How to Timestamp Documents Without Uploading Them

If a timestamping service asks you to upload your document, it is asking for more than it needs. The whole technique runs on a hash, and a hash can be computed on your own machine in under a second.

This matters most for exactly the documents worth timestamping: unfiled patents, draft contracts, manuscripts, client work under NDA. Uploading those to a third party is a disclosure, and often one you are not permitted to make.

Why the file never needs to leave

Timestamping publishes a fingerprint, not the document. SHA-256 turns any file into 64 hexadecimal characters, and that string is what gets recorded.

The fingerprint is enough because it is:

• Unique to the file. No two meaningfully different files share a hash.
• One-way. The hash cannot be reversed into the document.
• Reproducible. Anyone holding the file can recompute the hash and compare.

So the verification story works perfectly with the file never moving: you hash locally, the hash is published, and later you produce the file and anyone can re-hash it to confirm the match.

How client-side hashing works

Modern browsers ship a Web Crypto API that computes SHA-256 natively. The sequence is:

1. You pick a file. The browser reads it from disk into memory — a local operation, no network involved.
2. crypto.subtle.digest('SHA-256', bytes) returns the digest.
3. The 64-character hex string is displayed.
4. Only that string is ever transmitted.

You can watch this happen. Our hash generator does exactly this, and the page keeps working with your network disconnected — a decent demonstration that nothing is being sent.

Verifying the claim yourself

Do not take any service's word for it, including ours. Three checks, in ascending order of rigour:

1. Watch the network tab. Open developer tools, switch to Network, and hash a file. If the document were being uploaded you would see a request carrying megabytes. You should see nothing.

2. Pull the plug. Load the page, disconnect from the internet, then hash a file. If it still produces a hash, the computation is local. This is the most convincing test and takes ten seconds.

3. Compare against your own tools. Hash the file with a command-line tool and check that the values match:

# macOS / Linux
shasum -a 256 contract.pdf

# Windows PowerShell
Get-FileHash contract.pdf -Algorithm SHA256

Identical output means the service computed the standard SHA-256 of your file and nothing exotic is going on.

Red flags

Treat these as reasons to look elsewhere:

• Upload is mandatory with no client-side option. The file is not needed; asking for it is a choice.
• The service offers to store your document. Convenient, and a different product with different risk. Storage is not timestamping.
• You are asked for the file to verify. Verification also needs only the hash.
• No explanation of what is published. A service should tell you plainly that only the hash goes on-chain.
• Size limits measured in megabytes. A hint the file is crossing the network.

When you do want to upload something

One honest exception: some workflows embed a timestamp inside the file — PAdES signatures in a PDF, for example. There the file must be modified, so the tool needs it. That is a legitimate different purpose, covered in how to timestamp a PDF.

If all you need is proof the document existed and is unchanged, no upload is required at any point.

What you end up with

A public record containing your hash, a transaction anyone can inspect, and a document that never left your laptop. To prove the point later you produce the file yourself and let the other side re-hash it.

Being precise about the limit: this proves existence and integrity at a time, not authorship — see proof of existence vs proof of authorship.