Security · 5 min read
HMAC and Webhook Signatures Explained
When a service like Stripe or GitHub sends your server a webhook, how do you know it is genuine and not a forgery? The answer is almost always an HMAC signature.
This guide explains what HMAC is and how webhook verification works.
Try it yourself with the related tool.
Generate an HMAC →Advertisement
What HMAC is
HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce a signature. Because the secret is mixed in, only parties who know it can generate or verify a valid code. It proves two things at once: the message was not altered, and it came from someone holding the secret.
How webhook verification works
The provider signs each webhook's payload with a shared secret and sends the resulting HMAC in a header. On your server, you recompute the HMAC over the raw body with the same secret and compare. If they match, the request is authentic and untampered; if not, you reject it.
HMAC vs a plain hash
A plain hash proves only integrity — anyone can recompute it, so it cannot prove who sent the message. The secret key is what lets HMAC prove authenticity, which is exactly what webhook verification needs.
Compare in constant time
When checking a signature on the server, use a constant-time comparison rather than a normal string equality check. A naive comparison can leak timing information that helps an attacker guess the signature. Use your platform's timing-safe compare function.