"Can you prove this document hasn't been changed since you sent it?" is a question that comes up more than people expect — a signed contract, a delivered invoice, a piece of design work, a legal filing. The usual answer is "trust me" or "check the email timestamp," neither of which actually proves anything. A document certificate answers it properly, and it's simpler than it sounds.
The idea in one sentence
A document certificate is a fingerprint of a file's exact contents, created in your browser, that anyone can check later to confirm the file hasn't been altered by even a single byte.
The fingerprint is a SHA-256 hash — a standard cryptographic function that turns any file into a fixed-length string of characters. Change one character anywhere in the original file — a comma, a date, a dollar figure — and the hash comes out completely different. That property is what makes it useful as proof: it's not "probably the same," it's mathematically identical or it isn't.
Why the file itself never gets uploaded
This is the part people usually assume works differently: docstoc never sees or stores your actual file. The hash is computed locally in your browser using the Web Crypto API — the same building block browsers use for HTTPS — and only the resulting hash (plus, optionally, the filename) gets sent to create the certificate. The document's actual contents never leave your device.
That matters for two reasons. First, privacy — you're not uploading a contract or financial document to a third-party server to prove something about it. Second, it means the proof doesn't depend on trusting docstoc to have handled your file carefully, because docstoc never had it.
Why it's anchored to Bitcoin instead of just a database timestamp
A timestamp docstoc generates and stores in its own database is only as trustworthy as docstoc is. If the whole point is proving something to someone who has no reason to trust docstoc — a client, a counterparty, a court — a database row isn't strong enough evidence on its own.
That's the actual reason for anchoring certificates to the Bitcoin blockchain via OpenTimestamps, a free, open protocol built exactly for this. The hash gets included in a Bitcoin transaction (batched with many other hashes to keep it free and efficient), and once that transaction is confirmed, the existence of that exact hash at that point in time becomes independently verifiable by anyone, using any OpenTimestamps-compatible tool — not just docstoc's own systems. If docstoc disappeared tomorrow, the Bitcoin anchor would still be checkable.
Anchoring isn't instant — a batch typically confirms within a few hours — so a fresh certificate shows "Bitcoin timestamp pending" until it does, then upgrades to "Bitcoin-timestamped" automatically. Every certificate also offers a downloadable `.ots` proof file, so the timestamp can be verified independently with the standard `ots` command-line tool, without relying on docstoc's verification page at all.
What a certificate is actually good for (and what it isn't)
Good, realistic uses:
- Proving a contract or deliverable had specific contents as of a specific date, if a dispute comes up later
- Giving a client or collaborator a link where they can independently re-check a file against the original — dropping the current version in and seeing an instant match/mismatch, no account needed
- Adding a lightweight "this hasn't been tampered with" signal to a document you're distributing publicly, via an embeddable badge
What it is not:
- It is not a substitute for an electronic signature. A certificate proves a file's contents are unchanged since a point in time — it doesn't prove who agreed to it or that anyone signed anything.
- It is not identity verification. It says nothing about who created the document or whether the parties named in it are who they say they are.
- Revoking a certificate doesn't erase the Bitcoin anchor — the hash's historical existence stays independently verifiable — it only changes the status shown on docstoc's own verification page.
How to actually check a certificate
Every certificate gets its own public verification page. Anyone with the link can drop the current version of the file into that page, and the comparison happens entirely in their browser — same as creation, no upload, no server round-trip. Match means byte-for-byte identical to the original; no match means something changed, even something as small as re-saving the file in different software.
FAQ
Does this work for any file type?
Yes — the hash function works on any file's raw bytes, so it works for PDFs, Word documents, images, spreadsheets, anything.
What if I need to revoke a certificate I created by mistake?
Certificates can be revoked from your account. A revoked certificate's page shows a clear "revoked" status instead of "verified," though the underlying Bitcoin timestamp (if confirmed) remains independently checkable by design — that's the tradeoff of using a public, immutable anchor.
Do I need to know anything about Bitcoin or own any cryptocurrency to use this?
No. There's no wallet, no crypto to buy or hold. Bitcoin is used purely as a public, tamper-proof ledger for the timestamp — you never interact with it directly.
Is my file's content ever visible to docstoc or anyone else?
No — only the hash (a one-way fingerprint) and, if you choose to include it, the filename. The file's actual contents are never uploaded.
How is this different from just emailing myself the document as proof?
An email timestamp can be edited, forwarded, or disputed, and it only proves something to the extent people trust your inbox and your email provider's records. A Bitcoin-anchored hash is independently verifiable by a third party using public infrastructure, without needing to trust either docstoc or your email account.
Does docstoc charge for the Bitcoin timestamping?
No — OpenTimestamps itself is a free, donation-supported protocol, and docstoc doesn't add a fee on top of it for certificates.