feat: add Timestamp PDF tool with RFC 3161 support

Add document timestamping to the Secure PDF section using RFC 3161
protocol. Users can select from preset TSA servers (DigiCert, Sectigo,
SSL.com, Entrust, FreeTSA) or enter a custom TSA URL. No personal
certificate is required — only a cryptographic hash is sent to the server.

Key changes:
- Timestamp PDF page with TSA server selector, FAQ and SEO structured data
- timestampPdf() function with CORS proxy URL resolution
- TimestampNode for the workflow engine
- Tool entry in Secure PDF category + homepage i18n
- Built-in CORS proxy middleware for dev/preview
- Translations for all 16 languages

Tested with DigiCert, Sectigo and Entrust TSA servers. Timestamps are
verifiable in Adobe Acrobat (ETSI.RFC3161 SubFilter).

.env.development

@@ -0,0 +1,2 @@
+# Dev-only: route TSA/certificate requests through the built-in Vite CORS proxy
+VITE_CORS_PROXY_URL=/cors-proxy

public/locales/ar/tools.json

@@ -593,6 +593,15 @@
     "pageTitle": "التحقق من توقيع PDF - التحقق من التوقيعات الرقمية | BentoPDF",
     "subtitle": "التحقق من التوقيعات الرقمية في ملفات PDF. تحقق من صلاحية الشهادة، واعرض تفاصيل الموقّع، وتأكد من سلامة المستند. تتم جميع المعالجة في متصفحك."
   },
+  "timestampPdf": {
+    "name": "ختم PDF بالوقت",
+    "pageTitle": "ختم PDF بالوقت مجاناً - ختم RFC 3161 | BentoPDF",
+    "subtitle": "أضف ختماً زمنياً RFC 3161 إلى ملف PDF باستخدام خادم TSA موثوق. يثبت أن مستندك كان موجوداً في وقت محدد. لا يتطلب شهادة.",
+    "tsaSectionTitle": "خادم الختم الزمني (TSA)",
+    "selectTsa": "اختر خادم TSA",
+    "applyTimestamp": "تطبيق الختم الزمني",
+    "successMessage": "تم ختم PDF بالوقت بنجاح! يمكن التحقق من الختم في Adobe Acrobat وقارئات PDF الأخرى."
+  },
   "emailToPdf": {
     "name": "بريد إلكتروني إلى PDF",
     "subtitle": "تحويل ملفات البريد الإلكتروني (EML، MSG) إلى تنسيق PDF. يدعم تصديرات Outlook وتنسيقات البريد القياسية.",

public/locales/be/tools.json

@@ -593,6 +593,15 @@
     "pageTitle": "Праверыць подпіс PDF - Верыфікацыя лічбавых подпісаў | BentoPDF",
     "subtitle": "Праверыць лічбавыя подпісы ў PDF. Праверыць сапраўднасць сертыфіката, паглядзець дэталі падпісанта і пацвердзіць надзейнасць дакумента. Уся апрацоўка адбываецца ў вашым браўзеры."
   },
+  "timestampPdf": {
+    "name": "Пазначыць PDF часам",
+    "pageTitle": "Часовая пазнака PDF бясплатна - RFC 3161 | BentoPDF",
+    "subtitle": "Дадайце часовую пазнаку RFC 3161 да PDF праз давераны сервер TSA. Даказвае, што ваш дакумент існаваў у пэўны момант часу. Сертыфікат не патрабуецца.",
+    "tsaSectionTitle": "Сервер часовых пазнак (TSA)",
+    "selectTsa": "Абраць сервер TSA",
+    "applyTimestamp": "Прымяніць часовую пазнаку",
+    "successMessage": "PDF паспяхова пазначаны часам! Пазнаку можна праверыць у Adobe Acrobat і іншых PDF-праглядчыках."
+  },
   "emailToPdf": {
     "name": "Email у PDF",
     "subtitle": "Канвертаваць файлы email (EML, MSG) у PDF. Падтрымлівае экспарты Outlook і стандартныя email-фарматы.",

public/locales/da/tools.json

@@ -591,7 +591,16 @@
   "validateSignaturePdf": {
     "name": "Validér PDF-signatur",
     "pageTitle": "Validér PDF-signatur - Verificér digitale signaturer | BentoPDF",
-    "subtitle": "Tjek digitale signaturer i dine PDF’er. Verificér certifikater, se underskriverdetaljer og bekræft dokumentintegritet."
+    "subtitle": "Tjek digitale signaturer i dine PDF'er. Verificér certifikater, se underskriverdetaljer og bekræft dokumentintegritet."
+  },
+  "timestampPdf": {
+    "name": "Tidsstempl PDF",
+    "pageTitle": "Tidsstempl PDF gratis online - RFC 3161 dokumenttidsstempel | BentoPDF",
+    "subtitle": "Tilføj et RFC 3161 tidsstempel til din PDF via en betroet TSA-server. Beviser at dit dokument eksisterede på et bestemt tidspunkt. Intet certifikat påkrævet.",
+    "tsaSectionTitle": "Tidsstempelserver (TSA)",
+    "selectTsa": "Vælg en TSA-server",
+    "applyTimestamp": "Anvend tidsstempel",
+    "successMessage": "PDF tidsstemplet med succes! Tidsstemplet kan verificeres i Adobe Acrobat og andre PDF-læsere."
   },
   "emailToPdf": {
     "name": "Email til PDF",

public/locales/de/tools.json

@@ -593,6 +593,15 @@
     "pageTitle": "PDF-Signatur überprüfen - Digitale Signaturen verifizieren | BentoPDF",
     "subtitle": "Überprüfen Sie digitale Signaturen in Ihren PDF-Dateien. Prüfen Sie die Zertifikatsgültigkeit, sehen Sie Unterzeichnerdetails und bestätigen Sie die Dokumentenintegrität. Die gesamte Verarbeitung erfolgt in Ihrem Browser."
   },
+  "timestampPdf": {
+    "name": "PDF mit Zeitstempel versehen",
+    "pageTitle": "PDF-Zeitstempel online kostenlos - RFC 3161 Dokumentenzeitstempel | BentoPDF",
+    "subtitle": "Fügen Sie Ihrem PDF einen RFC 3161-Zeitstempel über einen vertrauenswürdigen Zeitstempelserver (TSA) hinzu. Beweist, dass Ihr Dokument zu einem bestimmten Zeitpunkt existierte. Kein Zertifikat erforderlich.",
+    "tsaSectionTitle": "Zeitstempelserver (TSA)",
+    "selectTsa": "TSA-Server auswählen",
+    "applyTimestamp": "Zeitstempel anwenden",
+    "successMessage": "PDF erfolgreich mit Zeitstempel versehen! Der Zeitstempel kann in Adobe Acrobat und anderen PDF-Readern überprüft werden."
+  },
   "emailToPdf": {
     "name": "E-Mail zu PDF",
     "subtitle": "E-Mail-Dateien (EML, MSG) in PDF-Format konvertieren. Unterstützt Outlook-Exporte und Standard-E-Mail-Formate.",

public/locales/en/tools.json

@@ -593,6 +593,15 @@
     "pageTitle": "Validate PDF Signature - Verify Digital Signatures | BentoPDF",
     "subtitle": "Verify digital signatures in your PDF files. Check certificate validity, view signer details, and confirm document integrity. All processing happens in your browser."
   },
+  "timestampPdf": {
+    "name": "Timestamp PDF",
+    "pageTitle": "Timestamp PDF Online Free - RFC 3161 Document Timestamp | BentoPDF",
+    "subtitle": "Add an RFC 3161 document timestamp to your PDF using a trusted Time Stamp Authority (TSA) server. Proves your document existed at a specific point in time. No certificate required.",
+    "tsaSectionTitle": "Timestamp Server (TSA)",
+    "selectTsa": "Select a TSA server",
+    "applyTimestamp": "Apply Timestamp",
+    "successMessage": "PDF timestamped successfully! The timestamp can be verified in Adobe Acrobat and other PDF readers."
+  },
   "emailToPdf": {
     "name": "Email to PDF",
     "subtitle": "Convert email files (EML, MSG) to PDF format. Supports Outlook exports and standard email formats.",

