Size an exponential backoff schedule with jitter: total retry window, delivery probability and the retry storm your consumer will see.
Exponential backoff grows geometrically until it hits the cap and then becomes linear, so the total window is a geometric sum plus a flat tail. Full jitter randomises each delay uniformly, which halves the expected wait and — more importantly — spreads a synchronised retry storm out over the delay window instead of concentrating it in one second. A retry schedule without jitter is a self-inflicted denial of service on the consumer: every failed delivery retries in lockstep, so the recovering endpoint is knocked over again by your own traffic.
Webhook Retry
With base delay b, multiplier m and cap c, the delays are min(b·m^i, c); their sum is the geometric series b(m^k − 1)/(m − 1) over the k attempts before the cap, plus (attempts − k) × c afterwards.
Jitter and delivery
Full jitter halves the expected delay, so the expected window is the nominal window × (1 − jitter ÷ 2); cumulative delivery probability = 1 − (1 − p)^attempts.
With base delay b, multiplier m and cap c, the delays are min(b·m^i, c); their sum is the geometric series b(m^k − 1)/(m − 1) over the k attempts before the cap, plus (attempts − k) × c afterwards. Exponential backoff grows geometrically until it hits the cap and then becomes linear, so the total window is a geometric sum plus a flat tail. Full jitter randomises each delay uniformly, which halves the expected wait and — more importantly — spreads a synchronised retry storm out over the delay window instead of concentrating it in one second.
A retry schedule without jitter is a self-inflicted denial of service on the consumer: every failed delivery retries in lockstep, so the recovering endpoint is knocked over again by your own traffic.
This calculator takes 7 inputs: Base delay before the first retry, Backoff multiplier, Maximum attempts, Delay cap per attempt, Full-jitter range applied to each delay, Per-attempt delivery success, Events failing in the same instant. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Enough to ride out a normal outage and no more — typically six to ten attempts spread over a few hours to a day, then a dead-letter queue with an operator-visible replay. Retrying for a week hides the failure, ties up delivery workers and eventually replays events the consumer no longer has context for.