HS256 means HMAC with SHA-256. The header and payload are Base64URL encoded, joined with a dot, then signed with your secret. Everything runs in your browser using the Web Crypto API.