public/locales/es/tools.json

@@ -593,6 +593,15 @@
     "pageTitle": "Validar Firma PDF - Verificar Firmas Digitales | BentoPDF",
     "subtitle": "Verifica firmas digitales en tus archivos PDF. Comprueba la validez del certificado, ve los detalles del firmante y confirma la integridad del documento."
   },
+  "timestampPdf": {
+    "name": "Sellar PDF con marca de tiempo",
+    "pageTitle": "Marca de tiempo PDF gratis - Sello RFC 3161 | BentoPDF",
+    "subtitle": "Añade una marca de tiempo RFC 3161 a tu PDF mediante un servidor TSA de confianza. Demuestra que tu documento existía en un momento específico. No se requiere certificado.",
+    "tsaSectionTitle": "Servidor de marca de tiempo (TSA)",
+    "selectTsa": "Seleccionar un servidor TSA",
+    "applyTimestamp": "Aplicar marca de tiempo",
+    "successMessage": "¡PDF sellado con marca de tiempo! La marca puede verificarse en Adobe Acrobat y otros lectores PDF."
+  },
   "emailToPdf": {
     "name": "Email a PDF",
     "subtitle": "Convierte archivos de correo (EML, MSG) a formato PDF. Soporta exportaciones de Outlook y formatos de correo estándar.",

public/locales/fr/tools.json

@@ -593,6 +593,15 @@
     "pageTitle": "Valider la signature PDF - Vérifier les signatures numériques | BentoPDF",
     "subtitle": "Vérifier les signatures numériques de vos fichiers PDF. Contrôlez la validité du certificat, consultez les informations du signataire et confirmez l’intégrité du document. Tout le traitement s’effectue dans votre navigateur."
   },
+  "timestampPdf": {
+    "name": "Horodater un PDF",
+    "pageTitle": "Horodatage PDF en ligne gratuit - Horodatage RFC 3161 | BentoPDF",
+    "subtitle": "Ajoutez un horodatage RFC 3161 à votre PDF via un serveur d'horodatage (TSA) de confiance. Prouve que votre document existait à un moment précis. Aucun certificat requis.",
+    "tsaSectionTitle": "Serveur d'horodatage (TSA)",
+    "selectTsa": "Sélectionner un serveur TSA",
+    "applyTimestamp": "Appliquer l'horodatage",
+    "successMessage": "PDF horodaté avec succès ! L'horodatage peut être vérifié dans Adobe Acrobat et d'autres lecteurs PDF."
+  },
   "emailToPdf": {
     "name": "Email vers PDF",
     "subtitle": "Convertir des fichiers email (EML, MSG) au format PDF. Prend en charge les exports Outlook et les formats email standards.",

public/locales/id/tools.json

@@ -593,6 +593,15 @@
     "pageTitle": "Validasi Tanda Tangan PDF - Verifikasi Tanda Tangan Digital | BentoPDF",
     "subtitle": "Verifikasi tanda tangan digital di file PDF Anda. Periksa validitas sertifikat, lihat detail penandatangan, dan konfirmasi integritas dokumen. Semua pemrosesan terjadi di browser Anda."
   },
+  "timestampPdf": {
+    "name": "Stempel Waktu PDF",
+    "pageTitle": "Stempel Waktu PDF Gratis Online - RFC 3161 | BentoPDF",
+    "subtitle": "Tambahkan stempel waktu RFC 3161 ke PDF Anda menggunakan server TSA tepercaya. Membuktikan dokumen Anda ada pada waktu tertentu. Tidak memerlukan sertifikat.",
+    "tsaSectionTitle": "Server Stempel Waktu (TSA)",
+    "selectTsa": "Pilih server TSA",
+    "applyTimestamp": "Terapkan Stempel Waktu",
+    "successMessage": "PDF berhasil diberi stempel waktu! Stempel waktu dapat diverifikasi di Adobe Acrobat dan pembaca PDF lainnya."
+  },
   "emailToPdf": {
     "name": "Email ke PDF",
     "subtitle": "Konversi file email (EML, MSG) ke format PDF. Mendukung ekspor Outlook dan format email standar.",

public/locales/it/tools.json

@@ -593,6 +593,15 @@
     "pageTitle": "Verifica firma PDF - Controlla firme digitali | BentoPDF",
     "subtitle": "Verifica le firme digitali nei tuoi PDF. Controlla la validità del certificato, visualizza i dati del firmatario e conferma l'integrità del documento. Tutto avviene nel tuo browser."
   },
+  "timestampPdf": {
+    "name": "Marca temporale PDF",
+    "pageTitle": "Marca temporale PDF gratuita online - RFC 3161 | BentoPDF",
+    "subtitle": "Aggiungi una marca temporale RFC 3161 al tuo PDF tramite un server TSA affidabile. Dimostra che il tuo documento esisteva in un momento specifico. Nessun certificato richiesto.",
+    "tsaSectionTitle": "Server marca temporale (TSA)",
+    "selectTsa": "Seleziona un server TSA",
+    "applyTimestamp": "Applica marca temporale",
+    "successMessage": "PDF marcato temporalmente con successo! La marca può essere verificata in Adobe Acrobat e altri lettori PDF."
+  },
   "emailToPdf": {
     "name": "Email in PDF",
     "subtitle": "Converti file email (EML, MSG) in formato PDF. Supporta esportazioni Outlook e formati email standard.",

public/locales/nl/tools.json

@@ -593,6 +593,15 @@
     "pageTitle": "PDF-handtekening valideren - Digitale handtekeningen verifiëren | BentoPDF",
     "subtitle": "Digitale handtekeningen in een PDF-bestanden verifiëren. Controleer de geldigheid van het certificaat, bekijk de gegevens van de ondertekenaar en bevestig de integriteit van het document. Alle verwerking gebeurt binnen jouw browser."
   },
+  "timestampPdf": {
+    "name": "PDF tijdstempelen",
+    "pageTitle": "PDF tijdstempel gratis online - RFC 3161 documenttijdstempel | BentoPDF",
+    "subtitle": "Voeg een RFC 3161 tijdstempel toe aan je PDF via een vertrouwde TSA-server. Bewijst dat je document op een specifiek moment bestond. Geen certificaat vereist.",
+    "tsaSectionTitle": "Tijdstempelserver (TSA)",
+    "selectTsa": "Selecteer een TSA-server",
+    "applyTimestamp": "Tijdstempel toepassen",
+    "successMessage": "PDF succesvol voorzien van tijdstempel! Het tijdstempel kan worden geverifieerd in Adobe Acrobat en andere PDF-lezers."
+  },
   "emailToPdf": {
     "name": "E-mail naar PDF",
     "subtitle": "Converteer e-mailbestanden (EML, MSG) naar PDF-formaat. Ondersteunt Outlook-exports en standaard e-mailformaten.",

public/locales/pt/tools.json

@@ -607,6 +607,15 @@
     "pageTitle": "Validar Assinatura PDF - Verificar Assinaturas Digitais | BentoPDF",
     "subtitle": "Verifique assinaturas digitais em seus arquivos PDF. Verifique a validade do certificado e a integridade do documento."
   },
+  "timestampPdf": {
+    "name": "Carimbo de tempo PDF",
+    "pageTitle": "Carimbo de tempo PDF grátis online - RFC 3161 | BentoPDF",
+    "subtitle": "Adicione um carimbo de tempo RFC 3161 ao seu PDF usando um servidor TSA confiável. Prova que o seu documento existia num momento específico. Sem necessidade de certificado.",
+    "tsaSectionTitle": "Servidor de carimbo de tempo (TSA)",
+    "selectTsa": "Selecionar um servidor TSA",
+    "applyTimestamp": "Aplicar carimbo de tempo",
+    "successMessage": "PDF carimbado com sucesso! O carimbo pode ser verificado no Adobe Acrobat e noutros leitores de PDF."
+  },
   "pdfToWord": {
     "name": "PDF para Word",
     "subtitle": "Converter arquivos PDF em documentos Word editáveis."

