Use this command to install timeglyph with WinGet:
winget install --id=SecurityRonin.timeglyph -e
TimeGlyph is a timestamp analysis tool designed to decode, encode, and identify various ways systems inscribe time. It provides ranked and scored interpretations of timestamps, ensuring clarity and precision by acknowledging ambiguity rather than offering single answers.
Key Features:
Live Timestamp Decoding: Hover over any number on screen to instantly see its time interpretation in multiple formats, with confidence scores and citations.
Multi-Format Support: Handles over 45 timestamp formats, including Unix, FILETIME, WebKit, Cocoa, HFS+, FAT/DOS, and more.
Cross-Platform Accessibility: Available via Winget for Windows, offering seamless installation and integration with the command line.
CSV Enrichment and Bulk Processing: Automatically decode timestamps in CSV files or scan logs for time data at scale.
Reference Calendar Tooling: Generate detailed calendars that include DST changes, leap seconds, epoch markers, and lunar phases for precise temporal analysis.
Target Audience and Benefits:
Ideal for digital forensics investigators (DFIR), incident responders, and forensic analysts to analyze and interpret timestamps with precision. TimeGlyph helps users quickly identify ambiguous or unknown timestamps, ensuring accurate time-based analysis in both investigative and operational workflows. Its ability to decode and rank interpretations across multiple formats makes it an essential tool for professionals requiring reliable temporal data insights.
README
TimeGlyph
Decode any timestamp. Identify the unknown ones. See time itself.
TimeGlyph Lens — hover any number on screen and read its time live, ranked and cited.
Every examination throws raw timestamps at you — a 133801920000000000 buried in
an artifact — that you need in human-readable time. timeglyph reads that value
every way a system might have written it and reports the results ranked, scored,
and cited — honest about the ambiguity instead of guessing one answer.
Mostly you never type them at all: hover the number and read its time live. When
you need more, the same engine converts a whole CSV in one pass, or lays a month out as
a timezone/DST/leap-aware reference calendar — DST fold/gap days, leap seconds, GPS
week, format epochs, and the moon's phase, all flagged. One static Rust binary and a
live overlay, from a single install command.
The playground runs the real engine as WebAssembly, entirely client-side — paste a value, see every ranked, cited reading; nothing leaves the page.
$ timeglyph 1577836800
# readings consistent with 1577836800 (ranked; a raw value is usually underdetermined — not a single verdict):
[1.00] unix 2020-01-01T00:00:00Z (Unix time (seconds))
[0.94] postgres 2000-01-01T00:26:17.8368Z (PostgreSQL timestamp (µs since 2000))
[0.67] cocoa 2051-01-01T00:00:00Z (Cocoa / CFAbsoluteTime (s since 2001))
[0.67] hfsplus 1953-12-31T00:00:00Z (Apple HFS+ (s since 1904))
...
You get the CLI on your PATH plus a real launcher for the overlay — a
Launchpad/Spotlight app on macOS (Developer-ID-signed and notarized), a Start Menu
shortcut on Windows, a desktop entry on Debian/Ubuntu (amd64 and arm64).
CLI only (Cargo, or the portable Linux archive)
cargo install timeglyph
cargo install and the static musl archive ship the CLI alone — no overlay.
On macOS you can also take the CLI by itself with
brew install securityronin/tap/timeglyph.
What you do with it
TimeGlyph Lens — hover anything, decode time data
The way most people use it: never type a timestamp again. Hover any number on
screen and read its time live. An always-on-top overlay follows your cursor and shows
timeglyph's ranked readings for the number in the UI element under the pointer — so you
never copy a value into a converter. Each row carries its confidence, the weekday, and
the public holiday for that date in the chosen zone. Pick any display timezone from the
footer.
It comes with the one-command install above, and reads the element under
the cursor through the platform accessibility layer — the Accessibility API on macOS,
UI Automation on Windows, and AT-SPI on Linux (X11, with assistive technologies
enabled).
