How to timestamp a file for free

Two mature, free ways exist to prove that a file existed by a particular moment. Both are older than most of the products sold on top of them, and for a great many situations they are the whole answer. We sell something adjacent; this page is deliberately about the free route first, because most people asking this question do not need to buy anything.

Option 1: OpenTimestamps, anchored in Bitcoin

OpenTimestamps aggregates submitted digests into a Merkle tree and commits the root into a Bitcoin transaction. Once the block confirms, every digest in that tree inherits the block's time. The calendars are free, need no registration, and are run by several independent operators.

pip install opentimestamps-client

ots stamp evidence.pdf        # creates evidence.pdf.ots
# wait — a calendar batches submissions, so this takes hours, not seconds
ots upgrade evidence.pdf.ots  # collects the Bitcoin attestation once confirmed
ots verify evidence.pdf.ots   # checks it against a block

Keep both files. The .ots file is the proof; the original file is what it is a proof about. Change one byte of the original and verification fails, which is the entire point.

What it proves: this exact content existed no later than that block. What it does not prove: anything about where the content came from, who made it, or whether it is true.

Option 2: an RFC 3161 timestamp authority

An authority signs your digest together with its own clock reading. Verification is a signature check against that authority's certificate — no waiting for a block, and the format is widely understood by existing document tooling.

openssl ts -query -data evidence.pdf -sha256 -cert -out request.tsq
curl -s -H "Content-Type: application/timestamp-query" \
  --data-binary @request.tsq https://freetsa.org/tsr > response.tsr
openssl ts -reply -in response.tsr -text | head

Several authorities offer free service; some commercial ones are free for low volumes. The trade-off against OpenTimestamps is direct: you are trusting the authority's clock and its certificate chain, rather than a block that thousands of independent parties reproduce. In exchange you get an answer immediately.

Use both. They fail in different ways, and together they cost nothing extra.

You do not need to reveal the file

Both methods work on the digest, never the content. sha256sum the file, submit the hash, keep the file. A calendar or an authority learns 32 bytes that say nothing about what they cover. This is what makes timestamping usable for confidential material — a draft, a dataset, a contract nobody else may read.

Where the free route stops

Three limits, each of which is a different product rather than a bigger version of the same one.

It says nothing about origin. A timestamp on a hash proves you had this content then. If the disputed fact is where the content came from — what a page served, what an API returned — a hash you made yourself cannot settle it, because you made it.

Somebody has to keep the proof. A .ots file on a laptop is a proof until the laptop is replaced. Free means free of charge, not free of operational responsibility.

It does not scale to a pipeline. Stamping a file by hand is fine. Doing it for every source a system reads, thousands of times a day, with the proofs retrievable years later, is an infrastructure problem rather than a command.

What we do, and when it is worth paying for

Elucora fetches the source itself, so the record is not one you made; signs it; appends it to a public append-only log; collects an RFC 3161 token and a Bitcoin anchor for you; and keeps the proofs retrievable. Verification still runs offline against published keys, and reading or verifying a receipt needs no account.

If your content is already in your hands and you only need to show it has not changed since a date, use the commands above and pay nobody. That is the honest recommendation, and it is the same one I would give a friend.