What it does
Builds an HMAC-SHA256 signature for a message using a shared secret, so you can prove the data wasn't changed.
How it's safe
Signing happens in your browser. The secret key and message stay on your device.
Watch out
HMAC only helps if the secret stays secret. If someone else has the same key, they can forge signatures too.