winget install --id=SecurityRonin.timeglyph -e timeglyph decodes, encodes, and identifies the many ways systems inscribe time, reporting every plausible interpretation ranked and scored with its assumptions — never a single "detected" answer.
Decode any timestamp. Identify the unknown ones.
Every examination throws raw timestamps at you — a 133801920000000000 buried in
an artifact — that you need in human-readable time. timeglyph reads that value
every way a system might have written it and reports the results ranked, scored,
and cited — honest about the ambiguity instead of guessing one answer. Convert
in bulk from a CSV, or hover the number on screen and read the time live. No more
copying each one into a converter app. One static Rust binary, plus a live overlay
that decodes whatever is under your cursor.
$ timeglyph 1577836800
# readings consistent with 1577836800 (ranked; a raw value is usually underdetermined — not a single verdict):
[1.00] unix 2020-01-01T00:00:00Z (Unix time (seconds))
[0.94] postgres 2000-01-01T00:26:17.8368Z (PostgreSQL timestamp (µs since 2000))
[0.67] cocoa 2051-01-01T00:00:00Z (Cocoa / CFAbsoluteTime (s since 2001))
[0.67] hfsplus 1953-12-31T00:00:00Z (Apple HFS+ (s since 1904))
...
macOS
brew install securityronin/tap/timeglyph
Debian / Ubuntu
curl -1sLf 'https://dl.cloudsmith.io/public/securityronin/timeglyph/setup.deb.sh' | sudo -E bash
sudo apt install timeglyph
Windows
winget install SecurityRonin.timeglyph
Cargo
cargo install timeglyph
On macOS and Windows this also installs the
timeglyph-lens overlay.
timeglyph 1577836800 # ranked, scored readings across every format
timeglyph identify --json 1577836800 # same, machine-readable
timeglyph hex 0060947C58B2D501 # raw bytes: little/big-endian + packed on-disk
timeglyph string 20200101000000Z # ISO / RFC 2822 / ASN.1 string forms
Exit codes are pipeline-safe: 0 clear top reading, 2 ambiguous or a sentinel
(review needed), 1 error. Render in any timezone with --tz (UTC, a fixed
offset, or a DST-correct IANA name); nudge readings toward a source family with
--artifact "".
timeglyph decode filetime 132223104000000000
timeglyph encode unix 2020-01-01T00:00:00Z
timeglyph list # the format registry, with spec citations
timeglyph scan app.log # find & decode every timestamp in text (or stdin)
timeglyph csv events.csv # enrich a CSV with human-readable timestamp columns
Convert in bulk: enrich a whole CSV of timestamps in one pass instead of pasting them into a converter one at a time.
Convert live: hover any number on screen and read its time in real time. An always-on-top overlay follows your cursor and shows timeglyph's ranked readings for the number in the UI element under the pointer, so you never copy a value into a converter. Each row carries its confidence, the weekday, and the public holiday for that date in the chosen zone. Pick any display timezone from the footer.
It installs with the CLI on macOS and Windows and reads the element under the cursor through the platform accessibility layer — the Accessibility API on macOS, UI Automation on Windows. (Linux support is in progress.)
timeglyph decodes and auto-identifies:
Every reading names the spec it assumes and is scored on window membership,
granularity, magnitude, byte-width, endianness, artifact context, and neighbour
monotonicity. Correctness is checked against primary-spec worked examples and the
MIT time_decode oracle — see
validation.
Good ones exist (time_decode,
MIT; DCode, proprietary). timeglyph is a single static Rust binary built on a
rigorous, cited model where a reading is evidence, not a verdict: a
POSIX-correct internal spine (never mislabelled UTC), the leap-second family kept
separate, and ambiguity as first-class, scored output. Calendar and timezone
math is reused (jiff), never reinvented. See
the design decisions.
Privacy Policy · Terms of Service · © 2026 Security Ronin Ltd