Can't hover it? Copy it. Some values aren't in the accessibility tree at all — a
VM guest window is one opaque framebuffer to the host, and so is a canvas, a rendered
image, or a remote-desktop session. Copy the value and press the header 🗐 button:
same ranked readings, from the clipboard. It reads once per press — nothing polls your
pasteboard — and the clipboard's contents are never drawn as the source caption.
timeglyph 1577836800 # ranked, scored readings across every format
timeglyph identify --json 1577836800 # same, machine-readable
timeglyph --as hex 0060947C58B2D501 # raw bytes only: little/big-endian + packed on-disk
timeglyph --as string 20200101000000Z # string forms only: ISO / RFC 2822 / ASN.1
Exit codes are pipeline-safe: 0 clear top reading, 2 ambiguous or a sentinel
(review needed), 1 error. Render in any timezone with --tz (UTC, a fixed
offset, or a DST-correct IANA name); nudge readings toward a source family with
--artifact "".
Decode or encode a known format
timeglyph decode filetime 132223104000000000
timeglyph decode fat 1545691136 # FAT/DOS packed date+time (LOCAL) — one of 45 formats
timeglyph encode unix 2020-01-01T00:00:00Z
timeglyph explain filetime # a spec card: epoch, tick, tz/leap, range, sentinels, citation
timeglyph list # the format registry, with spec citations
Mine artifacts at scale
timeglyph scan < app.log # find & decode every timestamp in a file (or stdin)
timeglyph carve aabbcc… --from 2015 --to 2026 --json # carve timestamps at every byte offset
timeglyph csv events.csv # enrich a CSV with human-readable timestamp columns
Convert in bulk: enrich a whole CSV of timestamps in one pass instead of pasting
them into a converter one at a time. carve sweeps a raw blob (a config, a
record, a hex selection) for timestamps at every offset — window- and
score-thresholded — and exports JSONL, ImHex bookmarks, or Timesketch events.
timeglyph cal # this month, with DST/leap/epoch markers
timeglyph cal 2026-11 --tz America/New_York # DST fold/gap days flagged
timeglyph cal 2026-09-18 # one day in full: week/epoch systems + a moon disc
timeglyph cal 2026 --json # a whole year, faithful per-day records
cal is a calendar built for temporal analysis: per-day UTC offset and DST
fold/gap days, leap-second days and GPS week, ISO week / Julian Day / Unix,
timestamp-format epoch and rollover markers, seven alternative calendars (Chinese
lunisolar with the 干支 four pillars, plus ROC, Japanese, Buddhist, Hebrew, Islamic,
and Persian), and the moon's phase — every value computed and oracle-validated
(date, zdump, USNO, IERS, JPL).
timeglyph mcp # a Model Context Protocol stdio server
mcp exposes identify / decode / explain as MCP tools, so an LLM-driven
DFIR workflow gets a cited, reproducible reading instead of a hallucinated epoch
conversion.
Every reading is scored and checked against an independent oracle — each names
the spec it assumes, and correctness is validated against primary-spec worked examples
and the MIT time_decode tool, with
calendar/astronomy values cross-checked against date, zdump, USNO, IERS, and JPL.
So a reading on your weird timestamp is evidence you can cite, not a guess. See
validation.
45 formats, every reading cited
timeglyph decodes and auto-identifies 45 registered formats plus the
self-describing string forms:
Epoch integers & floats — Unix (s/ms/µs/ns and double), FILETIME (incl.
Active Directory / LDAP), WebKit/Chrome, Cocoa / CFAbsoluteTime (integer, signed
double, iOS-11 ns), Apple HFS+/HFS, .NET ticks, OLE automation, Excel-1904,
PostgreSQL, Mozilla PRTime, SQLite Julian day, DHCPv6, Modified Julian Day
Leap-aware scales (--features leap) — GPS, TAI64, NTP, kept separate from
the POSIX spine
Each reading is scored on window membership, granularity, magnitude, byte-width,
endianness, artifact context, and neighbour monotonicity — so the ranking reflects
the evidence, not format popularity. (Validated against an independent oracle — see
the trust note above and validation.)
Why another converter?
Good ones exist (time_decode,
MIT; DCode, proprietary). timeglyph is a single static Rust binary built on a
rigorous, cited model where a reading is evidence, not a verdict: a
POSIX-correct internal spine (never mislabelled UTC), the leap-second family kept
separate, and ambiguity as first-class, scored output. Calendar and timezone
math is reused (jiff), never reinvented. See
the design decisions.
Point it at the timestamp you're stuck on. → cargo install timeglyph, or
try it in your browser —
no install, nothing leaves the page.
