Why sign a save file
If your save is a plain .json or .cfg file, anyone can open it and set their gold, level or stats to anything. For a single-player game that is sometimes fine, but it breaks balance, achievements, leaderboards and any in-app purchase that unlocks content. A signature is a short code computed from the save and a secret only your game knows. Change one character of the save and the signature no longer matches, so your game can refuse to load it or reset the suspicious values.
How it works
The tool uses HMAC-SHA256, a standard keyed hash. The signed file is your exact save text, followed by a trailer line #gsk-sig:<hash>. When your game loads the file, it splits off the trailer, recomputes the HMAC of the rest with the same secret, and compares. Because the signature is over the raw text your game wrote, there is no need to match JSON formatting between engines, which is where naive approaches usually break.
Using the code
Call sign(saveText) when you save to get the full file to write, and verify(fileText) when you load. Verify returns the original save text when the signature is valid and an empty result when it is not, so you can show a warning or start a fresh game. Godot 4 has HMAC built into its Crypto and HMACContext classes, Unity uses System.Security.Cryptography.HMACSHA256, and the browser uses Web Crypto. All three produce the same signature for the same secret and text.
Limits
This is tamper detection, not encryption. The save text is still readable; it just cannot be changed without the secret. And the secret ships in your game, so a dedicated player can find it and sign their own edits. For competitive or paid features, treat the client as untrusted and validate on a server.
Is anything uploaded?
No. Signing and verifying happen in your browser with Web Crypto. The secret and the save text never leave this page.