E-signatures · Glossary
What is a timestamp authority?
A timestamp authority is an independent service that receives a fingerprint of some data, adds the current time from a clock it maintains, and signs the pair. The result proves that the data existed at that moment, according to a party with no stake in the transaction.
Every signature carries a date, and almost none of them prove anything, because the date came from the signer's own machine. An independent authority is what turns a claim about time into evidence.
Indunil Asanka · Co-founder
5 min read · Published
| Source | Who controls it | Weight in a dispute |
|---|---|---|
| The signer's device clock | The signer | Almost none, since it can be set to anything |
| The signing service's server clock | The service, which may be a party's supplier | Reasonable, and better with a chained log |
| A timestamp authority token | An independent, audited third party | Strong, and verifiable by anyone with the file |
What the authority is actually attesting
Only that a particular fingerprint was presented to it at a particular moment. It does not see the document, which is the point: the requester sends a hash rather than the file, so nothing confidential leaves their control. It does not know who is asking or why, and it makes no statement about the validity of any signature. That narrowness is what makes the service cheap to operate and easy to trust. The token it returns is a small signed structure that can be attached to the signature it relates to.
Why the clock is the product
A timestamp service is really a clock with an audit programme attached. Providers synchronise to national time sources, log discrepancies, and are audited against standards that specify accuracy and record keeping. That is what a buyer is paying for, not the cryptography, which is standard. It also explains why running your own timestamp service inside your own organisation defeats much of the purpose: the value is in the independence, and a timestamp signed by one party to the transaction is only slightly better than the clock on their laptop.
Where the token lives afterwards
For a signed PDF the token is attached to the signature structure itself, so it travels with the document and any reader can check it without contacting anybody. That matters in five years when the question is whether a file predates a dispute. A timestamp also underpins long term validation, since embedded revocation data needs a fixed date to be meaningful. The mechanics of the request and response are covered on the page about the timestamp protocol rather than repeated here.
When the date genuinely decides something
Option exercises, notices with deadlines, priority between competing agreements, intellectual property disputes about who documented an idea first, and regulatory submissions with cut off dates. In each of those the document's content is not in question at all; the argument is entirely about when. Those are the documents worth timestamping. For a routine services agreement signed and performed immediately, the date matters far less than the identity of the signer. It is worth being honest about ordinary clocks before buying anything. A server clock synchronised to a public time source and running inside an audited system is usually accurate to well under a second, and for internal purposes it is entirely adequate. What it lacks is independence: the operator could in principle change it, and in a dispute the other side will say so. That is the only thing an authority adds, and it is the reason the decision is about who might challenge the date rather than about how accurate the clock is. Where nobody outside the business will ever question it, server time and a chained log are proportionate. The moment an outside party enters the picture that calculation changes, and it changes for every document of that type rather than for one.
What it costs and how it fails
Commercial providers charge per timestamp or by volume, and free services exist with rate limits and no service guarantee. The failure modes are ordinary: the authority is slow, unreachable, or returns an error, which leaves the signing process deciding whether to proceed without a token or to fail the document. That decision should be deliberate, because silently producing an untimestamped file while telling users they are timestamped is worse than not offering the feature at all.
The current position in this product
The timestamping path is implemented, including the request, the fifteen second timeout, the acceptance of the two success statuses, and a larger signature placeholder to fit the returned token. It is not switched on: the timestamp authority address is empty in every deployed configuration, so completed PDFs currently carry no token. The recorded algorithm string is the honest indicator, reading PAdES-SHA256-DocMDP when there is no timestamp and PAdES-SHA256-DocMDP-RFC3161 when one is attached. Where an independent time is essential today, timestamp the file separately after download.
Questions people ask
Does the authority see my document?
No. It receives a hash, which reveals nothing about the content and cannot be reversed into the file. That design is deliberate so that confidential documents can be timestamped by a public service without any disclosure, and it is why the same service can be used across unrelated organisations.
How accurate is the time?
Reputable authorities operate to a stated accuracy against a national time source, typically within a second, and publish their practice statement. For legal purposes the exact second rarely matters; what matters is that the time came from an audited third party rather than from a machine the signer controls.
Can a timestamp be forged?
Only by compromising the authority's signing key, which is the same risk model as any certificate authority. A more realistic concern is relying on an obscure provider with no audit record, since the token is only as credible as the organisation that issued it and the practices it can evidence.
Is a blockchain anchor an alternative?
Publishing a hash to a public ledger also fixes a date, and some organisations do it alongside a conventional token. The drawbacks are cost, latency and the need for a verifier to trust and query that network. A standard token is verifiable offline inside the document, which is usually more practical.
Do I need one for every document?
No. Reserve it for documents where the date could be contested or where the file must remain verifiable for many years. Applying it universally adds an external dependency to every signing, which is a poor trade when most agreements are performed within weeks of being signed.
Can I timestamp a file after the fact?
Yes, and it proves the file existed no later than that moment, which is still useful for archives. What it cannot do is prove the file existed earlier, so a timestamp added a year after signing establishes far less than one attached at the time.
Make one with e-signatures
The button opens the generator with this use case already described. Change the wording to match your own.
Send a document for signingRelated questions
- What is LTV in a PDF signature?LTV embeds the certificates and revocation data a signature needs, so it can still be checked after the certificate expires. What gets stored and why.
- What is a document hash?A document hash is a fixed string computed from a file's bytes. Why a signing certificate prints two of them, and what each one actually covers.
- What is an RFC 3161 timestamp?An RFC 3161 timestamp is a signed statement from an independent authority that a document existed at a moment. How it attaches to a PDF signature.
Written and checked by the OneCraft team. Last checked .