Question 1

What is a webhook signature and why does it matter?

Accepted Answer

A webhook signature is an HMAC hash of the request body, included in a request header (e.g. X-Hub-Signature-256 for GitHub, Stripe-Signature for Stripe). The receiver recomputes the HMAC using its shared secret and compares it to the header value. If they match, the payload is authentic and unmodified. This prevents attackers from sending forged webhook payloads to your endpoint.

Question 2

Which platforms does this simulator support?

Accepted Answer

GitHub (X-Hub-Signature-256, HMAC-SHA256), Stripe (Stripe-Signature with timestamp replay protection), Slack (X-Slack-Signature, HMAC-SHA256), Shopify (X-Shopify-Hmac-SHA256), and a generic HMAC-SHA256 option for any custom webhook system.

Question 3

Is my webhook secret safe?

Accepted Answer

Yes. HMAC signing runs entirely in your browser using the Web Crypto API. Your secret key is never sent to any server. You can safely test with real webhook secrets.

Question 4

How do I verify a webhook signature in Node.js?

Accepted Answer

Compute HMAC-SHA256 of the raw request body using your secret key, then compare to the signature header in constant time (to prevent timing attacks): const sig = crypto.createHmac('sha256', secret).update(rawBody).digest('hex'); then use crypto.timingSafeEqual() to compare. The exact header name and format differ by platform.