GLOSSARY

What is a webhook signature?

A webhook signature is an HMAC a provider sends so you can verify a webhook is authentic and untampered. Learn how it works.

Open the hash generator →All free tools

A webhook signature is a value a provider computes over the webhook body using a shared secret, sent in a header, so your endpoint can verify the request really came from the provider and was not altered or forged.

Why webhooks need signing

Your webhook URL is a public endpoint anyone could POST to. Without verification, an attacker could send fake events — fake payments, fake deliveries. A signature fixes this: only someone holding the shared secret can produce a valid one, so a matching signature proves authenticity.

How verification works

The provider computes HMAC (usually SHA-256) over the raw request body with your shared secret and sends it in a header. You recompute the same HMAC on your side and compare using a constant-time check. If they match, the webhook is genuine; if not, reject it. Eveses signs webhooks this way.

Try it now — free, no signup

Use the hash generator in your browser. Then, when you need it at scale with an API key and higher limits, grab the full Eveses API.

Open the hash generator →Sign up for the full API

FAQ

What algorithm signs webhooks?›
Usually HMAC-SHA256 over the raw request body with a shared secret.
Why compare signatures in constant time?›
To avoid timing attacks — a constant-time comparison does not leak how many characters matched.

Related

What is HMAC?HMAC proves a message was not tampered with and came from someone who holds a shared secret. Learn how it works — it powers TOTP and JWT signing.How to verify a webhook signatureVerify an incoming webhook with an HMAC signature so you only trust genuine events. Step-by-step with the security pitfalls to avoid.SHA-256 vs MD5: what is the difference?MD5 is fast but broken for security; SHA-256 is the modern default. Learn the difference and hash any text free with MD5, SHA-1, SHA-256/512.