Every capture is signed by DigiCert, an independent timestamping authority. The proof stays valid for decades, and anyone can check it with free tools.
This exact file existed by
2 March 2026, 09:12:41 UTC
Signed by DigiCert, an independent timestamping authority. Obtained within a second of the capture finishing.
SHA-256 of the downloaded document
Checked when it arrived
The date comes from DigiCert, not from us, so it holds up with people who have never heard of Archivepanel.
Only the file's fingerprint is sent. DigiCert never sees the page, its address or your account.
Timestamps are renewed automatically before their certificates expire, about once a decade.
The capture time on a record is our word for when a page was saved. A trusted timestamp is someone else's: DigiCert signs a statement that a file with exactly this fingerprint existed at that moment.
The signed token is kept with the record. Download it with the page and anyone can check the pair, now or in ten years, without an account.
A token can be checked for as long as the certificates behind it are valid, which is roughly ten years. In the year before they expire we have DigiCert timestamp the token itself, and the original proof carries through.
Each renewal adds one link, and the record lists them all with the command to check each one. Nothing is asked of you.
openssl ts -verify -data page.html \ -in page.tsr -token_in -attime 2091744000 \ -CAfile /etc/ssl/certs/ca-certificates.crt openssl ts -verify -data page.tsr \ -in page.renewal-1.tsr -token_in \ -CAfile /etc/ssl/certs/ca-certificates.crt
Show that the earlier wording existed on a given day, on the word of a third party rather than yours.
The token is part of every export, so the proof leaves with the file if you ever do.
Send the page, the token and the OpenSSL command. They do not need to trust Archivepanel to check it.
Download the page and its token from the record, put them in one folder, and run OpenSSL:
openssl ts -verify -data example.com-20260923-1600.html \ -in example.com-20260923-1600.tsr -token_in \ -CAfile /etc/ssl/certs/ca-certificates.crt
It prints Verification: OK only when the signature, the certificate chain and the file all match. Change one byte of the file and it fails. No account is needed.
That this exact file existed by the signed time. It is a statement from DigiCert, following the RFC 3161 standard, over the SHA-256 fingerprint of the saved page.
Only the fingerprint: 64 characters that identify the file but reveal nothing about it. The page, its address and your account never leave Archivepanel.
In the year before they expire, DigiCert timestamps the existing token, which proves it existed while its certificates were still valid. Each renewal adds one link to the chain, about once a decade. The revocation list from that time is kept with it. You do not need to do anything, and the record lists every renewal with the command to check it.
Yes. Before it is stored we check that it covers the right file, answers our request and no earlier one, carries a valid signature, and chains to a public root through a certificate issued for timestamping.
The request is repeated automatically for 45 minutes, and the record shows how long after the capture the token was signed. Older snapshots can request a timestamp by hand; the record then says plainly that it proves the later time, not the capture time.
Start free with 100 MB of storage. No card required.