Dev
Générateur de signature de webhook fictive
A mock webhook signature generator produces example signed webhook headers for testing signature verification. Many services sign their webhooks so you can confirm a request genuinely came from them and was not tampered with, using a timestamp and an HMAC signature. This tool emits realistic signature headers in the common format, with a note on how verification works. Click generate and copy them into a test. It is ideal for testing a webhook verifier, documenting your webhook scheme, and learning how signing works. The headers follow the typical pattern — a timestamp, a signature combining that timestamp and a hash, and an event id. The signature here is random, so it will not verify, which is the point: it lets you test that your verifier correctly rejects an invalid signature. To test the success path, compute a real HMAC with your signing secret.
How to use
- Choose your options above
- Click Generate
- Copy your result
Detailed instructions
- Click Generate to produce signature headers.
- Copy them into your test.
- Test that your verifier rejects them.
- Compute a real HMAC to test success.
Use Cases
- •Testing webhook signature verification
- •Documenting a webhook scheme
- •Learning how webhooks are signed
- •Seeding signature headers
- •Testing rejection of bad signatures
Tips
- →Always verify incoming webhooks.
- →HMAC covers timestamp and body.
- →The timestamp guards against replays.
- →This signature will not verify by design.
FAQ
why are webhooks signed
Signing lets you verify that a webhook genuinely came from the expected sender and was not tampered with in transit. The sender computes a signature using a shared secret, and you recompute it on your end to confirm the request is authentic.
how does signature verification work
You compute an HMAC — typically SHA-256 — over the timestamp and raw request body using your signing secret, then compare it to the signature in the header. If they match, the request is authentic; if not, you reject it. The timestamp also guards against replays.
will this signature verify
No — it is random, so it will fail verification, which is intentional. Use it to test that your verifier correctly rejects invalid signatures. For the success path, compute a real HMAC with your actual signing secret over the matching payload.
What is HMAC and why is it used for webhooks?
HMAC (hash-based message authentication code) combines a hash function like SHA-256 with a shared secret, producing a signature that proves both who sent a message and that it was not altered — anyone without the secret cannot forge it. Webhooks use it so receivers can trust the payload. The generator emits headers in that HMAC-signature format, so you can build and test the verification side against realistic-looking (though intentionally invalid) signatures.
Why include a timestamp in a webhook signature?
Signing the timestamp alongside the body lets the receiver reject old requests, defeating replay attacks where an attacker resends a captured valid webhook. You verify the signature and also check the timestamp is recent. The generator includes a timestamp in its signed headers, so your verifier can exercise both the signature check and the freshness window exactly as it would against a real provider.
You might also like
Popular tools from other categories that share themes with this one.
Try these next
More free tools from other corners of the catalog, picked by shared themes.