# Hash

A hash is a short, fixed-length fingerprint computed from a file, where any change to the file, even one character, produces a completely different value.

## In plain words

A hash function reads every byte of a file and returns a string of a set length, such as 64 hex characters for SHA-256. Three properties make it useful.

- The same file always gives the same hash.
- A tiny change gives a totally different hash.
- You can't work backwards from the hash to the file, and you can't feasibly find two files with the same hash.

So a hash lets you compare files without sending them. If two hashes match, the files are the same.

## An example

You keep a signed contract in your records system. A colleague sends you "the same contract" a year later. You compute both hashes. If they differ by even one character, so do the files, and you know to look more closely.

## How it shows up in docuinked

Hashes do three jobs in docuinked.

1. **The seal.** The [PAdES](/glossary/pades) seal and the [RFC 3161 timestamp](/glossary/rfc-3161-timestamp) both sign a hash of the finished PDF.
2. **The log.** Each event in the [audit trail](/glossary/audit-trail) includes the hash of the event before it. That is what makes the log [tamper-evident](/glossary/tamper-evident).
3. **Approvals.** When an agent creates a draft, it gets a `draft_hash`. The hash covers the PDF bytes, the title, the message, the signing order, every signer and every field. A person approves that exact hash. If the draft changes, the send is refused with `draft_changed`. See [approvals](/docs/approvals).

The [free checker](/tools/verify-pdf) can hash a file in your browser and look it up, so the file itself never has to leave your machine.

## Common confusions

**Hashing is not encryption.** Encryption hides a file and can be reversed with a key. A hash can't be reversed at all. It only proves sameness.

**A hash doesn't say who.** It proves a file is unchanged. It says nothing about who made it or signed it. That takes a [digital signature](/glossary/digital-signature) and an evidence record.

## Related terms

- [Human-in-the-loop](/glossary/human-in-the-loop), where the draft hash ties approval to bytes
- [Idempotency](/glossary/idempotency), a different way of matching repeat requests

## Common questions

### Which hash function does a PAdES seal use?

Modern PDF seals commonly use SHA-256. The function is named inside the signature, so readers know how to check it.

### Can two different contracts have the same hash?

In practice no. With SHA-256, finding two different files with the same hash is not feasible with today's computers.

### Why does an agent need to send the draft hash back?

It proves the agent is asking to send the exact draft it made. If anything changed in between, even a signer's email, the hash won't match and nothing goes out.