How to Prove Your Code Existed on a Specific Date (Without Revealing It)

The task is simple to state but hard to solve well: prove that a specific commit—or an entire codebase—existed on a given date, without publishing your source code or relying on logs that a court might dismiss as self-serving. This guide walks through exactly how to do that with Timestamp GIT, a managed GitHub App that anchors Git commit hashes to the Bitcoin blockchain using the OpenTimestamps protocol.

By the end, you’ll have automated, zero-knowledge timestamping for your Git history. Every monitored commit gets a .ots cryptographic receipt, a public verification page, and a path to court-ready prior-art evidence—all without installing OpenTimestamps tooling or touching Bitcoin transactions yourself.

Prerequisites

Before you start, make sure you have:

• A GitHub account.
• A repository you want to timestamp—public or private.
• Access to install the Timestamp GIT GitHub App from timestampgit.dev.
• Basic comfort with git commit and git push. No cryptography or blockchain knowledge is required.
• For Enterprise ZK Mode: a GitHub Actions workflow file provided by Timestamp GIT, plus a target repository where proofs will be written.
• Optional: if you need an air-gapped or self-hosted setup, a Timestamp GIT Docker license.

Pricing fits the use case: public repositories can use the free tier, private repositories are covered by Pro Agency at $49/month, and Enterprise ZK Mode with GitHub Actions starts at $199/month.

Step-by-Step: Setting Up Automatic Timestamping

Step 1: Install the Timestamp GIT GitHub App

Go to timestampgit.dev and install the Timestamp GIT GitHub App from the GitHub Marketplace.

The permissions you grant depend on your mode:

• Standard Mode: Timestamp GIT needs read-only access to the source repository because GitHub does not offer a “commit hash only” permission. It reads only the HEAD commit hash, never file contents.
• Enterprise ZK Mode: Timestamp GIT needs no read access to the source repository at all. You just need write access to a separate target repository where the proof files will live.

In both modes, the target repository receives a dedicated branch or shadow repository containing the proofs.

Step 2: Select the Repositories to Monitor

After installation, open the repository dashboard at timestampgit.dev/repos. You’ll see the repositories you can monitor.

Select the source repositories that should be timestamped automatically. If you use a separate shadow repository for proofs, choose that as the target.

Step 3: Choose Your Deployment Mode

Timestamp GIT offers two modes:

• Standard Mode: The GitHub App detects new commits automatically via webhooks and reads only the commit hash.
• Enterprise ZK Mode: A short GitHub Action runs on your own infrastructure and pushes only the commit hash to the Timestamp GIT API. Your source code never leaves your environment.

For most teams, Standard Mode is the fastest path. For strict compliance or private-source environments, Enterprise ZK Mode is the stronger zero-knowledge option.

Step 4: For Enterprise ZK Mode, Add the GitHub Actions Workflow

If you choose Enterprise ZK Mode, Timestamp GIT provides a 12-line workflow file. A simplified version looks like this:

# .github/workflows/timestamp-git.yml
name: timestamp-git

on:
  push:
    branches: ["**"]

jobs:
  timestamp:
    runs-on: ubuntu-latest
    steps:
      - name: Send commit hash to Timestamp GIT
        env:
          TIMESTAMP_GIT_SIGNED_URL: ${{ secrets.TIMESTAMP_GIT_SIGNED_URL }}
        run: |
          curl -f -X POST "$TIMESTAMP_GIT_SIGNED_URL"

The real workflow uses a signed URL generated in the Timestamp GIT dashboard. That URL carries the HMAC value and commit identifier, so the Action never handles source code—just the hash.

Step 5: Make a Commit

Now create a normal commit and push it to the monitored repository:

git add .
git commit -m "feat: add rate limiter"
git push origin main

In Standard Mode, the GitHub App detects the new commit through a webhook. In Enterprise ZK Mode, the GitHub Action pushes the commit hash to the Timestamp GIT API as soon as the push occurs.

Step 6: Wait for the Nightly Batch Process

Timestamp GIT does not anchor every commit individually in real time. Instead, a nightly cron worker runs at midnight:

1. It collects all pending commit hashes.
2. It groups them into daily manifest files.
3. It builds a Merkle tree.
4. It creates OpenTimestamps proofs using public OTS calendars.
5. It anchors the Merkle root into the Bitcoin blockchain.

Bitcoin confirmation normally takes around three hours. After that, the proof is immutable—no entity, including Timestamp GIT or you, can alter it.

Step 7: Retrieve Your Proof

Once the nightly process finishes, Timestamp GIT pushes the manifest and .ots receipt files back to your dedicated timestamps branch or shadow repository.

You can also download the proof files directly from the Timestamp GIT dashboard. The main artifacts are:

• The daily manifest file that contains the commit hashes.
• The .ots receipt file for each anchored batch.
• Audit metadata showing the Bitcoin block and transaction information.