public/locales/sv/tools.json

@@ -593,6 +593,15 @@
     "pageTitle": "Validera PDF-signatur - Verifiera digitala signaturer | BentoPDF",
     "subtitle": "Verifiera digitala signaturer i dina PDF-filer. Kontrollera certifikatgiltighet, visa signerardetaljer och bekräfta dokumentintegritet. All bearbetning sker i din webbläsare."
   },
+  "timestampPdf": {
+    "name": "Tidsstämpla PDF",
+    "pageTitle": "Tidsstämpla PDF gratis online - RFC 3161 dokumenttidsstämpel | BentoPDF",
+    "subtitle": "Lägg till en RFC 3161 tidsstämpel till din PDF via en betrodd TSA-server. Bevisar att ditt dokument existerade vid en specifik tidpunkt. Inget certifikat krävs.",
+    "tsaSectionTitle": "Tidsstämpelserver (TSA)",
+    "selectTsa": "Välj en TSA-server",
+    "applyTimestamp": "Tillämpa tidsstämpel",
+    "successMessage": "PDF tidsstämplad! Tidsstämpeln kan verifieras i Adobe Acrobat och andra PDF-läsare."
+  },
   "emailToPdf": {
     "name": "E-post till PDF",
     "subtitle": "Konvertera e-postfiler (EML, MSG) till PDF-format. Stöder Outlook-exporter och standard e-postformat.",

public/locales/tr/tools.json

@@ -607,6 +607,15 @@
     "pageTitle": "Validate PDF Signature - Verify Digital Signatures | BentoPDF",
     "subtitle": "Verify digital signatures in your PDF files. Check certificate validity, view signer details, and confirm document integrity. All processing happens in your browser."
   },
+  "timestampPdf": {
+    "name": "PDF Zaman Damgası",
+    "pageTitle": "PDF Zaman Damgası Ücretsiz - RFC 3161 Belge Zaman Damgası | BentoPDF",
+    "subtitle": "Güvenilir bir TSA sunucusu aracılığıyla PDF'nize RFC 3161 zaman damgası ekleyin. Belgenizin belirli bir zamanda var olduğunu kanıtlar. Sertifika gerekmez.",
+    "tsaSectionTitle": "Zaman Damgası Sunucusu (TSA)",
+    "selectTsa": "Bir TSA sunucusu seçin",
+    "applyTimestamp": "Zaman Damgası Uygula",
+    "successMessage": "PDF başarıyla zaman damgalandı! Zaman damgası Adobe Acrobat ve diğer PDF okuyucularda doğrulanabilir."
+  },
   "pdfToWord": {
     "name": "PDF'den Word'e",
     "subtitle": "PDF dosyalarını düzenlenebilir Word belgelerine dönüştürün."

public/locales/vi/tools.json

@@ -593,6 +593,15 @@
     "pageTitle": "Xác minh chữ ký PDF - Xác thực chữ ký số | BentoPDF",
     "subtitle": "Xác minh chữ ký số trong tệp PDF của bạn. Kiểm tra hiệu lực chứng chỉ, xem thông tin người ký và xác nhận tính toàn vẹn tài liệu. Tất cả xử lý diễn ra trong trình duyệt của bạn."
   },
+  "timestampPdf": {
+    "name": "Đóng dấu thời gian PDF",
+    "pageTitle": "Đóng dấu thời gian PDF miễn phí - RFC 3161 | BentoPDF",
+    "subtitle": "Thêm dấu thời gian RFC 3161 vào PDF của bạn thông qua máy chủ TSA đáng tin cậy. Chứng minh tài liệu của bạn tồn tại tại một thời điểm cụ thể. Không cần chứng chỉ.",
+    "tsaSectionTitle": "Máy chủ dấu thời gian (TSA)",
+    "selectTsa": "Chọn máy chủ TSA",
+    "applyTimestamp": "Áp dụng dấu thời gian",
+    "successMessage": "PDF đã được đóng dấu thời gian thành công! Dấu thời gian có thể được xác minh trong Adobe Acrobat và các trình đọc PDF khác."
+  },
   "emailToPdf": {
     "name": "Email sang PDF",
     "subtitle": "Chuyển đổi tệp email (EML, MSG) sang định dạng PDF. Hỗ trợ xuất Outlook và định dạng email tiêu chuẩn.",

public/locales/zh-TW/tools.json

@@ -607,6 +607,15 @@
     "pageTitle": "Validate PDF Signature - Verify Digital Signatures | BentoPDF",
     "subtitle": "Verify digital signatures in your PDF files. Check certificate validity, view signer details, and confirm document integrity. All processing happens in your browser."
   },
+  "timestampPdf": {
+    "name": "PDF 時間戳記",
+    "pageTitle": "免費線上 PDF 時間戳記 - RFC 3161 文件時間戳記 | BentoPDF",
+    "subtitle": "透過可信賴的 TSA 伺服器為您的 PDF 新增 RFC 3161 時間戳記。證明您的文件在特定時間點存在。無需憑證。",
+    "tsaSectionTitle": "時間戳記伺服器 (TSA)",
+    "selectTsa": "選擇 TSA 伺服器",
+    "applyTimestamp": "套用時間戳記",
+    "successMessage": "PDF 時間戳記新增成功！時間戳記可在 Adobe Acrobat 和其他 PDF 閱讀器中驗證。"
+  },
   "pdfToWord": {
     "name": "PDF 轉 Word",
     "subtitle": "將 PDF 檔案轉換為可編輯的 Word 文件。"

public/locales/zh/tools.json

@@ -593,6 +593,15 @@
     "pageTitle": "验证 PDF 签名 - 验证数字签名 | BentoPDF",
     "subtitle": "验证您的 PDF 文件中的数字签名。检查证书有效性、查看签名者详情并确认文档完整性。所有处理都在您的浏览器中进行。"
   },
+  "timestampPdf": {
+    "name": "PDF 时间戳",
+    "pageTitle": "免费在线 PDF 时间戳 - RFC 3161 文档时间戳 | BentoPDF",
+    "subtitle": "通过可信的 TSA 服务器为您的 PDF 添加 RFC 3161 时间戳。证明您的文档在特定时间点存在。无需证书。",
+    "tsaSectionTitle": "时间戳服务器 (TSA)",
+    "selectTsa": "选择 TSA 服务器",
+    "applyTimestamp": "应用时间戳",
+    "successMessage": "PDF 时间戳添加成功！时间戳可在 Adobe Acrobat 和其他 PDF 阅读器中验证。"
+  },
   "emailToPdf": {
     "name": "邮件转 PDF",
     "subtitle": "将电子邮件文件 (EML, MSG) 转换为 PDF 格式。支持 Outlook 导出和标准邮件格式。",

src/js/config/timestamp-tsa.ts

@@ -0,0 +1,14 @@
+export interface TimestampTsaPreset {
+  label: string;
+  url: string;
+}
+
+// Some TSA providers only expose HTTP endpoints. RFC 3161 timestamp tokens are
+// signed at the application layer, so integrity does not depend solely on TLS.
+export const TIMESTAMP_TSA_PRESETS: TimestampTsaPreset[] = [
+  { label: 'DigiCert', url: 'http://timestamp.digicert.com' },
+  { label: 'Sectigo', url: 'http://timestamp.sectigo.com' },
+  { label: 'SSL.com', url: 'http://ts.ssl.com' },
+  { label: 'FreeTSA', url: 'https://freetsa.org/tsr' },
+  { label: 'MeSign', url: 'http://tsa.mesign.com' },
+];

