Hash

A hash is a short, fixed-length fingerprint computed from a file, where any change to the file, even one character, produces a completely different value.

In plain words

A hash function reads every byte of a file and returns a string of a set length, such as 64 hex characters for SHA-256. Three properties make it useful.

The same file always gives the same hash.
A tiny change gives a totally different hash.
You can't work backwards from the hash to the file, and you can't feasibly find two files with the same hash.

So a hash lets you compare files without sending them. If two hashes match, the files are the same.

An example

You keep a signed contract in your records system. A colleague sends you "the same contract" a year later. You compute both hashes. If they differ by even one character, so do the files, and you know to look more closely.

How it shows up in docuinked

Hashes do three jobs in docuinked.

The seal. The PAdES seal and the RFC 3161 timestamp both sign a hash of the finished PDF.
The log. Each event in the audit trail includes the hash of the event before it. That is what makes the log tamper-evident.
Approvals. When an agent creates a draft, it gets a draft_hash. The hash covers the PDF bytes, the title, the message, the signing order, every signer and every field. A person approves that exact hash. If the draft changes, the send is refused with draft_changed. See approvals.

The free checker can hash a file in your browser and look it up, so the file itself never has to leave your machine.

Common confusions

Hashing is not encryption. Encryption hides a file and can be reversed with a key. A hash can't be reversed at all. It only proves sameness.

A hash doesn't say who. It proves a file is unchanged. It says nothing about who made it or signed it. That takes a digital signature and an evidence record.

Human-in-the-loop, where the draft hash ties approval to bytes
Idempotency, a different way of matching repeat requests

Common questions

Which hash function does a PAdES seal use?

Modern PDF seals commonly use SHA-256. The function is named inside the signature, so readers know how to check it.

Can two different contracts have the same hash?

In practice no. With SHA-256, finding two different files with the same hash is not feasible with today's computers.

Why does an agent need to send the draft hash back?

It proves the agent is asking to send the exact draft it made. If anything changed in between, even a signer's email, the hash won't match and nothing goes out.

Try it in test mode

Free during the beta. Test keys send no email, so you can build the whole flow first.

Get an API key Read the quickstart