With your constraints, it is trivial to detect millisecond timestamps. Even timestamps a year into the past are still magnitudes larger than the current timestamp.
Simply test if the number is greater than the current timestamp; if so, you have a timestamp in milliseconds:
now = time.mktime(time.gmtime())
if t > now:
# milliseconds, convert to seconds
t /= 1000.0
By dividing by 1000, you convert the timestamp back to one expressed in seconds and the default time
module functions can be applied.
That's because even a timestamp in milliseconds representing one year in the past, accidentally interpreted as a timestamp in seconds, would lie far into the future:
>>> import time
>>> ts = time.mktime(time.gmtime())
>>> year_ago = ts - (86400 * 365)
>>> time.gmtime(year_ago * 1000) # misinterpret milliseconds as seconds
time.struct_time(tm_year=45395, tm_mon=7, tm_mday=9, tm_hour=14, tm_min=0, tm_sec=0, tm_wday=3, tm_yday=190, tm_isdst=0)
You'd have to have a timestamp early in 1970 before you could confuse the two ranges:
>>> now = time.mktime(time.gmtime())
>>> time.gmtime(ts / 1000) # misinterpret seconds as milliseconds
time.struct_time(tm_year=1970, tm_mon=1, tm_mday=17, tm_hour=5, tm_min=25, tm_sec=13, tm_wday=5, tm_yday=17, tm_isdst=0)
E.g. timestamps in the first 17 days after the UNIX epoch could be confused for timestamps in milliseconds. Everything after that date is going to be larger than a 'current time' timestamp.
With your specific constraints, you are lucky that we can keep the two units separate so easily. The better option is to not get into this situation in the first place. This data was sourced from somewhere; determine as early as possible what data type you have instead of having to guess later. No system will randomly give you timestamps in seconds some of the time, timestamps in milliseconds the rest of the time. Surely you can know based on other information what type of data you are sourcing and either convert at that time or annotate your data to include the type?