src/js/config/tools.ts

@@ -785,6 +785,13 @@ const baseCategories = [
         icon: 'ph-seal-check',
         subtitle: 'Verify digital signatures and view certificate details.',
       },
+      {
+        href: import.meta.env.BASE_URL + 'timestamp-pdf.html',
+        name: 'Timestamp PDF',
+        icon: 'ph-clock',
+        subtitle:
+          'Add an RFC 3161 document timestamp using a trusted TSA server.',
+      },
     ],
   },
 ];

src/js/logic/digital-sign-pdf.ts

@@ -153,6 +153,20 @@ async function generateProxySignature(
     .join('');
 }
 
+async function buildCorsProxyUrl(url: string): Promise<string> {
+  let proxyUrl = `${CORS_PROXY_URL}?url=${encodeURIComponent(url)}`;
+
+  if (!CORS_PROXY_SECRET) {
+    return proxyUrl;
+  }
+
+  const timestamp = Date.now();
+  const signature = await generateProxySignature(url, timestamp);
+  proxyUrl += `&t=${timestamp}&sig=${signature}`;
+
+  return proxyUrl;
+}
+
 /**
  * Custom fetch wrapper that routes external certificate requests through a CORS proxy.
  * The zgapdfsigner library tries to fetch issuer certificates from URLs embedded in the
@@ -192,20 +206,30 @@ function createCorsAwareFetch(): {
           url.includes('caIssuers')) &&
         !url.startsWith(window.location.origin);
 
-      if (isExternalCertificateUrl && CORS_PROXY_URL) {
+      const isTsaRequest =
-        let proxyUrl = `${CORS_PROXY_URL}?url=${encodeURIComponent(url)}`;
+        (init?.headers &&
+          typeof init.headers === 'object' &&
+          'Content-Type' in init.headers &&
+          (init.headers as Record<string, string>)['Content-Type'] ===
+            'application/timestamp-query') ||
+        url.includes('timestamp') ||
+        url.includes('/tsa') ||
+        url.includes('/tsr') ||
+        url.includes('/ts01') ||
+        url.includes('RFC3161');
 
+      const shouldProxy =
+        (isExternalCertificateUrl || isTsaRequest) &&
+        !url.startsWith(window.location.origin);
+
+      if (shouldProxy && CORS_PROXY_URL) {
+        const proxyUrl = await buildCorsProxyUrl(url);
         if (CORS_PROXY_SECRET) {
-          const timestamp = Date.now();
-          const signature = await generateProxySignature(url, timestamp);
-          proxyUrl += `&t=${timestamp}&sig=${signature}`;
           console.log(
-            `[CORS Proxy] Routing signed certificate request through proxy: ${url}`
+            `[CORS Proxy] Routing signed request through proxy: ${url}`
           );
         } else {
-          console.log(
+          console.log(`[CORS Proxy] Routing request through proxy: ${url}`);
-            `[CORS Proxy] Routing certificate request through proxy: ${url}`
-          );
         }
 
         return originalFetch(proxyUrl, init);
@@ -302,6 +326,34 @@ export async function signPdf(
   }
 }
 
+export async function timestampPdf(
+  pdfBytes: Uint8Array,
+  tsaUrl: string
+): Promise<Uint8Array> {
+  let effectiveUrl = tsaUrl;
+
+  if (CORS_PROXY_URL) {
+    effectiveUrl = await buildCorsProxyUrl(tsaUrl);
+
+    if (CORS_PROXY_SECRET) {
+      console.log(
+        `[Timestamp] Routing signed TSA request through proxy: ${tsaUrl}`
+      );
+    } else {
+      console.log(`[Timestamp] Routing TSA request through proxy: ${tsaUrl}`);
+    }
+  }
+
+  const signOptions: SignOption = {
+    signdate: { url: effectiveUrl },
+  };
+
+  const signer = new PdfSigner(signOptions);
+
+  const timestampedPdfBytes = await signer.sign(pdfBytes);
+  return new Uint8Array(timestampedPdfBytes);
+}
+
 export function getCertificateInfo(certificate: forge.pki.Certificate): {
   subject: string;
   issuer: string;

