bin
Entropy = 7.999982 bits per byte.

Optimum compression would reduce the size
of this 10485760 byte file by 0 percent.

Chi square distribution for 10485760 samples is 236.79,
and randomly would exceed this value 78.61 percent of the times.

Arithmetic mean value of data bytes is 127.4808 (127.5 = random).
Monte Carlo value for Pi is 3.142031732 (error 0.01 percent).
Serial correlation coefficient is 0.000203 (totally uncorrelated = 0.0).

Entropy at 7.9999 bits/byte and Monte Carlo Pi within 0.01% — that's a healthy CSPRNG. Now compare to a text file:

$ ent /etc/passwd
Entropy = 4.912847 bits per byte.
Optimum compression would reduce the size of this file by 38 percent.
Chi square distribution ... would exceed this value 0.01 percent of the times.
Arithmetic mean value of data bytes is 89.4210 (127.5 = random).
Monte Carlo value for Pi is 4.000000000 (error 27.32 percent).

Everything screams "not random." Chi-square at 0.01% means "there's essentially no chance this came from a uniform distribution."

Where this earns its keep:

• Sanity-check your RNG. Shipping a product that generates session tokens? Pipe a million of them through ent -b (bit-level) before you push. Bad seeding shows up instantly as low entropy or high serial correlation.
• Detect encrypted vs plaintext blobs. Forensics people use this constantly. An encrypted file or hidden TrueCrypt volume looks like /dev/urandom. A file claiming to be a JPEG that comes back at 5.2 bits/byte? Somebody's hiding something.
• Verify compression is working. If your gzipped log ships at 6.8 bits/byte, it's leaving compression on the table. Well-compressed data should hit ~7.99.
• Catch broken crypto. ECB-mode AES on repeating plaintext leaves visible patterns — ent catches these where a chi-square eyeball won't. The famous "ECB penguin" is a chi-square failure waiting to be printed.
• Estimate seed quality on embedded devices. The classic Debian OpenSSL bug (2006–2008) produced keys with dramatically reduced entropy. ent against /dev/urandom samples would have caught it in seconds.

The two flags worth knowing:

$ ent -b random.bin      # treat input as bit stream, not bytes
$ ent -c random.bin      # print full occurrence counts for each byte
$ ent -t random.bin      # terse CSV output — great for piping into datamash

That last one composes beautifully. Sample a thousand tokens from your app, feed each to ent -t, aggregate with datamash mean 3, and you have a continuous entropy monitor in three lines of shell.

It's a 900-line C program that hasn't needed an update since Bush was president. That's the good kind of software.