Webhook Signature Generator & Verifier

Generate and verify cryptographic HMAC SHA-256 and SHA-512 webhook signatures for Stripe, GitHub, Shopify, and custom API endpoints.

HMAC Webhook Signer

Compute cryptographic headers for simulated incoming webhooks.

Signing Secret Key

Unix Timestamp (Seconds)

Raw Payload Body (Unparsed JSON)

Stripe-Signature Header Value

Awaiting input...

Securing Inbound Webhooks with Cryptographic HMAC Signatures

In distributed cloud architectures, webhooks expose public HTTP POST endpoints to receive real-time events from payment providers (Stripe, PayPal), CI/CD pipelines (GitHub), and SaaS platforms (Shopify). Without validating incoming cryptographic signatures using a shared secret key, malicious actors can send forged JSON payloads to trigger fraudulent order fulfillments or bypass authentication.

Key Technical Features

✓

Multi-Provider Formats

Pre-configured header formats matching Stripe (`t=timestamp,v1=signature`), GitHub (`sha256=...`), and standard hex digests.

✓

HMAC SHA-256 & SHA-512 Support

Compute signatures using modern NIST-recommended cryptographic hashing algorithms.

✓

Replay Attack Timestamp Protection

Simulates Stripe-style timestamp concatenation (`${timestamp}.${payload}`) to defend against network replay attacks.

✓

Timing-Safe Verification Tester

Verify incoming headers against raw payloads to prevent side-channel timing attacks.

✓

Multi-Language Backend Snippets

Ready-to-use verification middleware code for Node.js (Crypto), Python (Hmac), Go (crypto/hmac), and PHP.

✓

Raw Payload String Preservation

Emphasizes the critical developer rule of verifying unparsed raw request buffers before JSON deserialization.

Practical Engineering Scenarios

✓
Stripe Payment Webhook Testing
Simulate `payment_intent.succeeded` payloads and generate authentic `Stripe-Signature` headers for local test suites.
✓
GitHub App & Action Integrations
Verify `X-Hub-Signature-256` headers when receiving push, pull_request, or release events.
✓
Shopify App Development
Validate base64-encoded `X-Shopify-Hmac-Sha256` signatures on order creation and inventory updates.
✓
Custom API Gateway Webhook Egress
Sign outbound enterprise webhook payloads sent to external customer callback URLs.

Frequently Asked Questions

Why does webhook verification fail after parsing JSON?

Cryptographic HMAC signatures are calculated over the exact raw byte stream of the HTTP request body. If your backend framework (like Express or FastAPI) parses the JSON into an object and re-stringifies it, whitespace, key ordering, and unicode formatting change, causing hash verification to fail. Always capture the raw unparsed request buffer.

How does Stripe prevent webhook replay attacks?

Stripe prepends the current Unix timestamp to the payload (`${timestamp}.${payload}`) before generating the HMAC hash and includes the timestamp in the `Stripe-Signature` header. The receiver checks that the timestamp is within 5 minutes of the server's current time, rejecting replayed historical requests.

What is a timing attack in webhook verification?

If you compare signatures using standard string comparison (`===`), the comparison returns false faster if the first character doesn't match, leaking information about how many characters were correct. Always use constant-time comparisons like Node's `crypto.timingSafeEqual()` or Python's `hmac.compare_digest()`.

Which HMAC algorithm is industry standard for webhooks?

HMAC-SHA256 is the universal standard used by Stripe, GitHub, Shopify, Slack, and Twilio. HMAC-SHA1 is considered legacy and should be avoided for new implementations.