src/js/logic/timestamp-pdf-page.ts

@@ -0,0 +1,257 @@
+import { createIcons, icons } from 'lucide';
+import { showAlert, showLoader, hideLoader } from '../ui.js';
+import {
+  readFileAsArrayBuffer,
+  formatBytes,
+  downloadFile,
+  getPDFDocument,
+} from '../utils/helpers.js';
+import { TIMESTAMP_TSA_PRESETS } from '../config/timestamp-tsa.js';
+import { timestampPdf } from './digital-sign-pdf.js';
+
+interface TimestampState {
+  pdfFile: File | null;
+  pdfBytes: Uint8Array | null;
+}
+
+const state: TimestampState = {
+  pdfFile: null,
+  pdfBytes: null,
+};
+
+function getElement<T extends HTMLElement>(id: string): T | null {
+  return document.getElementById(id) as T | null;
+}
+
+function resetState(): void {
+  state.pdfFile = null;
+  state.pdfBytes = null;
+
+  const fileDisplayArea = getElement<HTMLDivElement>('file-display-area');
+  if (fileDisplayArea) fileDisplayArea.innerHTML = '';
+
+  const fileInput = getElement<HTMLInputElement>('file-input');
+  if (fileInput) fileInput.value = '';
+
+  const tsaSection = getElement<HTMLDivElement>('tsa-section');
+  if (tsaSection) tsaSection.classList.add('hidden');
+
+  updateProcessButton();
+}
+
+function initializePage(): void {
+  createIcons({ icons });
+
+  const fileInput = getElement<HTMLInputElement>('file-input');
+  const dropZone = getElement<HTMLDivElement>('drop-zone');
+  const processBtn = getElement<HTMLButtonElement>('process-btn');
+  const backBtn = getElement<HTMLButtonElement>('back-to-tools');
+  const tsaPreset = getElement<HTMLSelectElement>('tsa-preset');
+
+  populateTsaPresets(tsaPreset);
+
+  if (fileInput) {
+    fileInput.addEventListener('change', handlePdfUpload);
+    fileInput.addEventListener('click', () => {
+      fileInput.value = '';
+    });
+  }
+
+  if (dropZone) {
+    dropZone.addEventListener('dragover', (e) => {
+      e.preventDefault();
+      dropZone.classList.add('bg-gray-700');
+    });
+
+    dropZone.addEventListener('dragleave', () => {
+      dropZone.classList.remove('bg-gray-700');
+    });
+
+    dropZone.addEventListener('drop', (e) => {
+      e.preventDefault();
+      dropZone.classList.remove('bg-gray-700');
+      const droppedFiles = e.dataTransfer?.files;
+      if (droppedFiles && droppedFiles.length > 0) {
+        handlePdfFile(droppedFiles[0]);
+      }
+    });
+  }
+
+  if (processBtn) {
+    processBtn.addEventListener('click', processTimestamp);
+  }
+
+  if (backBtn) {
+    backBtn.addEventListener('click', () => {
+      window.location.href = import.meta.env.BASE_URL;
+    });
+  }
+}
+
+function populateTsaPresets(tsaPreset: HTMLSelectElement | null): void {
+  if (!tsaPreset) return;
+
+  tsaPreset.replaceChildren();
+
+  for (const preset of TIMESTAMP_TSA_PRESETS) {
+    const option = document.createElement('option');
+    option.value = preset.url;
+    option.textContent = preset.label;
+    tsaPreset.append(option);
+  }
+}
+
+function handlePdfUpload(e: Event): void {
+  const input = e.target as HTMLInputElement;
+  if (input.files && input.files.length > 0) {
+    handlePdfFile(input.files[0]);
+  }
+}
+
+async function handlePdfFile(file: File): Promise<void> {
+  if (
+    file.type !== 'application/pdf' &&
+    !file.name.toLowerCase().endsWith('.pdf')
+  ) {
+    showAlert('Invalid File', 'Please select a PDF file.');
+    return;
+  }
+
+  state.pdfFile = file;
+  state.pdfBytes = new Uint8Array(
+    (await readFileAsArrayBuffer(file)) as ArrayBuffer
+  );
+
+  updatePdfDisplay();
+  showTsaSection();
+  updateProcessButton();
+}
+
+async function updatePdfDisplay(): Promise<void> {
+  const fileDisplayArea = getElement<HTMLDivElement>('file-display-area');
+
+  if (!fileDisplayArea || !state.pdfFile) return;
+
+  fileDisplayArea.innerHTML = '';
+
+  const fileDiv = document.createElement('div');
+  fileDiv.className =
+    'flex items-center justify-between bg-gray-700 p-3 rounded-lg';
+
+  const infoContainer = document.createElement('div');
+  infoContainer.className = 'flex flex-col flex-1 min-w-0';
+
+  const nameSpan = document.createElement('div');
+  nameSpan.className = 'truncate font-medium text-gray-200 text-sm mb-1';
+  nameSpan.textContent = state.pdfFile.name;
+
+  const metaSpan = document.createElement('div');
+  metaSpan.className = 'text-xs text-gray-400';
+  metaSpan.textContent = `${formatBytes(state.pdfFile.size)} • Loading pages...`;
+
+  infoContainer.append(nameSpan, metaSpan);
+
+  const removeBtn = document.createElement('button');
+  removeBtn.className = 'ml-4 text-red-400 hover:text-red-300 flex-shrink-0';
+  removeBtn.innerHTML = '<i data-lucide="trash-2" class="w-4 h-4"></i>';
+  removeBtn.onclick = () => {
+    state.pdfFile = null;
+    state.pdfBytes = null;
+    fileDisplayArea.innerHTML = '';
+    hideTsaSection();
+    updateProcessButton();
+  };
+
+  fileDiv.append(infoContainer, removeBtn);
+  fileDisplayArea.appendChild(fileDiv);
+  createIcons({ icons });
+
+  try {
+    if (state.pdfBytes) {
+      const pdfDoc = await getPDFDocument({
+        data: state.pdfBytes.slice(),
+      }).promise;
+      metaSpan.textContent = `${formatBytes(state.pdfFile.size)} • ${pdfDoc.numPages} pages`;
+    }
+  } catch (error) {
+    console.error('Error loading PDF:', error);
+    metaSpan.textContent = `${formatBytes(state.pdfFile.size)}`;
+  }
+}
+
+function showTsaSection(): void {
+  const tsaSection = getElement<HTMLDivElement>('tsa-section');
+  if (tsaSection) {
+    tsaSection.classList.remove('hidden');
+  }
+}
+
+function hideTsaSection(): void {
+  const tsaSection = getElement<HTMLDivElement>('tsa-section');
+  if (tsaSection) {
+    tsaSection.classList.add('hidden');
+  }
+}
+
+function updateProcessButton(): void {
+  const processBtn = getElement<HTMLButtonElement>('process-btn');
+  if (!processBtn) return;
+
+  if (state.pdfBytes) {
+    processBtn.classList.remove('hidden');
+    processBtn.disabled = false;
+  } else {
+    processBtn.classList.add('hidden');
+    processBtn.disabled = true;
+  }
+}
+
+function getTsaUrl(): string | null {
+  const tsaPreset = getElement<HTMLSelectElement>('tsa-preset');
+  if (!tsaPreset) return null;
+
+  return tsaPreset.value;
+}
+
+async function processTimestamp(): Promise<void> {
+  if (!state.pdfBytes || !state.pdfFile) {
+    showAlert('No File', 'Please upload a PDF file first.');
+    return;
+  }
+
+  const tsaUrl = getTsaUrl();
+  if (!tsaUrl) return;
+
+  showLoader('Applying timestamp...');
+
+  try {
+    const timestampedBytes = await timestampPdf(state.pdfBytes, tsaUrl);
+
+    const outputFilename = state.pdfFile.name.replace(
+      /\.pdf$/i,
+      '_timestamped.pdf'
+    );
+    const blob = new Blob([new Uint8Array(timestampedBytes)], {
+      type: 'application/pdf',
+    });
+    downloadFile(blob, outputFilename);
+
+    showAlert(
+      'Success',
+      'PDF timestamped successfully! The timestamp can be verified in Adobe Acrobat and other PDF readers.'
+    );
+
+    resetState();
+  } catch (error) {
+    console.error('Timestamp error:', error);
+    const message = error instanceof Error ? error.message : 'Unknown error';
+    showAlert(
+      'Timestamp Failed',
+      `Failed to timestamp PDF: ${message}\n\nPlease try a different TSA server or check your internet connection.`
+    );
+  } finally {
+    hideLoader();
+  }
+}
+
+document.addEventListener('DOMContentLoaded', initializePage);

src/js/main.ts

@@ -214,6 +214,7 @@ const init = async () => {
     'Deskew PDF': 'tools:deskewPdf',
     'Digital Signature': 'tools:digitalSignPdf',
     'Validate Signature': 'tools:validateSignaturePdf',
+    'Timestamp PDF': 'tools:timestampPdf',
     'Scanner Effect': 'tools:scannerEffect',
     'Adjust Colors': 'tools:adjustColors',
     'Markdown to PDF': 'tools:markdownToPdf',

src/js/workflow/nodes/registry.ts

@@ -35,6 +35,7 @@ import { SanitizeNode } from './sanitize-node';
 import { EncryptNode } from './encrypt-node';
 import { DecryptNode } from './decrypt-node';
 import { DigitalSignNode } from './digital-sign-node';
+import { TimestampNode } from './timestamp-node';
 import { RedactNode } from './redact-node';
 import { RepairNode } from './repair-node';
 import { PdfToTextNode } from './pdf-to-text-node';
@@ -509,6 +510,13 @@ export const nodeRegistry: Record<string, NodeRegistryEntry> = {
     description: 'Apply a digital signature to PDF',
     factory: () => new DigitalSignNode(),
   },
+  TimestampNode: {
+    label: 'Timestamp',
+    category: 'Secure PDF',
+    icon: 'ph-clock',
+    description: 'Add an RFC 3161 document timestamp',
+    factory: () => new TimestampNode(),
+  },
   RedactNode: {
     label: 'Redact',
     category: 'Secure PDF',

