How to Prove Code Existed at a Specific Time (Without Revealing It)

If you need to prove that a specific piece of code existed before a certain date—for a patent dispute, an employee disagreement, or a competitor’s “independent development” claim—standard Git history is not enough. Internal logs live on servers you don’t own, can be edited, and are often dismissed in legal audits as self-serving. This article walks through the exact task: proving code existed at a specific time without revealing the code itself.

You’ll do this by anchoring Git commit hashes—not source code—to the Bitcoin blockchain using the managed Timestamp GIT GitHub App. By the end, you’ll have an immutable, court-ready proof that anyone can verify independently, with no manual cryptography work and no source code ever leaving your repository.

If you’re new to the underlying concept, see What Is Cryptographic Proof of Authorship for Code?.

Prerequisites

• A GitHub account and a repository you want to timestamp. Public repositories work on the free Open Source plan. Private repositories require a paid Pro Agency or Enterprise ZK plan.
• Access to the Timestamp GIT GitHub App and a Timestamp GIT account. You’ll install the app once from the product page at Timestamp GIT.
• Basic familiarity with Git commits and repository structure. No advanced cryptography knowledge is needed.
• For private repositories, make sure your account has a paid plan tier that includes private repos.

Step-by-Step: Setting Up Automatic Timestamping

Step 1: Install the Timestamp GIT GitHub App

Go to the Timestamp GIT dashboard and start the GitHub App installation. Choose your personal account or organization, then grant the requested permissions:

• Read access to the source repository. GitHub’s permission system requires at least read-only access because commit hashes are not exposed without it.
• Read-write access to the target repository where proof files will be written.

The important guarantee: Timestamp GIT never reads, copies, or stores your source code. It only extracts commit hashes.

Step 2: Connect your repository

After installing the app, open the Timestamp GIT dashboard and select the repository you want to monitor. Choose where proofs should be delivered:

• A dedicated timestamps branch in the same repository, or
• A separate shadow repository.

This target location is where the manifest and .ots receipt files will be pushed later.

Step 3: Configure timestamping preferences

The default behavior is automatic nightly batching. Pending commit hashes are grouped daily, a Merkle tree is built, OpenTimestamps proofs are created, and the Merkle root is anchored to Bitcoin. In most cases, you don’t need to change anything.

If you’re using Enterprise ZK mode, you’ll run a short GitHub Action on your own infrastructure instead of granting read access to the source repository. That action pushes only commit hashes to the Timestamp GIT API, so your source code never leaves your environment.

Step 4: Make a new commit

Commit to your repository as usual. The GitHub App detects the new commit automatically via webhooks.

git add .
git commit -m "Add new feature logic"
git push origin main

No extra timestamp command is needed. The commit hash enters Timestamp GIT’s queue automatically.

Step 5: Wait for the nightly cron job

Each night, Timestamp GIT processes the pending hashes:

1. Groups all pending commit hashes from the day.
2. Creates manifest text files for each repository.
3. Builds a Merkle tree natively.
4. Creates OpenTimestamps proofs using public OTS calendars.
5. Anchors the Merkle root into the Bitcoin blockchain.

Bitcoin confirmation typically takes a few hours after the nightly batch.

Step 6: Receive your proof

Once the Bitcoin transaction is confirmed, Timestamp GIT pushes the proof files to the designated branch. You’ll see:

• A manifest file listing the commit hashes.
• .ots receipt files for the daily batch.

These proof files are vendor-independent. You can verify them later even if the Timestamp GIT service disappears.

Step 7: Add a verification badge to your README

From the repository status page, copy the provided Shields.io badge markdown and paste it into your README.md. For public repositories, the badge links to a public verification page. For private repositories, the badge URL includes an encrypted HMAC so only authorized users can view the status.

The dashboard provides the exact markdown snippet, which will look similar to:

[![Timestamped](https://timestampgit.dev/api/badgeLink/your-user/your-repo/shields)](https://timestampgit.dev/status/your-user/your-repo)

Replace your-user and your-repo with the actual values shown in the dashboard.

How to Confirm It Worked (Verification)

Check the repository status dashboard

Open the public status page for your repository. It shows:

• Proof longevity and earliest anchor date.
• Daily anchoring regularity and a calendar heatmap.
• Bitcoin block height and transaction data.
• Downloadable audit CSV and PDF certificate for a specific date.

