OSINT Timestamp Decoder Free
Extract and decode hidden timestamps from web pages, URLs, APIs, and online content.
Paste source code, upload files, or enter values — all processing happens in your browser.
Ctrl+K or / to focus · Ctrl+Enter to decode
Finding Timestamps in OSINT Investigations
Timestamps are hidden throughout web content, URLs, and API responses. Here's where to look and how to use this tool to extract them.
Google Search URLs
The "ei" parameter in Google URLs contains a base64-encoded Unix timestamp recording when the search results were served. This parameter does not appear in the main search bar URL — it is found in click-through URLs when you click a search result, or in navigation links (e.g., switching to the Images tab, clicking page 2). Right-click a search result link and "Copy link address" to find it, or inspect network requests in browser DevTools.
Example:ei=ZKhkZYqLDqKn5NoP-IeAqAc
Twitter/X Posts
Every tweet has a Snowflake ID that encodes a millisecond-precision timestamp. Copy the numeric ID from the tweet URL and paste it here to determine exactly when the post was created.
Example:twitter.com/user/status/1760000000000000000
Webpage Source Code
View the page source (Ctrl+U) and look for JSON-LD data, meta tags, and data attributes. Copy the entire source and paste it here — the tool auto-extracts all numeric timestamps.
Look for:datePublished, data-timestamp, created_at
API Responses
REST and GraphQL APIs frequently include Unix timestamps (seconds or milliseconds) in their JSON responses. Copy the API response and paste it to decode all timestamp fields at once.
Common fields:timestamp, created_at, updated_at
Email Headers
"Received:" headers in emails contain delivery timestamps showing when each mail server processed the message. These help trace the actual timing of email communication.
Tip: View full headers in your email client and paste them here.
Social Media Post IDs
Twitter, Discord, and other platforms use epoch-based IDs that encode creation timestamps. Even if a post is deleted, the ID reveals when it was originally created.
Platforms: Twitter/X Snowflake, Discord Snowflake, UUID v1
Wayback Machine
Wayback Machine URLs contain 14-digit timestamps (YYYYMMDDHHmmss) indicating when a page was captured. This tells you exactly when a snapshot was taken.
Format:web.archive.org/web/20231114120000/example.com
Browser History & Cookies
Chrome, Edge, and Brave store timestamps as Chrome/WebKit microseconds in their SQLite databases. If you encounter 17-digit numbers from browser artifacts, decode them here.
Example: 17-digit value like 13350247892000000
How to Use This Tool for OSINT
Whether you have a single value from a URL or an entire page source, this tool identifies and converts timestamps in seconds.
- 1
Right-click a Webpage and View Source
Press Ctrl+U or right-click and select "View Page Source." Copy the entire source code and paste it into the input field above. The tool scans the text and extracts every potential timestamp automatically.
- 2
Copy URLs with Suspicious Parameters
Copy URLs containing numeric parameters, Google EI values, or social media post IDs. Paste the full URL or just the numeric value — the tool handles both.
- 3
Upload Saved Files
Upload saved HTML pages, text files, JSON API responses, or PDF reports from your investigation. The tool parses file content locally and extracts all timestamps.
- 4
Review Results with Confidence Scoring
Web-relevant formats are shown first with confidence scoring. Forensic-only formats (Windows FILETIME, FAT/DOS, etc.) are available in a collapsible section below.
- 5
Export and Share
Copy individual values, export as CSV for your investigation report, or share a URL with colleagues that auto-decodes the same value.
Why Timestamps Matter in OSINT Investigations
Hidden timestamps in web content provide crucial evidence for establishing when events occurred, verifying claims, and building investigation timelines.
Timeline Reconstruction
Establish when content was created, modified, or accessed. Correlate timestamps across multiple platforms to build a comprehensive timeline of online activity.
Authenticity Verification
Cross-reference claimed dates with embedded timestamps. A post claiming to be from last year may have a Snowflake ID revealing it was created yesterday.
Cross-Platform Attribution
Link activity across platforms using correlated timestamps. Matching creation times across accounts can reveal connections between seemingly unrelated profiles.
Evidence Preservation
Document temporal context before content is deleted. Decode and record all embedded timestamps as part of your evidence collection process.
Supported Timestamp Formats (21)
Reference guide for all supported formats. Web formats appear first.
Web Formats
Seconds elapsed since the Unix epoch. The most common timestamp format in computing, used across nearly every operating system and programming language.
Milliseconds elapsed since the Unix epoch. Standard in JavaScript (Date.now()) and Java (System.currentTimeMillis()). Provides millisecond precision.
Microseconds elapsed since the Unix epoch. Also known as Mozilla PRTime in Firefox internals. Used in Python and PostgreSQL for high-precision timestamps.
Microseconds since January 1, 1601 UTC. Used internally by Chromium-based browsers (Chrome, Edge, Brave, Opera) to store history, cookies, and bookmark timestamps in SQLite databases.
Base64-encoded Unix timestamp found in the "ei" parameter of Google search URLs. The first 4 bytes (decoded from base64) are a little-endian 32-bit Unix timestamp in seconds.
A distributed unique ID format where the timestamp is encoded in the upper 42 bits (after right-shifting by 22 bits). The lower 22 bits contain datacenter ID, worker ID, and sequence number. Also used by Discord.
100-nanosecond intervals since October 15, 1582 UTC, embedded within a UUID v1 string. The timestamp is split across three fields in the UUID: time_low (chars 1-8), time_mid (chars 9-12), and time_hi (chars 13-16, masked by version nibble "1").
100-nanosecond intervals since January 1, 0001 in the proleptic Gregorian calendar. Used by .NET DateTime.Ticks property. The large epoch offset means values are very large numbers.