src/js/workflow/nodes/timestamp-node.ts

@@ -0,0 +1,60 @@
+import { ClassicPreset } from 'rete';
+import { BaseWorkflowNode } from './base-node';
+import { pdfSocket } from '../sockets';
+import type { SocketData } from '../types';
+import { requirePdfInput, processBatch } from '../types';
+import { PDFDocument } from 'pdf-lib';
+import { TIMESTAMP_TSA_PRESETS } from '../../config/timestamp-tsa.js';
+import { timestampPdf } from '../../logic/digital-sign-pdf.js';
+
+export class TimestampNode extends BaseWorkflowNode {
+  readonly category = 'Secure PDF' as const;
+  readonly icon = 'ph-clock';
+  readonly description = 'Add an RFC 3161 document timestamp';
+
+  constructor() {
+    super('Timestamp');
+    this.addInput('pdf', new ClassicPreset.Input(pdfSocket, 'PDF'));
+    this.addOutput(
+      'pdf',
+      new ClassicPreset.Output(pdfSocket, 'Timestamped PDF')
+    );
+    this.addControl(
+      'tsaUrl',
+      new ClassicPreset.InputControl('text', {
+        initial: TIMESTAMP_TSA_PRESETS[0].url,
+      })
+    );
+  }
+
+  getTsaPresets(): { label: string; url: string }[] {
+    return TIMESTAMP_TSA_PRESETS;
+  }
+
+  async data(
+    inputs: Record<string, SocketData[]>
+  ): Promise<Record<string, SocketData>> {
+    const pdfInputs = requirePdfInput(inputs, 'Timestamp');
+
+    const tsaUrlCtrl = this.controls['tsaUrl'] as
+      | ClassicPreset.InputControl<'text'>
+      | undefined;
+    const tsaUrl = tsaUrlCtrl?.value || TIMESTAMP_TSA_PRESETS[0].url;
+
+    return {
+      pdf: await processBatch(pdfInputs, async (input) => {
+        const timestampedBytes = await timestampPdf(input.bytes, tsaUrl);
+
+        const bytes = new Uint8Array(timestampedBytes);
+        const document = await PDFDocument.load(bytes);
+
+        return {
+          type: 'pdf',
+          document,
+          bytes,
+          filename: input.filename.replace(/\.pdf$/i, '_timestamped.pdf'),
+        };
+      }),
+    };
+  }
+}

