Webhook signature verification in Rest API - Time & Space Complexity

Time Complexity: Webhook signature verification

O(n)

Understanding Time Complexity

When verifying webhook signatures, we want to know how the time to check the signature changes as the message size grows.

We ask: How does the verification time grow when the webhook payload gets bigger?

Scenario Under Consideration

Analyze the time complexity of the following code snippet.

// Assume payload is a string and secret is a key
const crypto = require('crypto');

function verifySignature(payload, secret, signature) {
  const hmac = crypto.createHmac('sha256', secret);
  hmac.update(payload);
  const digest = hmac.digest('hex');
  return digest === signature;
}

This code creates a hash of the payload using a secret key and compares it to the given signature to verify authenticity.

Identify Repeating Operations

Identify the loops, recursion, array traversals that repeat.

• Primary operation: The hashing process reads every character of the payload once.
• How many times: Exactly once for each character in the payload string.

How Execution Grows With Input

As the payload size grows, the hashing work grows proportionally because each character is processed once.

Input Size (n)	Approx. Operations
10	~10 hash steps
100	~100 hash steps
1000	~1000 hash steps

Pattern observation: The time grows linearly with the size of the payload.

Final Time Complexity

Time Complexity: O(n)

This means the verification time increases directly in proportion to the payload size.

Common Mistake

[X] Wrong: "Signature verification takes the same time no matter how big the payload is."

[OK] Correct: The hashing must read the entire payload, so bigger payloads take more time.

Interview Connect

Understanding how signature verification scales helps you explain security checks clearly and shows you can reason about performance in real systems.

Self-Check

"What if the payload was streamed in chunks instead of a full string? How would the time complexity change?"