What is a trusted timestamp, and how does it prove a file existed on a certain date?

Why isn't a file's date good enough as proof?

Because your own device writes it, and anyone can rewrite it. "Created" and "last modified" dates come from the device clock. Change the clock, copy the file to another drive, or run a single system command, and they say something else.

The same goes for dates stored inside the document, such as PDF properties or the capture date in a photo. These are things the file claims about itself. No outside party stands behind them, and anyone who wants to dispute them only has to point out that they are editable.

For a date to carry weight, it has to be set by someone other than you, in a way that cannot be changed later without detection. That is the job of a trusted timestamp.

What is a cryptographic hash (SHA-256)?

It is a short code, 64 characters long, computed from the entire content of a file. Think of it as a fingerprint: the same file always produces the same hash, on any machine, at any time.

• Same content, same hash. The file name and folder make no difference.
• One byte changed, a different hash. Fixing a typo, cropping a pixel, or simply re-saving the file gives a completely different code.
• It only works one way. You cannot rebuild the file from its hash, so sharing the hash reveals nothing about the content.

SHA-256 is a public algorithm defined in a NIST standard. No company owns it, and every major operating system ships with a tool that can compute it.

How does an RFC 3161 timestamp work?

A Time Stamping Authority (TSA) receives a hash, adds the time from its own clock, and signs the two together. The protocol is an open internet standard, RFC 3161.

1. Your device computes the SHA-256 hash of the file.
2. Only the hash is sent to the authority. The file itself does not travel.
3. The authority combines the hash with the current date and time and signs the result with its private key.
4. You get back a small file, the timestamp token, containing the hash, the time, and the signature.

Since the authority never sees the document, you can timestamp confidential material without disclosing it. And since the signature is checked against the authority's public certificate, anyone can verify the token later without having to trust you.

What does a timestamp prove, and what doesn't it prove?

It proves one thing, and proves it well: a file with that exact hash existed no later than the stamped date and time. The file may be much older. What is ruled out is that it was created or altered afterward. This is sometimes called proof of existence.

What it does not prove:

• Who made it. The token records that someone submitted a hash, not who wrote the text or took the picture.
• That the content is true. A forged document can be timestamped just as easily as a real one.
• Ownership or copyright. Holding a file on a given date is useful supporting evidence, but it is not the same as being the rights holder.
• That you had it first. Someone else may have had the same content earlier.

A timestamp gives you integrity and time. Whether a court accepts it, and how much weight it gets, depends on the jurisdiction and the judge. It is not a substitute for a notary or a forensic expert.

When is a trusted timestamp useful?

Whenever you want a record of how things stood before anyone has a reason to argue about it. Common cases:

• Drafts, manuscripts, scripts, and compositions before you send them to anyone.
• Designs, drawings, logos, and source code before a pitch to a client or potential partner.
• Signed contracts and annexes, to pin down the exact version that was agreed.
• Photos of damage, a delivery, or the condition of a rental. There is a dedicated option to certify a photo for this.
• Research data and results ahead of publication.
• Web pages that may change or disappear; see how to capture a web page as evidence.

The practical rule: timestamp before you share. A token dated after a dispute begins only shows you had the file once the dispute already existed.

How do I timestamp a file myself and verify it later?

The hash takes one command you already have. Open a terminal in the file's folder and run:

• Windows: certutil -hashfile file.pdf SHA256
• macOS: shasum -a 256 file.pdf
• Linux: sha256sum file.pdf

The output is the 64-character hash. To timestamp it by hand you need software that speaks RFC 3161, such as OpenSSL, and the address of a timestamping authority: you build a request from the hash, send it, and save the token that comes back. It works, but it assumes you are comfortable on the command line.

The shortcut is to certify the file in your browser. The hash is computed on your device, the file is not uploaded, and you receive a PDF certificate showing the hash, the stamped time, and a code for checking it.

How to verify a timestamp later

Compute the file's hash again and compare it with the one inside the token. If they match, the file is identical to what was stamped. If they don't, the file has changed or is a different file.

The second step is checking the authority's signature on the token, which tools like OpenSSL do using the authority's public certificate. For a certificate issued here, the first check (that the fingerprint matches) is done on the public verification page, which anyone can open; the authority's signature is checked separately, using the timestamp token.

This is why the original has to stay exactly as it was. Opening and re-saving a document, forwarding a photo through a messaging app, or converting it to another format changes its bytes and therefore its hash. Keep at least two copies of the original alongside the certificate, and do all further work on duplicates.

How is it different from an electronic signature or a notary?

They answer different questions. A timestamp answers when. An electronic signature answers who approved a document and ties it to a person. A notary is an official who attests to what they witness or certify, with whatever effect local law gives that act. They complement one another; none replaces the others.

What mistakes should I avoid?

• Editing the original after stamping it. Even a format conversion breaks the match.
• Keeping only the certificate. Without the file there is nothing to compare; a hash cannot be turned back into a document.
• Stamping a forwarded copy. Messaging apps often recompress photos and video. Stamp the file as it came out of the camera or the application.
• Presenting it as proof of authorship. It establishes time and content. Authorship rests on other things: earlier drafts, correspondence, witnesses.
• Waiting until there is a problem. The value lies in the timestamp coming first.

A quick checklist before you move on:

1. I have the final, original version of the file.
2. I timestamped it before sharing it.
3. I stored the certificate or token next to the file.
4. I made two copies in different places and will not open them for editing.
5. I ran the verification once and it matched.