How to Confirm It Worked (Verification)

Verification is where Timestamp GIT turns a Git hash into something you can show a lawyer, auditor, or court.

Check the Repository Status Page

Open https://timestampgit.dev/status/{user}/{repo}. This public dashboard shows:

• The latest anchored Bitcoin block and transaction details.
• The earliest anchor date for the repository.
• Daily timestamping regularity.
• A calendar heatmap of anchored commits.
• Downloadable audit CSV and PDF certificate.

Run Browser-Based Merkle Verification

For a specific day, open https://timestampgit.dev/verification/{user}/{repo}/{date}. This page walks through the Merkle chain verification step by step.

All computation happens locally in your browser. Timestamp GIT never sees what you verify—it’s a zero-knowledge verification flow.

Download Formal Records

Use the dashboard or API to download:

• A PDF certificate for a specific date.
• A full audit ledger as CSV.

These are useful for contract disputes, IP due diligence, and legal discovery.

Add a Verification Badge to Your README

Timestamp GIT provides embeddable Shields.io badge snippets from https://timestampgit.dev/connected/{user}/{repo}. Place the generated Markdown in your README to publicly display verification status.

Keep in mind that private repositories use an encrypted HMAC appended to the badge URL. Only authorized users can see the status for private repos.

Independent Verification

If you ever want to verify outside the Timestamp GIT interface, you can download the .ots receipt file and run standard OpenTimestamps verification tools against the Bitcoin blockchain. The product’s browser-based verification page already handles this for you, but the receipt remains independently verifiable forever.

Troubleshooting Common Issues

No Commits Detected

Check that the GitHub App is installed on the correct repository and has the permissions required for your mode. In GitHub settings, look at webhook deliveries to see whether Timestamp GIT received the push event.

Proof Not Appearing After a Day

Remember that Bitcoin anchoring takes several hours—normally around three hours. Confirm that the nightly cron job ran and that the target branch received new files. If you’re in Standard Mode, check that the target repository is writable.

Badge Shows “Unverified”

If the repository is private, the public badge will not work unless you use the HMAC-signed URL from the badge widget. For public repositories, make sure you’re using the exact snippet generated by Timestamp GIT.

Enterprise ZK Mode Not Sending Hashes

Open the GitHub Actions workflow logs and look for errors. Confirm that:

• The signed URL in the repository secret is still valid.
• The target repository is reachable.
• The workflow runs on the correct push events.

Self-Hosted Docker Instance Issues

If you run the Docker image, verify the Compose setup and logs:

docker compose pull
docker compose up -d
docker compose logs -f timestampgit

Also check that the license file is valid and mounted in the expected location. The app is available at http://localhost:8080 after startup.

FAQ

How does Timestamp GIT prove my code existed on a date without seeing my code?

Timestamp GIT extracts only the Git commit hash—a one-way cryptographic fingerprint—and anchors that hash into the Bitcoin blockchain. The actual source code never leaves your repository. Because the hash cannot be reversed to reveal the code, the timestamp proves that the hash existed at that moment, which in turn proves the code existed.

Can I use Timestamp GIT for private repositories?

Yes. Timestamp GIT has plans for private repositories. In Standard Mode, the GitHub App needs read access to the source repository to detect commit hashes, but it never reads file contents. In Enterprise ZK Mode, a GitHub Action sends only the commit hash to the API, so the app never has access to the source repository at all.

What happens if Timestamp GIT goes out of business? Can I still verify my timestamps?

Your timestamps remain verifiable forever. The proofs are based on the Bitcoin blockchain and the OpenTimestamps protocol, both of which are independent of Timestamp GIT. You can download the .ots receipt files and verify them locally using standard OpenTimestamps tools against the Bitcoin blockchain, without any reliance on Timestamp GIT’s servers.

Is the timestamp legally binding in court?

No timestamp can guarantee a specific legal outcome. However, cryptographic timestamps anchored in the Bitcoin blockchain are increasingly recognized as strong evidence of existence at a point in time. They provide a tamper-proof, mathematically verifiable record that can be presented in legal proceedings to support claims of prior art or authorship. You should consult legal counsel about admissibility in your jurisdiction.

Conclusion

You’ve now set up automatic, zero-knowledge timestamping for your Git commits with Timestamp GIT. Instead of maintaining fragile internal logs or manually learning a cryptographic protocol, you installed a GitHub App once, connected a repository, and let nightly processes anchor commit hashes into Bitcoin.

The result is immutable proof of prior art, independent of any vendor, generated without revealing source code. Start with the free tier for public repositories, or explore the Docker self-hosted option if you need air-gapped infrastructure.

For deeper dives, see the related posts below.

Related posts

• Protect Your Startup from Patent Trolls with Git Timestamping
• How Dev Shops Can Prove Work Delivery with Timestamp GIT
• Proof of Existence for Code: What It Is and Why It Matters