How can blockchain timestamping be free?

By batching. Many hashes are combined into a Merkle tree and only the single root hash is written to the chain, so one transaction fee is shared across everyone in that batch. The cost you carry instead is operational: you must keep the inclusion proof, and in some designs return later to complete it.

What happens if I lose my Merkle proof file?

The timestamp is effectively unrecoverable. The blockchain transaction contains the Merkle root, not your hash, so without the sibling path there is no way to link your file to it. This is the most common way people lose timestamps they thought they had.

Is a Merkle proof weaker evidence than a direct transaction?

Not cryptographically — a correctly constructed Merkle proof is exactly as sound. The practical difference is presentation: verifying it means recomputing a hash path, which requires a tool and an explanation, whereas a direct write can be read straight off a public block explorer by anyone.

Merkle Tree Timestamping Explained

If you have wondered how a service can timestamp files on Bitcoin for free when a Bitcoin transaction is not free, the answer is a Merkle tree. It is worth understanding, because the trade-off it makes is the main difference between the timestamping services on the market.

The problem it solves

Writing a hash to a blockchain costs money — a transaction fee, paid in the chain's currency. If every file needs its own transaction, every timestamp has a hard cost floor.

Batching many hashes into one transaction removes the floor. The difficulty is doing that while still allowing anyone to prove that their specific hash was in the batch, without publishing the whole batch.

How a Merkle tree works

Take a set of hashes. Pair them up and hash each pair together. Pair up the results and hash those. Keep going until one hash remains.

h(A)  h(B)   h(C)  h(D)
   \  /         \  /
  h(AB)         h(CD)
      \        /
       h(ABCD)   ← the Merkle root

That final value is the Merkle root, and it commits to every input. Change any one of the original hashes and the root changes completely.

Only the root goes on the chain. One transaction, however many files were in the batch.

Proving your file was included

To show that h(A) is under the root, you do not need the whole tree. You need the siblings along the path from your leaf to the top — here, h(B) and h(CD). Anyone can recompute:

h( h( h(A), h(B) ), h(CD) ) == the root on the chain?

That short list of siblings is the Merkle proof or inclusion proof. For a batch of a million files it is about twenty hashes, because the path length grows with the logarithm of the batch size, not the batch itself.

This is genuinely elegant. It is the mechanism behind OpenTimestamps, and behind most free timestamping.

What you give up

Three things, all operational rather than cryptographic.

You must keep the proof file. The chain contains the root, not your hash. Without the sibling path there is no way to connect your file to the transaction. Lose the proof and the timestamp is gone — the transaction alone will not help you.

There is usually a delay and an extra step. Batches close on a schedule. Until the batch is committed and confirmed, your proof is incomplete, and in some designs you must return later to "upgrade" it. Plenty of people never do, and find out years afterwards.

Verification takes explaining. Recomputing a Merkle path is a straightforward operation for a developer and an unwelcome surprise for anyone else. A record whose verification requires a tutorial is a weaker record in front of a non-technical audience.

The alternative: one transaction each

The other approach is to write each hash into its own transaction. That is what we do: your payload hash goes into the input data of a dedicated Ethereum transaction, where anyone can read it on Etherscan with "View as UTF-8".

	Merkle batching	One transaction each
Cost per timestamp	Near zero	The full transaction fee
What you must keep	A proof file	Nothing — the hash is on-chain
If you lose the artefact	Timestamp unrecoverable	Recoverable from public data
Extra step after submission	Often yes	No
Verification	Recompute a Merkle path	Read the transaction
Explaining it to a lawyer	Requires a tutorial	Open the link

Neither is cryptographically stronger. A Merkle proof is exactly as sound as a direct write. The difference is entirely about what happens later, to a person who is not you, holding an artefact they do not understand.

Which to choose

If you are timestamping at volume, technically comfortable, and reliable about keeping files, batching is excellent and the price is unbeatable.

If you are timestamping a small number of documents that matter, and the eventual audience is a client, an insurer or a court, paying for a direct write buys you a proof with nothing to lose and nothing to explain.

Batching is also the sensible way to offer a free tier, which is worth knowing when comparing prices: a service charging cents per certificate is almost certainly batching, and one charging dollars is probably not.