TimeBinder

Start →

Compare

Are Git commit dates proof? Git shows what changed and in what order. A timestamp shows when.

Drop your release files here Any file type. Up to 10 files per TimeBind. Opens the TimeBinder app.

Clicking opens the TimeBinder app. Files are hashed locally on your computer; nothing is uploaded or stored by TimeBinder.

Developers often point to Git history to show when code existed. Git is excellent at showing what changed and in what order. It is weak at showing when, because the dates are written by whoever makes the commit.

Your files never leave your computer. With TimeBinder, each file is hashed locally on your own device. Nothing is uploaded or stored by TimeBinder.

Can Git commit dates prove when code existed?

Short answer: not on their own. Git takes author and committer dates from the committer’s machine, and both can be set to anything. Git does protect integrity, because each commit ID depends on everything before it. Timestamp a commit ID or release archive with TimeBinder and that history is anchored to the Bitcoin blockchain, showing it existed no later than the recorded time. It doesn’t show who wrote the code. See source code timestamping for developers.

That makes Git and a timestamp a good partner, not a choice between them.

What is TimeBinder? TimeBinder is a blockchain timestamping service. It shows that a digital file existed no later than a specific time, and that it still matches its fingerprint, by anchoring the file’s SHA-256 fingerprint to the Bitcoin blockchain. Files are hashed in your browser and never uploaded, and each TimeBind comes with a Proof of Time Certificate that can be checked later. It does not prove who created a file or that its contents are true.

Why commit dates are easy to challenge

  1. Dates come from the committer’s machine. Both the author date and the committer date can be set to anything with git commit –date or environment variables.
  2. History can be rewritten. Rebase, amend and filter tools change committer dates and commit IDs. A force-push replaces the remote history.
  3. Signatures prove keys, not time. A signed commit shows a key signed it, not when.
  4. Hosting records are not yours. GitHub, GitLab and Bitbucket keep server-side push records, but they are the platform’s, and repositories can be deleted.

Git commit dates vs Git + TimeBinder

Git commit datesGit + TimeBinder
Who sets the dateThe committerRecorded independently on the Bitcoin blockchain
Can the date be backdated?YesNo: the record shows no later than the anchor time
Covers the whole history?Yes, by commit IDYes: anchor a commit ID or a release archive
Code uploaded?To your Git hostNo: only a hash leaves your device

A simple routine for each release

  1. At each release or milestone, run git rev-parse HEAD > commit-id.txt and git archive --format=zip -o release.zip HEAD.
  2. TimeBind both files in one TimeBind. Keep the exact zip and the certificate together.
  3. Later, you can check the commit ID in the repository, or re-hash the saved zip, and check it against the record.

Note: git archive output can vary between Git versions, so keep the exact zip you TimeBound rather than regenerating it. The commit ID file is the more durable anchor.

How it works

Three steps. Submitting takes a few minutes; a Pooled TimeBind is usually recorded within 24 to 48 hours, and often sooner, depending on Bitcoin network activity, and ASAP is faster.

  1. Drop your files

    Add commit-id.txt and release.zip, up to 10 files per TimeBind. Any file type and size works.

    commit-id.txt · release.zip

  2. Hashed on your computer

    Your browser works out a unique SHA-256 fingerprint for each file. Nothing is uploaded. The files never leave your device and TimeBinder never stores them.

    fingerprint 9f2c…41ab · file stays with you

  3. Sealed to Bitcoin

    The fingerprints are anchored to the Bitcoin blockchain: ASAP (your own transaction, sent straight away) or Pooled (usually recorded within 24 to 48 hours, and often sooner, depending on Bitcoin network activity). You get a Proof of Time Certificate, a PDF with a QR code and the Bitcoin transaction ID.

    ✓ sealed · certificate ready
Timestamp a release →

What a TimeBind shows, and what it doesn’t

What it shows

  • That this exact file existed no later than the time recorded on the Bitcoin blockchain
  • That a file shown later still matches its fingerprint: the same file gives the same fingerprint, and any edit gives a different one
  • A record kept outside your own systems: an ASAP TimeBind can be checked on the Bitcoin blockchain without relying on TimeBinder, and a Pooled TimeBind is verified through TimeBinder

What it doesn’t show

  • Who created, wrote or signed the file
  • That the contents are true or accurate
  • How a court or other decision-maker will treat it: that depends on the jurisdiction and the rules that apply. It isn’t legal advice

Frequently asked questions

Can Git commit dates be faked?

Yes. Git takes author and committer dates from the machine that makes the commit, and both can be set to any value, for example with the –date option or the GIT_AUTHOR_DATE and GIT_COMMITTER_DATE environment variables. Rebasing also rewrites committer dates.

Do signed commits prove when code was written?

No. A GPG or SSH signature shows which key signed the commit. The date inside the commit is still whatever the committer’s machine said.

Is GitHub’s history good evidence?

It can be useful, because GitHub records pushes on its servers. But those records belong to GitHub, the public events feed only goes back a short time, and repositories can be deleted or rewritten.

What is the simplest way to timestamp a Git repository?

Timestamp the release archive (git archive of a tag) or a small text file containing the full commit ID. Because a commit ID covers the whole tree and history, a timestamp of it shows that exact commit existed no later than that time.

Is my code uploaded?

No. Your browser hashes the files locally and only the fingerprint is recorded. Your source stays on your machine.

Related guides

Open TimeBinder and timestamp a release

Here’s what you’ll do next:

  1. Open the app and sign in with email or Google.
  2. Add your release files. They stay on your computer.
  3. Seal them and download your Proof of Time certificates.
Open TimeBinder →
Your code stays privateEvery file is hashed locally on your own computer. Your files are never uploaded or stored by TimeBinder; only a fingerprint is sealed to Bitcoin.

Start free: your first Pooled TimeBind each month costs nothing. See pricing