Floating-point number representing days since December 30, 1899. The integer part counts whole days and the fractional part represents the time of day. Used extensively in Microsoft Office and COM programming.
Seconds since January 1, 2001 UTC. The native date format for Apple platforms (NSDate in Objective-C, Date in Swift). Found throughout macOS and iOS application databases and plists.
Forensic Formats
These formats are typically found in disk forensics, mobile device extractions, and system artifacts. For full forensic analysis, visit forensicnotes.com/tools/timestamp-decoder.
100-nanosecond intervals since January 1, 1601 UTC. The standard timestamp format in Windows operating systems. Stored as a 64-bit value, often in little-endian byte order in raw hex.
100-nanosecond intervals since January 1, 1601 UTC. Identical encoding to Windows FILETIME. Used in Active Directory LDAP attributes for account and policy timestamps.
Packed bit-field datetime used in legacy Microsoft Word (.doc) binary format. Fields are packed into a 32-bit integer: minutes (6 bits), hours (5 bits), day (5 bits), month (4 bits), year-1900 (9 bits).
A 16-byte Windows API structure containing 8 WORD (16-bit) fields in order: year, month, dayOfWeek, day, hour, minute, second, millisecond. Commonly found in registry values and memory dumps.
Seconds since January 1, 1904 UTC. The native timestamp format of the HFS+ (Mac OS Extended) filesystem. Stored as a 32-bit unsigned integer, limiting the range to dates before February 2040.
Packed 32-bit value encoding date and time in bit fields. Upper 16 bits: year (7 bits, offset 1980), month (4 bits), day (5 bits). Lower 16 bits: hour (5 bits), minute (6 bits), second/2 (5 bits). Seconds have 2-second resolution only.
BCD-encoded timestamp used in SMS PDU (Protocol Data Unit) messages. Each byte stores two decimal digits with nibbles swapped. 7 bytes represent: year, month, day, hour, minute, second, and timezone offset.
Minutes (not seconds) since the Unix epoch, stored as a 32-bit big-endian hex value. Specific to Nokia Series 40 feature phones.
Unix seconds stored as a 32-bit big-endian hex value. Used in Motorola feature phones for call logs, SMS, and other timestamped records.
Seconds since January 6, 1980 (GPS epoch). GPS time does not include leap seconds, so it drifts ahead of UTC by the accumulated leap second count (currently 18 seconds).
Binary-coded decimal timestamp where each hex digit directly represents a decimal digit. Format: YYYYMMDDHHMMSS. Common in embedded systems and industrial equipment.
OSINT Timestamp Decoder: Frequently Asked Questions
Right-click any webpage and select "View Page Source" or press Ctrl+U. Look for numeric values in JSON-LD structured data (inside <script type="application/ld+json"> tags), meta tags (like og:updated_time or article:published_time), data attributes (data-timestamp, data-created), and inline JavaScript variables. Copy the entire page source and paste it into this tool — it will automatically extract and decode all potential timestamps.
The "ei" parameter in Google URLs contains a base64-encoded Unix timestamp that records when the search results were served. Important: this parameter does NOT appear in the main address bar URL when you search. It is found in click-through URLs (right-click a search result and select "Copy link address") and navigation links (e.g., switching to the Images tab, clicking page 2). You can also find it by inspecting network requests in browser DevTools. Paste the ei= value into this tool and it will decode the timestamp automatically.
Every Twitter/X post has a unique Snowflake ID (the numeric ID in the tweet URL, e.g. twitter.com/user/status/1760000000000000000). This ID encodes the exact millisecond the tweet was created. Paste the numeric ID into this tool and it will decode the embedded timestamp. This works even if the tweet has been deleted, as long as you have the ID.
Timestamps appear in URLs as numeric query parameters (e.g. ?t=1700000000), path segments, Google EI parameters (found in click-through and navigation URLs, not the main search bar), social media post IDs (Twitter Snowflake, Discord), Wayback Machine URLs (web.archive.org/web/20231114120000/), and base64-encoded tokens. Many web applications embed creation or modification timestamps directly in their URL structure. Note: not all URLs contain timestamps — numeric parameters may be IDs, hashes, or other non-temporal values.
Yes. Wayback Machine URLs contain a 14-digit timestamp in the format YYYYMMDDHHmmss (e.g. web.archive.org/web/20231114120000/example.com). While this tool focuses on numeric timestamp formats, you can read Wayback Machine timestamps directly from the URL: the digits represent year, month, day, hour, minute, and second in UTC.
Email headers contain multiple timestamps in the "Received:" fields, showing when each mail server processed the message. These are typically in RFC 2822 date format, but underlying systems may log them as Unix timestamps. You can also find timestamps in the Message-ID header and X-headers added by mail services.
Many social platforms use epoch-based IDs that encode timestamps. Twitter/X uses Snowflake IDs, Discord uses a similar format, and some platforms embed Unix timestamps in their API responses. View a post URL to get the numeric ID, or inspect the page source for JSON data containing timestamp fields like "created_at", "timestamp", or "date".
Yes. All processing happens locally in your browser using JavaScript. No data is sent to any server, and nothing is stored or logged. You can verify this by using the tool with your network disconnected. This makes it safe to use with sensitive investigation data.
Learn More: Timestamp Forensics — How Hidden Timestamps Reveal Online Activity
A deep dive into finding and decoding hidden timestamps in platform IDs, URLs, file metadata, and email headers. Covers Unix epochs, Twitter Snowflakes, Discord IDs, timeline reconstruction, and manipulation detection.
Read the Full GuideStart Your OSINT Investigation
This free tool is brought to you by Forensic OSINT, the evidence-grade web capture platform for OSINT investigators. Take your workflow to the next level.
