The digest is keccak256(0x19 ‖ 0x01 ‖ domainSeparator ‖ hashStruct(message)). hashStruct hashes a type hash (the Keccak-256 of a canonical type string such as Mail(address from,address to,string contents)) with the encoded fields; strings, bytes and arrays are hashed, nested structs are hashed recursively. The domain separator is hashStruct(EIP712Domain) with name, version, chainId, verifyingContract and optionally salt; the type hash of the usual four-field domain is 0x8b73c3c69bb8fe3d512ecc4cf759cc79239f7b179b0ffacaa9a75d522b39400f.
Wallets call it through eth_signTypedData_v4. It underpins EIP-2612 permit, Uniswap Permit2, Safe transaction hashes, order books, gasless relayers and many governance systems. A typed-data signature is only as safe as what the user understood: off-chain permit signatures that grant unlimited allowances are a leading phishing technique.
Common bugs: a type string that does not match the struct exactly, a missing or wrong chainId or verifyingContract, and signatures accepted twice because the contract stores no nonce. The EIP-712 inspector recomputes every hash locally.