Run verification in the browser

Use the verification page for a specific repository and date. It walks through the Merkle chain verification step by step, and all computation happens locally in your browser. Nobody sees what you verify.

Download a PDF certificate

For a court-ready document, download the PDF certificate for the date you need. This gives you a clean, shareable proof without exposing any code.

Check the API programmatically

You can query the public status endpoints with curl:

curl https://timestampgit.dev/api/statusLast/your-user/your-repo
curl https://timestampgit.dev/api/statusCount/your-user/your-repo
curl https://timestampgit.dev/api/statusSummary/your-user/your-repo

The last endpoint returns a combined summary suitable for Shields.io badges.

Independent verification for advanced users

Because the proof relies only on SHA-256 and Bitcoin block data, you can download the .ots receipt and verify it with standard OpenTimestamps verification tools against the Bitcoin blockchain. This does not require trusting Timestamp GIT or any vendor. The managed app simply automates the process that would otherwise require manual protocol work.

Troubleshooting Common Issues

No timestamp appears after a commit

Check that the GitHub App is installed on the account or organization and that the repository is connected in the Timestamp GIT dashboard. Only commits made after the setup will be timestamped.

Proof not delivered after 24 hours

Bitcoin confirmation can take several hours after the nightly batch. Check the repository status dashboard for a pending state. If you’re using a private repository, confirm that your plan includes private repos.

Badge shows ‘unverified’ or a broken link

Verify the badge URL from the dashboard and make sure the repository is public or the encrypted HMAC is included for private repos. A broken link often means the repository or username is mistyped.

You need to prove existence for code not hosted on GitHub

Use Enterprise ZK mode. A GitHub Action runs on your infrastructure and pushes only commit hashes to the API. This works with any Git repository, and Timestamp GIT needs no read access to the source repo.

You want to self-host in an air-gapped environment

Timestamp GIT is available as a Docker image with a self-hosted license. You can run the same managed workflow on your own infrastructure using the provided Docker Compose setup:

services:
  timestampgit:
    image: rue1401/timestampgit:prod
    ports:
      - "8080:8080"
    volumes:
      - ./data:/app/data
    restart: unless-stopped
  valkey:
    image: valkey/valkey:8
    restart: unless-stopped

Then start it with:

docker compose pull
docker compose up -d
docker compose logs -f timestampgit

The application is available at http://localhost:8080 after startup. A time-limited demo license is available for evaluation.

FAQ

Does timestamping my code reveal its contents to anyone?

No. Timestamp GIT only extracts the Git commit hash—a cryptographic fingerprint—and anchors that hash into the Bitcoin blockchain. Your actual source code is never read, copied, or stored by the service.

How long does it take to get a timestamp proof?

The process is automatic. After you commit, the hash is queued and anchored in the next nightly batch. Bitcoin confirmation typically takes a few hours, after which the proof files are pushed to your repository.

Can I verify the timestamp without relying on Timestamp GIT?

Yes. The proof is based on the OpenTimestamps protocol and Bitcoin blockchain data. You can download the .ots receipt and verify it independently using standard OpenTimestamps tools, even if Timestamp GIT disappears.

What if I need to prove existence for code not hosted on GitHub?

Timestamp GIT offers an Enterprise ZK mode where a GitHub Action runs on your infrastructure and pushes only commit hashes to the API. This works with any Git repository, and your code never leaves your environment.

Conclusion

You now know how to prove code existed at a specific time without revealing it: install the Timestamp GIT GitHub App once, connect a repository, and let the service anchor every commit hash to Bitcoin automatically. Your source code never leaves your repository—only cryptographic fingerprints are timestamped.

The proofs are independent of any single vendor, rely on Bitcoin math, and can be verified in a browser, via API, or with standard OpenTimestamps tools. For public repositories, the free Open Source plan is a practical starting point. For private repos or air-gapped environments, the Pro Agency, Enterprise ZK, and Docker self-hosted license options cover the rest.

If you want to understand the underlying concepts or compare the managed approach with the raw protocol, see the articles below.

Related posts

• What Is Cryptographic Proof of Authorship for Code?
• Timestamp GIT vs. OpenTimestamps: Which Is Right for You?
• Install a GitHub App to Timestamp Your Commits Automatically