src/pages/timestamp-pdf.html

@@ -0,0 +1,492 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+
+    <title>
+      Timestamp PDF Online Free - RFC 3161 Document Timestamp | BentoPDF
+    </title>
+    <meta
+      name="title"
+      content="Timestamp PDF Online Free - RFC 3161 Document Timestamp | BentoPDF"
+    />
+    <meta
+      name="description"
+      content="★ Add RFC 3161 document timestamp to PDF online free ★ Trusted TSA servers ★ No certificate required ★ Privacy-first ★ Works in browser"
+    />
+    <meta
+      name="keywords"
+      content="timestamp pdf, rfc 3161, tsa server, document timestamp, time stamp authority, pdf timestamp"
+    />
+    <meta name="author" content="BentoPDF" />
+    <meta
+      name="robots"
+      content="index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"
+    />
+
+    <link rel="canonical" href="https://www.bentopdf.com/timestamp-pdf.html" />
+
+    <meta property="og:type" content="website" />
+    <meta property="og:url" content="https://www.bentopdf.com/timestamp-pdf" />
+    <meta
+      property="og:title"
+      content="Timestamp PDF Online Free - RFC 3161 Document Timestamp | BentoPDF"
+    />
+    <meta
+      property="og:description"
+      content="★ Add RFC 3161 document timestamp to PDF online free ★ Trusted TSA servers ★ No certificate required ★ Privacy-first ★ Works in browser"
+    />
+    <meta
+      property="og:image"
+      content="https://www.bentopdf.com/images/og-timestamp-pdf.png"
+    />
+    <meta property="og:image:width" content="1200" />
+    <meta property="og:image:height" content="630" />
+    <meta property="og:site_name" content="BentoPDF" />
+
+    <meta name="twitter:card" content="summary_large_image" />
+    <meta name="twitter:url" content="https://www.bentopdf.com/timestamp-pdf" />
+    <meta name="twitter:title" content="Timestamp PDF Free" />
+    <meta
+      name="twitter:description"
+      content="★ Add RFC 3161 document timestamp to PDF online free ★ Trusted TSA servers ★ Privacy-first"
+    />
+    <meta
+      name="twitter:image"
+      content="https://www.bentopdf.com/images/twitter-timestamp-pdf.png"
+    />
+    <meta name="twitter:site" content="@BentoPDF" />
+
+    <meta name="mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-title" content="Timestamp PDF" />
+
+    <link href="/src/css/styles.css" rel="stylesheet" />
+
+    <link rel="manifest" href="/site.webmanifest" />
+
+    <link rel="icon" type="image/svg+xml" href="/images/favicon.svg" />
+    <link
+      rel="icon"
+      type="image/png"
+      sizes="192x192"
+      href="/images/favicon-192x192.png"
+    />
+    <link
+      rel="icon"
+      type="image/png"
+      sizes="512x512"
+      href="/images/favicon-512x512.png"
+    />
+    <link
+      rel="apple-touch-icon"
+      sizes="180x180"
+      href="/images/apple-touch-icon.png"
+    />
+    <link rel="icon" href="/favicon.ico" sizes="32x32" />
+  </head>
+
+  <body class="antialiased bg-gray-900">
+    {{> navbar }}
+
+    <div
+      id="uploader"
+      class="min-h-screen flex flex-col items-center justify-start py-12 p-4 bg-gray-900"
+    >
+      <div
+        id="tool-uploader"
+        class="bg-gray-800 rounded-xl shadow-xl px-4 py-8 md:p-8 max-w-2xl w-full text-gray-200 border border-gray-700"
+      >
+        <button
+          id="back-to-tools"
+          class="flex items-center gap-2 text-indigo-400 hover:text-indigo-300 mb-6 font-semibold"
+        >
+          <i data-lucide="arrow-left" class="cursor-pointer"></i>
+          <span class="cursor-pointer" data-i18n="tools.backToTools">
+            Back to Tools
+          </span>
+        </button>
+
+        <h1
+          class="text-2xl font-bold text-white mb-2"
+          data-i18n="tools:timestampPdf.name"
+        >
+          Timestamp PDF
+        </h1>
+        <p class="text-gray-400 mb-4" data-i18n="tools:timestampPdf.subtitle">
+          Add an RFC 3161 document timestamp to your PDF using a trusted Time
+          Stamp Authority (TSA) server. Proves your document existed at a
+          specific point in time. No certificate required.
+        </p>
+
+        <div
+          class="bg-blue-900/30 border border-blue-700 rounded-lg p-3 mb-6 flex items-start gap-3"
+        >
+          <i
+            data-lucide="wifi"
+            class="w-5 h-5 text-blue-400 flex-shrink-0 mt-0.5"
+          ></i>
+          <div class="text-sm">
+            <p class="text-blue-300 font-medium">
+              Internet connection required
+            </p>
+            <p class="text-blue-400/80 mt-1">
+              Timestamping requires contacting the selected TSA server to obtain
+              a trusted timestamp token.
+            </p>
+          </div>
+        </div>
+
+        <div
+          id="drop-zone"
+          class="relative flex flex-col items-center justify-center w-full h-48 md:h-64 border-2 border-dashed border-gray-600 rounded-xl cursor-pointer bg-gray-900 hover:bg-gray-700 transition-colors duration-300"
+        >
+          <div class="flex flex-col items-center justify-center pt-5 pb-6">
+            <i
+              data-lucide="upload-cloud"
+              class="w-10 h-10 mb-3 text-gray-400"
+            ></i>
+            <p class="mb-2 text-sm text-gray-400">
+              <span class="font-semibold" data-i18n="upload.clickToSelect"
+                >Click to select a file</span
+              >
+              <span data-i18n="upload.orDragAndDrop">or drag and drop</span>
+            </p>
+            <p
+              class="text-xs text-gray-500"
+              data-i18n="upload.hints.pdfDocuments"
+            >
+              PDF Documents
+            </p>
+            <p class="text-xs text-gray-500" data-i18n="upload.filesNeverLeave">
+              Your files never leave your device.
+            </p>
+          </div>
+          <input
+            id="file-input"
+            type="file"
+            class="absolute top-0 left-0 w-full h-full opacity-0 cursor-pointer"
+            accept="application/pdf"
+          />
+        </div>
+
+        <div id="file-display-area" class="mt-4 space-y-2"></div>
+
+        <div id="tsa-section" class="hidden mt-6 space-y-4">
+          <h3
+            class="text-lg font-semibold text-white"
+            data-i18n="tools:timestampPdf.tsaSectionTitle"
+          >
+            Timestamp Server (TSA)
+          </h3>
+
+          <div>
+            <label
+              for="tsa-preset"
+              class="block text-sm font-medium text-gray-300 mb-1"
+              data-i18n="tools:timestampPdf.selectTsa"
+            >
+              Select a TSA server
+            </label>
+            <select
+              id="tsa-preset"
+              class="w-full bg-gray-700 border border-gray-600 text-gray-200 rounded-lg px-3 py-2 focus:ring-2 focus:ring-indigo-500 focus:border-transparent"
+            ></select>
+          </div>
+        </div>
+
+        <button
+          id="process-btn"
+          class="hidden w-full mt-6 bg-indigo-600 hover:bg-indigo-700 disabled:bg-gray-600 disabled:cursor-not-allowed text-white font-semibold py-3 px-4 rounded-lg transition-colors duration-200 flex items-center justify-center gap-2"
+          disabled
+        >
+          <i data-lucide="clock" class="w-5 h-5"></i>
+          <span data-i18n="tools:timestampPdf.applyTimestamp"
+            >Apply Timestamp</span
+          >
+        </button>
+      </div>
+    </div>
+
+    <div
+      id="loader-overlay"
+      class="hidden fixed inset-0 bg-black/60 z-50 flex items-center justify-center"
+    >
+      <div class="text-center">
+        <div
+          class="inline-block animate-spin rounded-full h-12 w-12 border-4 border-indigo-400 border-t-transparent mb-4"
+        ></div>
+        <p id="loader-text" class="text-white text-lg font-medium">
+          Processing...
+        </p>
+      </div>
+    </div>
+
+    <div
+      id="alert-overlay"
+      class="hidden fixed inset-0 bg-black/60 z-50 flex items-center justify-center"
+    >
+      <div
+        class="bg-gray-800 rounded-xl shadow-xl p-6 max-w-md w-full mx-4 border border-gray-700"
+      >
+        <h3
+          id="alert-title"
+          class="text-xl font-bold text-white mb-2"
+          data-i18n="alert.title"
+        >
+          Alert
+        </h3>
+        <p id="alert-message" class="text-gray-300 mb-6"></p>
+        <button
+          id="alert-ok"
+          class="w-full bg-indigo-600 hover:bg-indigo-700 text-white font-semibold py-2 px-4 rounded-lg transition-colors duration-200"
+        >
+          OK
+        </button>
+      </div>
+    </div>
+
+    <section class="max-w-4xl mx-auto px-4 py-12">
+      <h2
+        class="text-2xl md:text-3xl font-bold text-white mb-8 text-center"
+        data-i18n="howItWorks.title"
+      >
+        How It Works
+      </h2>
+      <div class="space-y-6">
+        <div class="flex items-start gap-4">
+          <div
+            class="flex-shrink-0 w-10 h-10 bg-indigo-600 rounded-full flex items-center justify-center text-white font-bold"
+          >
+            1
+          </div>
+          <div class="flex-1">
+            <h3 class="text-lg font-semibold text-white mb-1">Upload PDF</h3>
+            <p class="text-gray-400">
+              Select the PDF document you want to timestamp
+            </p>
+          </div>
+        </div>
+        <div class="flex items-start gap-4">
+          <div
+            class="flex-shrink-0 w-10 h-10 bg-indigo-600 rounded-full flex items-center justify-center text-white font-bold"
+          >
+            2
+          </div>
+          <div class="flex-1">
+            <h3 class="text-lg font-semibold text-white mb-1">
+              Choose TSA Server
+            </h3>
+            <p class="text-gray-400">Select one of the trusted TSA servers</p>
+          </div>
+        </div>
+        <div class="flex items-start gap-4">
+          <div
+            class="flex-shrink-0 w-10 h-10 bg-indigo-600 rounded-full flex items-center justify-center text-white font-bold"
+          >
+            3
+          </div>
+          <div class="flex-1">
+            <h3 class="text-lg font-semibold text-white mb-1">
+              Timestamp & Download
+            </h3>
+            <p class="text-gray-400">
+              Apply the RFC 3161 timestamp and download your timestamped PDF
+            </p>
+          </div>
+        </div>
+      </div>
+    </section>
+
+    <section class="max-w-6xl mx-auto px-4 py-12">
+      <h2
+        class="text-2xl md:text-3xl font-bold text-white mb-6 text-center"
+        data-i18n="relatedTools.title"
+      >
+        Related PDF Tools
+      </h2>
+      <div class="grid grid-cols-2 md:grid-cols-3 lg:grid-cols-5 gap-4">
+        <a
+          href="digital-sign-pdf.html"
+          class="block bg-gray-800 p-4 rounded-lg hover:bg-gray-700 transition-colors border border-gray-700"
+        >
+          <h3 class="text-white font-semibold mb-1">Digital Signature</h3>
+          <p class="text-gray-400 text-sm">Sign with X.509 certificate</p>
+        </a>
+        <a
+          href="validate-signature-pdf.html"
+          class="block bg-gray-800 p-4 rounded-lg hover:bg-gray-700 transition-colors border border-gray-700"
+        >
+          <h3 class="text-white font-semibold mb-1">Validate Signature</h3>
+          <p class="text-gray-400 text-sm">Verify digital signatures</p>
+        </a>
+        <a
+          href="encrypt-pdf.html"
+          class="block bg-gray-800 p-4 rounded-lg hover:bg-gray-700 transition-colors border border-gray-700"
+        >
+          <h3 class="text-white font-semibold mb-1">Encrypt PDF</h3>
+          <p class="text-gray-400 text-sm">Password protect your PDF</p>
+        </a>
+        <a
+          href="flatten-pdf.html"
+          class="block bg-gray-800 p-4 rounded-lg hover:bg-gray-700 transition-colors border border-gray-700"
+        >
+          <h3 class="text-white font-semibold mb-1">Flatten PDF</h3>
+          <p class="text-gray-400 text-sm">Make annotations permanent</p>
+        </a>
+        <a
+          href="sanitize-pdf.html"
+          class="block bg-gray-800 p-4 rounded-lg hover:bg-gray-700 transition-colors border border-gray-700"
+        >
+          <h3 class="text-white font-semibold mb-1">Sanitize PDF</h3>
+          <p class="text-gray-400 text-sm">Remove hidden data</p>
+        </a>
+      </div>
+    </section>
+
+    <section class="max-w-4xl mx-auto px-4 py-12">
+      <h2
+        class="text-2xl md:text-3xl font-bold text-white mb-6 text-center"
+        data-i18n="faq.sectionTitle"
+      >
+        Frequently Asked Questions
+      </h2>
+      <div class="space-y-4">
+        <details class="bg-gray-800 p-5 rounded-lg border border-gray-700">
+          <summary
+            class="cursor-pointer font-semibold text-white flex items-center justify-between"
+          >
+            What is a document timestamp?
+            <i data-lucide="chevron-down" class="w-5 h-5"></i>
+          </summary>
+          <p class="mt-3 text-gray-400">
+            A document timestamp (RFC 3161) is a cryptographic proof that your
+            PDF existed at a specific point in time. A trusted Time Stamp
+            Authority (TSA) server signs a hash of your document along with the
+            current time, creating a tamper-evident timestamp embedded in the
+            PDF.
+          </p>
+        </details>
+        <details class="bg-gray-800 p-5 rounded-lg border border-gray-700">
+          <summary
+            class="cursor-pointer font-semibold text-white flex items-center justify-between"
+          >
+            Do I need a certificate?
+            <i data-lucide="chevron-down" class="w-5 h-5"></i>
+          </summary>
+          <p class="mt-3 text-gray-400">
+            No. Unlike a digital signature, a document timestamp does not
+            require a personal certificate. The TSA server provides the trusted
+            timestamp using its own certificate.
+          </p>
+        </details>
+        <details class="bg-gray-800 p-5 rounded-lg border border-gray-700">
+          <summary
+            class="cursor-pointer font-semibold text-white flex items-center justify-between"
+          >
+            Is my document sent to the TSA server?
+            <i data-lucide="chevron-down" class="w-5 h-5"></i>
+          </summary>
+          <p class="mt-3 text-gray-400">
+            No. Only a cryptographic hash (SHA-256) of your document is sent to
+            the TSA server. Your actual PDF content never leaves your browser.
+          </p>
+        </details>
+        <details class="bg-gray-800 p-5 rounded-lg border border-gray-700">
+          <summary
+            class="cursor-pointer font-semibold text-white flex items-center justify-between"
+          >
+            Will the timestamp be valid in PDF readers?
+            <i data-lucide="chevron-down" class="w-5 h-5"></i>
+          </summary>
+          <p class="mt-3 text-gray-400">
+            Yes. The tool creates a standard RFC 3161 document timestamp
+            (ETSI.RFC3161 SubFilter) that is recognized by Adobe Acrobat and
+            other major PDF viewers.
+          </p>
+        </details>
+      </div>
+    </section>
+
+    {{> footer }}
+
+    <script type="module" src="/src/js/utils/lucide-init.ts"></script>
+    <script type="module" src="/src/js/utils/full-width.ts"></script>
+    <script type="module" src="/src/js/utils/simple-mode-footer.ts"></script>
+    <script type="module" src="/src/version.ts"></script>
+    <script type="module" src="/src/js/logic/timestamp-pdf-page.ts"></script>
+    <script type="module" src="/src/js/mobileMenu.ts"></script>
+    <script type="module" src="/src/js/main.ts"></script>
+
+    <script type="application/ld+json">
+      {
+        "@context": "https://schema.org",
+        "@type": "SoftwareApplication",
+        "name": "Timestamp PDF - BentoPDF",
+        "applicationCategory": "PDF Tool",
+        "operatingSystem": "Any - Web Browser",
+        "offers": {
+          "@type": "Offer",
+          "price": "0",
+          "priceCurrency": "USD"
+        },
+        "aggregateRating": {
+          "@type": "AggregateRating",
+          "ratingValue": "4.9",
+          "ratingCount": "1850"
+        }
+      }
+    </script>
+
+    <script type="application/ld+json">
+      {
+        "@context": "https://schema.org",
+        "@type": "HowTo",
+        "name": "How to add a timestamp to PDF",
+        "description": "Learn how to add an RFC 3161 document timestamp to PDF using BentoPDF",
+        "step": [
+          {
+            "@type": "HowToStep",
+            "position": 1,
+            "name": "Upload PDF",
+            "text": "Select the PDF document you want to timestamp"
+          },
+          {
+            "@type": "HowToStep",
+            "position": 2,
+            "name": "Choose TSA Server",
+            "text": "Select one of the trusted TSA servers"
+          },
+          {
+            "@type": "HowToStep",
+            "position": 3,
+            "name": "Timestamp & Download",
+            "text": "Apply the RFC 3161 timestamp and download your timestamped PDF"
+          }
+        ]
+      }
+    </script>
+
+    <script type="application/ld+json">
+      {
+        "@context": "https://schema.org",
+        "@type": "BreadcrumbList",
+        "itemListElement": [
+          {
+            "@type": "ListItem",
+            "position": 1,
+            "name": "Home",
+            "item": "https://www.bentopdf.com"
+          },
+          {
+            "@type": "ListItem",
+            "position": 2,
+            "name": "Timestamp PDF",
+            "item": "https://www.bentopdf.com/timestamp-pdf"
+          }
+        ]
+      }
+    </script>
+  </body>
+</html>

