time.txryan.com

Public NTP,
open to all.

Use time.txryan.com as a public stratum 2 NTP server over IPv4 or IPv6.

Hostname

time.txryan.com

Addresses

144.217.160.110 / 2607:5300:205:200::a17c

NTP Port

123 / udp

Roughtime,
secure time.

Every response is cryptographically signed. If a server ever lies about the time, you can prove it — without trusting any single source. Powered by roughtime ↗.

Address

time.txryan.com:2002

Ed25519 public key

iBVjxg/1j7y1+kQUTBYdTabxCppesU/07D4PMDJk2WA=

ecosystem.json

Example config pairing this server with Cloudflare:

{
  "servers": [
    {
      "name": "time.txryan.com",
      "version": "IETF-Roughtime",
      "publicKeyType": "ed25519",
      "publicKey": "iBVjxg/1j7y1+kQUTBYdTabxCppesU/07D4PMDJk2WA=",
      "addresses": [{ "protocol": "udp", "address": "time.txryan.com:2002" }]
    },
    {
      "name": "Cloudflare-Roughtime-2",
      "version": "IETF-Roughtime",
      "publicKeyType": "ed25519",
      "publicKey": "0GD7c3yP8xEc4Zl2zeuN2SlLvDVVocjsPSL8/Rl/7zg=",
      "addresses": [
        { "protocol": "udp", "address": "roughtime.cloudflare.com:2003" }
      ]
    }
  ]
}

Multiple servers recommended. Full list of active Roughtime servers ↗

One line,
you're synced.

Drop one of these into your system's time daemon and you're done.

server time.txryan.com iburst

server time.txryan.com iburst

sntp -d time.txryan.com

The why
and how.

Keeping clocks honest is harder than it sounds.

Can I use this server?

Yes. This is a public time server. If you're an individual user, just point your client at time.txryan.com. No need to ask. If you're planning to deploy it across infrastructure that will generate a high volume of requests, reach out to Tanner ↗ first. There are no formal uptime or accuracy guarantees, but the server is actively monitored and maintained.

What does stratum 2 mean?

Time servers are organized in layers called strata. Stratum 0 is the reference clock itself, usually an atomic clock or GPS receiver. Stratum 1 servers are directly connected to a stratum 0 source. Stratum 2 servers, like this one, synchronize with stratum 1 servers. Each layer adds a small amount of distance from the reference, but stratum 2 is more than accurate enough for nearly all applications on the Internet.

Why does accurate time matter?

Computers can't agree on much, but they need to agree on the time. Encrypted connections depend on certificates that expire. If a machine's clock is wrong, it might accept a certificate that expired last week or reject one that's perfectly valid. Logs stop making sense. Databases that span multiple servers start contradicting themselves. Authentication tokens look expired when they aren't, or valid when they shouldn't be. Accurate time isn't a nice-to-have. It's load-bearing infrastructure.

How does NTP work?

NTP has been around since the 1980s. The idea is simple: your machine sends a request to a time server and notes when it sent it. The server records when the request arrived and when it sends its response. Your machine records when the response gets back. That gives you four timestamps, two from your clock and two from the server. From those, you can calculate the network delay and figure out how far off your clock is. Do it repeatedly and your clock gradually locks on.

What's wrong with plain NTP?

NTP was built for accuracy, not trust. Most of the time, responses aren't authenticated at all. Your machine has no way to know the answer actually came from the server it asked. Anyone sitting between you and the server can quietly rewrite the timestamps. Shift a clock backward and the machine starts accepting expired certificates. Shift it forward and it trusts certificates that aren't valid yet. Either way, you're exposed.

How does Roughtime work?

Roughtime doesn't use TLS at all. The server has a long-term root key that signs a short-lived delegated key, and that delegated key signs responses. Your device sends a random value (a nonce) to the server. The server incorporates that nonce into its signed response, which includes a timestamp and a radius representing the server's confidence in its accuracy. You verify the delegation against the server's long-term public key, which you already have, and then verify the response against the delegated key. No certificates, no handshake, no need to know the time before you start.

The real trick is accountability. A client can chain requests across multiple servers by mixing the previous server's signed response into each new nonce. That creates a sequence where every timestamp is cryptographically bound to the one before it. If one server in the chain lied, the timestamps won't line up, and the client has signed proof of it. You don't need to trust any single server. You just need most of them to be honest.

Why run both?

They cover different problems. NTP gives precise ongoing synchronization for running machines. Roughtime provides cryptographically signed time without depending on certificates or an already-correct clock.

How does the clock on this page work?

Your browser opens a WebSocket connection to this server and runs a series of timing exchanges, similar to how NTP works. Each exchange produces four timestamps that let the client calculate the offset between your clock and the server's. Samples are collected in batches, filtered to keep only the ones with the shortest round trips, and smoothed over time to avoid sudden jumps. The clock you see is your local system time plus that correction.