The internet standard for trusted timestamping. A Time Stamping Authority signs a token binding a hash of your document to its certified clock, producing proof the document existed at that moment.

Does the TSA see my document?

No. Only a SHA-256 hash — a one-way fingerprint — is sent. The TSA signs the hash and returns a token; the file itself never leaves your device.

Do I need my own certificate?

No. The TSA's certificate signs the timestamp token, so the proof stands on the authority's identity, not yours.

Why does this tool need internet access?

The trusted time must come from an external authority — that's what makes it trustworthy. It's the only network call: a hash goes out, a signed token comes back. You choose the TSA and consent before anything is sent.

Which timestamp authorities are supported?

FreeTSA, DigiCert, Sectigo, and SSL.com — all free public RFC 3161 endpoints. If one is unreachable, pick another; the token format is identical.

How is the timestamp verified later?

The token is embedded as an ETSI.RFC3161 document timestamp. Acrobat and other readers show it in the signature panel; our Validate Signature tool lists it with the certified time.

Can I timestamp a password-protected PDF?

Yes — enter the password and the file is decrypted locally before stamping. The timestamped output is unencrypted; re-protect it afterwards if needed.

Dấu thời gian RFC 3161 cho PDF: chứng minh thời điểm

Nhúng dấu thời gian tin cậy RFC 3161 từ TSA miễn phí vào PDF. Chỉ hàm băm tài liệu rời thiết bị — bản thân tệp vẫn nằm cục bộ.

1. Select PDF

Select a PDF file. Only its SHA-256 hash is ever sent — the file stays on your device.

2. Pick a timestamp authority

Choose a free RFC 3161 TSA (FreeTSA, DigiCert, Sectigo, SSL.com) and consent to the hash-only request.

3. Timestamp

The TSA's signed token is embedded as a document timestamp.

4. Download

Get a PDF with cryptographic proof of existence at a certified time.

Prove a document existed at an exact moment

What an RFC 3161 timestamp is

A trusted timestamp is a cryptographic token issued by a Time Stamping Authority (TSA): the TSA signs a statement binding your document's hash to its own audited clock. Anyone can later verify that the exact bytes you hold existed at that instant — no earlier, no later — without trusting you or your computer's clock.

This tool builds a standards-compliant RFC 3161 request, sends it to the TSA you choose, and embeds the returned token into the PDF as an ETSI.RFC3161 document timestamp — the same structure Acrobat's own timestamping produces.

Your document never leaves the device

The only thing sent to the TSA is a SHA-256 hash — a 32-byte one-way fingerprint of the file. The TSA cannot reconstruct, read, or learn anything about your document from it. The request is gated behind an explicit consent checkbox that names the authority and states exactly what is transmitted.

This is the one tool on OxygenPDF that makes a network call, and it makes exactly one: a hash out, a signed token back. Everything else — hashing, embedding, saving — happens locally.

What you get

A timestamped PDF with verifiable proof inside.

TSA choice

FreeTSA, DigiCert, Sectigo, or SSL.com — pick the authority whose clock you trust.

Hash-only request

SHA-256 fingerprint leaves the device; the document itself never does.

Certified time

The token's genTime is shown after stamping and embedded in the file for any verifier.

No certificate needed

You don't need your own signing certificate — the TSA's signature vouches for the time.

When to use it

Timestamp drafts and designs to establish IP priority. Timestamp contracts to defeat backdating claims. Timestamp audit exports and financial records so the log itself proves when each entry existed. Because the token is embedded in the PDF, the proof travels with the file — no separate .tsr file to keep track of.

Encrypted PDFs are supported: the file is decrypted locally first (with the password you supply), then timestamped. The output is unencrypted.