vite.config.ts

@@ -1,5 +1,7 @@
 import { defineConfig, Plugin } from 'vitest/config';
 import type { IncomingMessage, ServerResponse } from 'http';
+import http from 'http';
+import https from 'https';
 import type { Connect } from 'vite';
 import basicSsl from '@vitejs/plugin-basic-ssl';
 import tailwindcss from '@tailwindcss/vite';
@@ -197,13 +199,89 @@ function createLanguageMiddleware(isDev: boolean): Connect.NextHandleFunction {
   };
 }
 
+function createCorsProxyMiddleware(): Connect.NextHandleFunction {
+  return (
+    req: IncomingMessage,
+    res: ServerResponse,
+    next: Connect.NextFunction
+  ): void => {
+    if (!req.url?.startsWith('/cors-proxy')) return next();
+
+    if (req.method === 'OPTIONS') {
+      res.setHeader('Access-Control-Allow-Origin', req.headers.origin || '*');
+      res.setHeader('Access-Control-Allow-Methods', 'GET,POST,OPTIONS');
+      res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+      res.statusCode = 204;
+      res.end();
+      return;
+    }
+
+    const parsed = new URL(req.url, 'http://localhost');
+    const targetUrl = parsed.searchParams.get('url');
+    if (!targetUrl) {
+      res.statusCode = 400;
+      res.end('Missing url parameter');
+      return;
+    }
+
+    console.log(`[CORS Proxy] ${req.method} ${targetUrl}`);
+
+    const bodyChunks: Buffer[] = [];
+    req.on('data', (chunk: Buffer) => bodyChunks.push(chunk));
+    req.on('end', () => {
+      const body = Buffer.concat(bodyChunks);
+      const target = new URL(targetUrl);
+      const transport = target.protocol === 'https:' ? https : http;
+
+      const headers: Record<string, string> = {};
+      if (req.headers['content-type']) {
+        headers['Content-Type'] = req.headers['content-type'] as string;
+      }
+      if (body.length > 0) {
+        headers['Content-Length'] = String(body.length);
+      }
+
+      const proxyReq = transport.request(
+        targetUrl,
+        { method: req.method || 'GET', headers },
+        (proxyRes) => {
+          console.log(
+            `[CORS Proxy] Response: ${proxyRes.statusCode} from ${targetUrl}`
+          );
+          res.setHeader(
+            'Access-Control-Allow-Origin',
+            req.headers.origin || '*'
+          );
+          res.setHeader('Access-Control-Allow-Methods', 'GET,POST,OPTIONS');
+          res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+          res.statusCode = proxyRes.statusCode || 200;
+          proxyRes.pipe(res);
+        }
+      );
+
+      proxyReq.on('error', (err) => {
+        console.error('[CORS Proxy] Error:', err.message);
+        res.statusCode = 502;
+        res.end(`Proxy error: ${err.message}`);
+      });
+
+      if (body.length > 0) {
+        proxyReq.write(body);
+      }
+      proxyReq.end();
+    });
+  };
+}
+
 function languageRouterPlugin(): Plugin {
   return {
     name: 'language-router',
     configureServer(server) {
+      server.middlewares.use(createCorsProxyMiddleware());
       server.middlewares.use(createLanguageMiddleware(true));
     },
     configurePreviewServer(server) {
+      server.middlewares.use(createCorsProxyMiddleware());
       server.middlewares.use(createLanguageMiddleware(false));
     },
   };
@@ -309,7 +387,7 @@ export default defineConfig(() => {
         include: ['buffer', 'stream', 'util', 'zlib', 'process'],
         globals: {
           Buffer: true,
-          global: true,
+          global: false,
           process: true,
         },
       }),
@@ -551,6 +629,7 @@ export default defineConfig(() => {
             __dirname,
             'src/pages/digital-sign-pdf.html'
           ),
+          'timestamp-pdf': resolve(__dirname, 'src/pages/timestamp-pdf.html'),
           'validate-signature-pdf': resolve(
             __dirname,
             'src/pages/validate-signature-pdf.html'