How webhook signatures work
When one service sends webhooks to another, both share a secret. The sender computes an HMAC of the request body with that secret and puts it in a header. The receiver computes the same HMAC and rejects the request if the values differ. Without the secret, nobody can send a webhook your endpoint will accept.
The generator creates a 32-character Base62 secret with a whsec_ prefix, a convention popularized by Stripe and Svix. Change or clear the prefix in the options, and use the calculator below the generator to sign a sample body and check your verification code.
Verifying signatures correctly
- Compute the HMAC over the raw request body, before any JSON parsing.
- Compare signatures with a constant-time function such as hmac.compare_digest in Python or crypto.timingSafeEqual in Node.js.
- Include a timestamp in the signed payload and reject old requests to stop replays.
Frequently asked questions
How long should a webhook secret be?
At least 32 random characters, which is about 190 bits with Base62. That matches or exceeds what major providers issue.
Is the whsec_ prefix part of the HMAC key?
It depends on the provider. Stripe uses the whole whsec_ string as the key, while Svix strips the prefix and Base64-decodes the rest. For your own webhooks, document the choice and stay consistent.