Can I use this as a real webhook signing secret?

No — it's a randomly generated sample only, meant to fill in a test config or documentation example. Always generate real signing secrets from the service that verifies your webhooks (e.g. Stripe, GitHub).

Why does it start with "whsec_"?

That prefix matches the common convention several webhook providers use for signing secrets, so the sample looks realistic in a `.env` file or example without being usable as an actual secret.

Webhook Secret Example Generator

Generates a clearly-fake, "whsec_"-prefixed webhook-signing-secret sample for filling in test environment files or documentation. This is randomly-generated example data, not a real, deliverable, resolvable or otherwise usable value — never use it as an actual production credential or contact detail.

Your result will appear here.

What this generator does

Makes one sample signing secret each press: the fixed prefix whsec_ with 48 lowercase hex characters after it. There is nothing to set and nothing to type.

How to use this tool

Press generate for a sample secret.
Generate again for another one.

Worked examples

A generated example: whsec_abbdb5870421361520b72636e4517d35c63292488ca17ff8 — a fixed whsec_ prefix followed by 24 random bytes as 48 hex characters.

Common use cases

Test/mock environment configs
Documentation examples
UI demos needing a placeholder secret

How this generator works

24 bytes are drawn from your browser's Web Crypto random generator and written out as 48 lowercase hex characters, with a fixed whsec_ prefix added in front — matching the shape several real webhook providers use for signing secrets. The body alone carries 192 bits of entropy, far more than any signing use actually needs; the point of this tool is a realistic-looking placeholder, not minimal sufficient length.

Randomness and fairness

All 24 bytes come from your browser's cryptographic random generator, with no seed and no reproducible mode.

For how randomness is produced across the whole site, see how Generate Random works.

Limitations and good to know

This is a sample value only, never registered with any service — it cannot verify a real webhook signature and will not match what any provider issues.
The whsec_ prefix mimics a common naming convention but is not a claim about compatibility with any specific provider's format.

A random sample value only — never a real, usable signing secret for any service.

Frequently asked questions

Can I use this as a real webhook signing secret?: No — it's a randomly generated sample only, meant to fill in a test config or documentation example. Always generate real signing secrets from the service that verifies your webhooks (e.g. Stripe, GitHub).
Why does it start with "whsec_"?: That prefix matches the common convention several webhook providers use for signing secrets, so the sample looks realistic in a `.env` file or example without being usable as an actual secret.