Validate any timestamp

The check runs against the European Commission's List of Trusted Lists, the register of every provider each EU member state has audited and approved. The trust anchor is the set of certificates published in the Official Journal, so the result does not depend on trusting Provlyn or any other intermediary.

Two findings are reported separately and never combined. A timestamp can be cryptographically sound and still come from a provider with no qualified status, and merging the two into one verdict would hide exactly that distinction. Article 42(1) of Regulation 910/2014 sets three requirements for a qualified timestamp: it must bind the date and time to the data so that undetected change is reasonably precluded, it must be based on an accurate time source linked to Coordinated Universal Time, and it must be signed with an advanced electronic signature or seal of the provider.

The service is open source and can be run by anyone who would rather not rely on this instance. It retains nothing, and it never receives your document.

What does this tool check?

Two separate things, reported separately. First, whether the timestamp is intact: that it was signed by the authority it names and has not been altered since. Second, whether that authority appears on the EU Trusted Lists as a qualified trust service provider. A timestamp can pass the first check and fail the second, which is why the two are never merged into a single verdict.

What is a qualified electronic timestamp?

A timestamp issued by a provider that the EU has audited and listed as a qualified trust service provider. Under Article 41(2) of Regulation 910/2014, a qualified electronic time stamp "shall enjoy the presumption of the accuracy of the date and the time it indicates and the integrity of the data to which the date and time are bound". The presumption is rebuttable, but it shifts the burden onto whoever disputes the record. An ordinary timestamp carries no such presumption.

Do I have to upload my document?

No. The timestamp is read out of your file inside your own browser, and only the timestamp is sent for checking. The document never leaves your machine, is never uploaded, and is never stored. The service keeps no record of what you check.

What does "not in EU Trusted Lists" mean?

It means the issuing authority is not a qualified trust service provider under EU law. It is not a sign of forgery. Many widely used timestamp services operate correctly under RFC 3161 without being EU-qualified, and their timestamps remain admissible evidence. Article 41(1) provides that a timestamp cannot be denied legal effect solely because it is electronic or because it is not qualified. What it lacks is the presumption of accuracy.

Which timestamps can I check?

Any RFC 3161 timestamp, from any provider. Drop a .tsr file, or a certificate PDF with timestamps embedded in it, and each timestamp found is checked in turn. Provlyn certificates work here the same as anyone else’s: the tool trusts nothing from Provlyn and reaches its verdict from the EU Trusted Lists alone.

Does a qualified timestamp count outside the EU?

Article 41(3) provides that a qualified electronic time stamp issued in one Member State is recognised in all Member States. The EEA states publish national trusted lists referenced from the Commission’s list, so recognition extends there through the EEA Agreement. The UK retains an equivalent framework including the presumption, but UK and EU qualified timestamps are no longer mutually recognised as qualified between the two regimes. The United States has no equivalent statutory presumption; a qualified timestamp is weighed there as strong technical evidence under ordinary rules of evidence.

What does a timestamp not prove?

It does not establish who created a file, who owns it, or who submitted it for timestamping. A timestamp establishes that specific data existed in a specific form at a specific moment, and that it has not changed since. Authorship and ownership are separate questions that a timestamp cannot answer on its own.