Skip to main content

Webhook Secret Generator

Generate a cryptographically secure random secret for signing and verifying webhooks. Secrets are generated locally in your browser with crypto.getRandomValues(); nothing is sent to any server.

What is a webhook secret?

A webhook secret is a shared random value that the webhook sender uses to sign each request, typically as an HMAC signature in a header such as X-Hub-Signature-256 (GitHub) or Stripe-Signature (Stripe). The receiver recomputes the signature over the raw request body with the same secret and rejects the request when the values differ. This proves the payload came from the real sender and was not tampered with in transit.

How long should a webhook secret be?

At least 32 bytes (256 bits) of randomness. That matches the strength of HMAC-SHA256, the most common webhook signature algorithm. Longer secrets do not hurt, but 32 random bytes is already beyond brute force. What matters more is that the secret comes from a cryptographically secure random source, never from a password you made up.

Using the secret to verify webhooks

If you receive webhooks with Core Webhook Module, put the secret in an environment variable and reference it in your webhook configuration:

{
  "github_events": {
    "data_type": "json",
    "module": "log",
    "hmac": {
      "secret": "{$WEBHOOK_HMAC_SECRET}",
      "header": "X-Hub-Signature-256",
      "algorithm": "sha256"
    }
  }
}

The module verifies the HMAC with a constant-time comparison, which prevents timing attacks. See the HMAC signature validation guide for GitHub-style and Stripe-style signatures, or the authentication overview for the other 11 supported methods (JWT, OAuth, Basic, IP whitelisting, and more).

Tips

  • Use a different secret per webhook endpoint, so one leak never affects the rest.
  • Store secrets in environment variables or a secret manager such as HashiCorp Vault, never in code or config files committed to git.
  • Rotate secrets periodically: generate a new one here, update the sender and receiver, then retire the old value.
  • Hex and base64url formats encode the same randomness; pick whichever your provider's docs expect. Both are safe in HTTP headers and environment variables.