01
Select bytes only for raw bytes
A whole hexadecimal number and a little-endian byte dump can look similar. Byte order is enabled only for the eight-byte format; the high/low format always takes the high word first, separated by a comma.
Date and time
FILETIME converterRead every tick in its context
Convert Windows timestamps and UTC dates with seven fractional digits. Choose the source format and LDAP attribute before interpreting a value.
FILETIME converter
Input
Your input is processed in this browser and is not sent to a server.
Results
Options
Windows epoch: 1601-01-01 UTC · one tick = 100 ns.
One value per line. High/low: high,low (decimal or 0x words; signed decimal words allowed). Bytes: 16 hex digits or 8 pairs. Dates: YYYY-MM-DDTHH:mm:ss[.1–7 digits]Z or ±HH:mm; +YYYYYY for expanded years.
Byte order applies only to byte input. Select the actual AD field; zero is not universally Never. Decimal -1 is accepted only as a pwdLastSet write control.
UTC dates retain seven fractional digits. Unix quotients are floored; their remainders are in 100 ns ticks.
Up to 1,000 physical lines and 100,000 UTF-16 code units. Blank rows are errors; outer whitespace is trimmed.
Enter input or choose an example to begin.
The FILETIME converter helps you read an Active Directory export or a timestamp extracted from an NTFS record. Keep the original integer when a spreadsheet or a millisecond-only date viewer would hide its last digits.
A 64-bit value carries no attribute name. A zero can describe the Windows epoch, an account without an expiry date, or an unknown login time. The selected context determines which interpretation appears.
Why use this FILETIME converter?
One value, several exact representations
The FILETIME converter reports the whole decimal and hexadecimal value, both DWORDs and both byte orders together. Compare a memory dump with an API result without accidentally reversing the bytes of an already decoded integer.
Zero needs an attribute name
Switching from generic FILETIME to accountExpires changes zero from a date to Never expires. The lastLogon preset instead reports Unknown. A special result deliberately has no fabricated date or Unix timestamp.
Match the representation to its source
02
Declare the field and the offset
Choose an AD attribute only when it matches the source. Reverse conversion requires Z or an explicit offset, even if your own computer uses UTC. Example follows the current representation and opens a replacement preview.
03
Check freshness before reversing
Automatic conversion waits 350 ms after editing. Turn it off to use Convert or Ctrl/Cmd+Enter. Reverse requires every row to contain a date; Apply replaces the input and Undo restores both input and results.
Inspect the entire 64-bit value
Exact subsecond round trips
116444736000000001 becomes 1970-01-01T00:00:00.0000001Z. Decimal strings and integer arithmetic preserve that last tick. Output dates always show seven fractional digits; no millisecond rounding is applied.
Signed COM words are explicit
High/low accepts unsigned DWORDs or signed decimal LONG values in the 32-bit range. Negative words use two’s complement, and the report includes both signed and unsigned forms. This rule does not reinterpret a negative whole FILETIME.
Unix values with their remainders
The LDAP timestamp converter subtracts 116444736000000000 ticks before dividing. Seconds and milliseconds are floored, with a nonnegative tick remainder for each. This preserves instants immediately before 1970 as well as after it.
Batch diagnostics stay attached
Up to 1,000 physical rows retain their original text and line number. A malformed Windows timestamp does not suppress neighboring results. Display starts with 50 rows; Copy and Download include the full JSON report and all diagnostics.
What a timestamp cannot tell you
- Storage range differs from date range
- Unsigned input may reach 18446744073709551615. Values above 9223372036854775807 retain their bit representations but receive an outside-range notice, matching the FileTimeToSystemTime boundary. The generic date maximum uses an extended ISO year.
- Special values are field-specific
- For accountExpires, zero and 9223372036854775807 mean no expiry. For pwdLastSet, zero needs the UF_DONT_EXPIRE_PASSWD flag to interpret the next-login requirement; decimal -1 is a write control, not a recorded instant. lastLogon zero means unknown, not proof of no logins.
- Strict date grammar
- Supply seconds and Z or ±HH:mm, within ±14:00. Years above 9999 use +YYYYYY. Invalid days, leap seconds, 24:00, unknown -00:00 and fractions longer than seven digits are rejected. No named-zone or daylight-saving inference is performed.
- No guessing or repair
- Choose decimal, whole hex, eight bytes or high,low. Scientific notation and thousands separators are rejected. Outer whitespace is trimmed, but blank rows remain errors. A short integer can be a valid FILETIME, so the tool never identifies the format by digit count.
- Values only, no directory or disk access
- No LDAP connection, registry import, MFT parsing, file timestamp editing or account audit is performed. GeneralizedTime, .NET ticks, Excel dates and other epochs belong to their own tools. NTFS file time accuracy still depends on the source that recorded it.
- Bounded input and reversible replacements
- A batch is limited to 100,000 UTF-16 code units and 1,000 physical lines. Exceeding either rejects the batch. Example, Clear and Reverse show the replacement size before Apply; one Undo restores the earlier options and report.
FILETIME converter questions
How do I convert an LDAP timestamp to Unix time?
For a FILETIME-based attribute, subtract 116444736000000000 and divide by 10000000 for seconds. Preserve the remainder if precision matters. The report supplies both components, but first use the matching attribute preset so a control value is not treated as a date.
Which value means an AD account never expires?
accountExpires uses both 0 and 9223372036854775807 for this state. Select that preset to see the interpretation. These meanings do not apply universally to every Windows timestamp or LDAP attribute.
Does LDAP have other timestamp encodings?
Yes. Fields such as whenCreated and whenChanged commonly use GeneralizedTime, for example 20240101000000.0Z. That text is not a decimal count of 100 ns ticks and this page intentionally rejects it.
How do I turn FILETIME into seconds or milliseconds?
Each second contains 10000000 ticks and each millisecond 10000. Converting to Unix units also requires changing the epoch from 1601 to 1970. The report keeps the discarded fraction separately instead of silently reducing precision.
Can I convert Unix milliseconds back to FILETIME?
The exact formula is milliseconds × 10000 + 116444736000000000. This page accepts dates for the reverse direction, so enter the corresponding ISO instant with an offset. A millisecond source cannot recover the additional four fractional digits that were never recorded.
Unexpected result?
Keep the source and the interpretation together
Use the FILETIME converter with the original value and its field name. Save the complete report so the byte order, context and remaining precision travel with the converted date.