It is the only JWS algorithm JWA marks as Required to implement, and the default of many tutorials and frameworks. The 32-byte tag is computed over header.payload with the shared secret; verification recomputes and compares it in constant time.
Weak secrets are the main problem: RFC 7518 requires keys of at least the hash length (256 bits), but tokens signed with short or dictionary secrets such as secret can be cracked offline from a single token (hashcat mode 16500, jwt_tool), after which the attacker mints arbitrary tokens. Use 32 or more random bytes, never a password, and check with the JWT secret checker.
HS256 fits when the same service issues and verifies tokens. For third-party verifiers, microservices or public clients, use an asymmetric algorithm so verifiers hold only a public key, and pin the algorithm per key to avoid confusion with RS256.