Archivepanel

A capture date someone else signs.

The capture time on a record is our word for when a page was saved. A trusted timestamp is an independent authority's: DigiCert signs a statement that a file with exactly this digest existed at that moment.

What is sent, and what comes back

Stays with us

The document

The saved page, in private storage. The authority never sees it, its address or your account.

Sent to DigiCert

Its SHA-256 digest

Sixty-four hex characters. Change one byte of the document and they change completely.

3f2a9c1e…0b7de17b
Kept with the record

A signed token

The authority's signature over the digest and the time, stored beside the snapshot.

timestamp.tsr

Checked the moment it arrives

  • It covers our digest, not some other file's.
  • It answers our request and no earlier one.
  • The signature is valid.
  • It chains to a public root through a certificate issued for timestamping.

Check it yourself, without us

Download the document and its token from the record page, put them in one folder, and run OpenSSL. It prints Verification: OK only when the signature, the certificate chain and the file's digest all agree.

No account is needed, and nothing depends on Archivepanel still existing.

openssl ts -verify -data example.com-20260923-1600.html \
  -in example.com-20260923-1600.tsr -token_in \
  -CAfile /etc/ssl/certs/ca-certificates.crt

Kept checkable for decades

A token can be checked while the certificates behind it are valid, roughly ten years. Before they expire, the authority timestamps the token itself. Each renewal adds one link to the chain, and the original proof carries through.

  • Nothing new leaves the service. A renewal sends the digest of the previous token.
  • Revocation is recorded. The authority's revocation list is kept with each renewal.
  • Nothing to do. The record lists every renewal and prints the commands to check each link.
  1. At capture

    Token

    Proves the document existed at the certified time. timestamp.tsr

  2. The year before its certificates expire

    Renewal 1

    Proves the token existed while its certificates were still good. timestamp-renewal-1.tsr

  3. About ten years later

    Renewal 2

    Covers renewal 1 in the same way, and so on, once a decade.

A late token says so. If the authority cannot be reached, the request is repeated for 45 minutes and the record shows how long after the capture the token was signed. A token requested later for an older snapshot proves only the later time, and the record says that plainly.

More features

Start with one page.

Create an account on the free tier, paste an address, and see the snapshot land in your archive.

Create your account See pricing