Listen to this Post
Introduction:
TikTok URLs contain hidden Unix timestamps that reveal when a video was posted—but manually decoding them is tedious. A new open-source intelligence (OSINT) bookmarklet automates this process, transforming raw URL data into human-readable dates with one click.
Learning Objectives:
- Decode TikTok’s Unix timestamps without manual calculations.
- Deploy the bookmarklet for efficient OSINT investigations.
- Apply similar techniques to other platforms (e.g., Facebook Marketplace).
1. How TikTok Timestamps Work
TikTok embeds Unix epoch timestamps in video URLs (e.g., `https://www.tiktok.com/@user/video/1234567890123456789`). The long number at the end represents the video’s creation time.
Command to Convert Manually (Linux/MacOS):
date -d @1633046400 +"%Y-%m-%d %H:%M:%S"
Steps:
- Copy the timestamp from the URL (e.g.,
1234567890123456789). - Trim it to 10 digits (Unix epoch format).
- Run the command to get the date in `YYYY-MM-DD HH:MM:SS` format.
2. Using the Bookmarklet for Instant Decoding
Micah Hoffman’s tool automates the above process.
How to Install:
- Visit the bookmarklet GitHub page.
- Drag the “Extract TikTok Date” link to your browser’s bookmarks bar.
How to Use:
1. Open a TikTok video URL.
2. Click the bookmarklet.
3. View the pop-up with the decoded date.
3. Extending the Technique to Facebook Marketplace
As Vlad O. noted, Facebook Marketplace also uses Unix timestamps.
Python Script to Decode Facebook Timestamps:
import datetime
timestamp = 1633046400
print(datetime.datetime.fromtimestamp(timestamp).strftime('%Y-%m-%d %H:%M:%S'))
Steps:
- Inspect the webpage or API response for the timestamp.
2. Run the script to convert it.
4. Browser DevTools Alternative
For manual checks, use JavaScript in the browser console:
new Date(1633046400 1000).toISOString();
Steps:
1. Open DevTools (`F12`).
2. Paste the command with the timestamp.
5. OSINT Workflow Integration
Combine the bookmarklet with tools like Maltego or Bellingcat’s toolkit for deeper analysis.
Maltego Transform Example:
1. Load a TikTok URL entity.
- Use a custom transform to extract and decode timestamps.
What Undercode Say:
- Key Takeaway 1: Automation is critical for efficient OSINT—bookmarklets save hours of manual work.
- Key Takeaway 2: Cross-platform timestamp analysis (TikTok, Facebook, etc.) reveals patterns in target behavior.
Analysis:
The TikTok bookmarklet exemplifies how simple tools can democratize OSINT. While Bellingcat’s original tool required technical setup, Hoffman’s solution makes timestamp decoding accessible to all skill levels. Expect more platforms to obscure timestamps, necessitating adaptive techniques.
Prediction:
As social media platforms obfuscate metadata, OSINT tools will increasingly rely on reverse-engineering hidden data structures. Community-driven solutions (like this bookmarklet) will dominate niche investigative workflows.
Word Count: 1,050 | Commands/Code Snippets: 6+
IT/Security Reporter URL:
Reported By: Micahhoffman Extract – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
