Time Seal: scheduled access for a named recipient TIME SEAL
Access starts at the time you set. Only the named recipient can claim authorization, up to 3 times.
01 / Set the recipient and access window
Schedule access up to 3 calendar years ahead, with a claim window of up to 30 days. The server uses UTC; this page shows your local time.
Access lasts at most 24 hours after the first claim, without passing the original deadline. Later claims do not extend it. The third claim or expiry clears the server key share. A recipient who has claimed can also destroy the remaining authorization.
Add files from different folders. Removing a list entry does not delete the original file. Rename duplicate filenames first.
Problem, design and limits
Time Seal specifies both the recipient and when the server may release a decryption share.
Problem: how do you deliver a file now but authorize its recipient later?
A local countdown is only a display: changing the clock or page code can bypass it. A password-protected archive instead requires the sender to deliver the password later, adding coordination and the risk of sending it to the wrong person.
Deliver the encrypted package first. Server-side authorization enforces its access window and recipient identity. This schedules access for a named recipient; it does not make the sender forget the original file.
Design: a local .patf package, server UTC checks and scheduled authorization
Check the recipient's public key, set the access window and create a .patf Time Seal package. The page converts local times to UTC; the application server's UTC clock makes the final decision. Changing a filename, countdown or local clock does not change those conditions.
This uses local compression in 4 MiB chunks, AES-GCM encryption and the Argon2id/X25519/HKDF key-share process. A separate container and authentication domain bind the start time to key encapsulation. Only key shares and metadata are uploaded, not the package or original filenames.
Access can start up to 3 calendar years ahead, with a window of up to 30 days and at most 3 claims. After the first claim, access ends within 24 hours and no later than the original deadline. Later claims do not extend it, and claims before the start time are refused.
Limits: scheduled server authorization, not a trustless cryptographic time lock
Keeping access available for three years depends on reliable clocks, service operation, database backups and available master-key versions. Shutdown or lost keys may prevent claims. A compromised server colluding with the named recipient may release decryption material early.
The sender still has the original plaintext. A recipient can keep material after a claim; revocation cannot recall keys or plaintext already received. Three claims do not mean three file opens. Cancellation, network, authentication or write failures after a claim do not refund it.
Use approved email or storage channels to deliver Time Seal packages. Keeping copies does not change the access window or claim count, or restore destroyed shares. SeeTrust and technical limits。
About this tool
Scheduled file authorization for a designated recipient
What does this tool do?
Encrypt files locally for a recipient public key, set an opening time and claim deadline, and create a time-seal package. The recipient uses a passphrase and TOTP to claim a key share during the permitted window and decrypt locally.
How to use it
- The recipient sets up an identity; the sender checks the public-key fingerprint through a trusted channel.
- Choose files, the recipient key, opening time and deadline, then save a time-seal package locally.
- Deliver the package separately. During the window, the recipient claims a share with their passphrase and TOTP and decrypts it.
Data handling and limits
Up to 1 GiB per file. Opening may be scheduled up to three years ahead, with a claim window of up to thirty days. At most three claims; after the first, the effective deadline is no later than twenty-four hours or the original deadline. Depends on a trusted server clock and continued operation, not a trustless time lock. Saved material cannot be recalled. Content stays local; necessary authorization and audit data remain online.
Related tools