// ADMIN TOOLS

Timestamp Converter

Convert between Unix timestamps, Windows FILETIME, and human-readable dates. Instant, client-side, no sign-up required.

// ENTER TIMESTAMP

examples:

Enter a timestamp above to see conversions

// ACTIVE DIRECTORY REFERENCE

AD Attributes (Windows FILETIME)

Active Directory stores many timestamps as Windows FILETIME — the number of 100-nanosecond intervals since 1601-01-01 UTC. Key attributes:

lastLogon — Last interactive logon (not replicated between DCs)
lastLogonTimestamp — Last logon (replicated, updated ~14 days behind)
pwdLastSet — When the password was last changed
accountExpires — Account expiration (0 = never expires by default; INT64_MAX = never expires explicitly)
badPasswordTime — Last failed password attempt

Windows Event Logs

Windows Event Logs store timestamps as FILETIME. When analysing exported .evtx files or parsing events via PowerShell or WEF, you will encounter these 18-digit numbers.

NTFS Timestamps

NTFS stores file times (Created, Modified, Accessed, MFT Modified) as FILETIME values. Tools like fsutil and forensic suites expose these directly.

Registry Timestamps

Windows Registry keys use FILETIME for their LastWrite time. Exporting hive data or using reg query with /s will show these timestamps, which can be converted with this tool.

Intune / Microsoft Entra ID

Microsoft Intune and Entra ID (Azure AD) API responses typically return ISO 8601 date strings (e.g. 2024-04-25T12:00:00Z). Paste any ISO date string into this tool to convert it to other formats. Some on-prem sync scenarios still surface FILETIME values in diagnostic logs.

Timestamp Format Comparison

Different systems use different timestamp formats. The table below compares the three formats this tool converts between, including their epoch, precision, and common use cases.

Comparison of Unix, Windows FILETIME, and ISO 8601 timestamp formats
Format	Epoch	Precision	Range	Common Uses
Unix Timestamp	1 Jan 1970	1 second (or 1 ms)	±292 billion years	Linux, macOS, web APIs, databases, logging
Windows FILETIME	1 Jan 1601	100 nanoseconds	1601 – 30828	Active Directory, Event Logs, NTFS, Registry, Intune
ISO 8601	N/A (calendar)	Variable	N/A	APIs, logging, config files, human readability

Frequently Asked Questions

What is a Windows FILETIME value?: Windows FILETIME is a 64-bit integer representing the number of 100-nanosecond intervals since 1 January 1601 UTC. Active Directory uses FILETIME for timestamp attributes like lastLogon, pwdLastSet, and accountExpires. The 1601 epoch predates Unix by 369 years, so FILETIME values are typically much larger numbers than Unix timestamps.
How do I convert an Active Directory lastLogon timestamp?: Active Directory stores lastLogon as a FILETIME integer. Copy the 18-digit number (e.g. 133428288000000000) and paste it into this tool — it will auto-detect the format and show the corresponding date in UTC and local time. Note that lastLogon is not replicated between domain controllers; for a replicated approximation, use lastLogonTimestamp instead.
What does FILETIME 0 mean in Active Directory?: A FILETIME value of 0 (1 Jan 1601) means "never" in Active Directory. It appears in lastLogon when a user has never logged in, and in pwdLastSet when a password has never been set. This tool flags the value with an explanation when it detects a FILETIME of 0.
What does FILETIME 9223372036854775807 mean?: The value 9223372036854775807 is INT64_MAX and means "never expires" in Active Directory. It is commonly used for accountExpires when an account has no expiration date. This tool detects it and shows an explanatory note alongside the conversion.
How accurate is Unix timestamp vs FILETIME?: A standard Unix timestamp has 1-second resolution. Unix timestamps in milliseconds (used by JavaScript Date.now()) have 1-ms resolution. Windows FILETIME has 100-nanosecond resolution — 10,000 times finer than millisecond precision. For most IT operations, second-level accuracy is sufficient; FILETIME’s extra precision matters in forensic timeline analysis and high-frequency event correlation.

// ACTIVE DIRECTORY MANAGEMENT

Managing Active Directory at scale?

DMC IT Services manages Active Directory environments for SMBs across London, Cambridge, Hertfordshire, and Bedfordshire — from user lifecycle and Group Policy through to Azure AD hybrid sync and Intune MDM enrolment.

Talk to an Engineer

← Back to all free tools

Timestamp Format Comparison

Different systems use different timestamp formats. The table below compares the three formats this tool converts between, including their epoch, precision, and common use cases.

Comparison of Unix, Windows FILETIME, and ISO 8601 timestamp formats
Format	Epoch	Precision	Range	Common Uses
Unix Timestamp	1 Jan 1970	1 second (or 1 ms)	±292 billion years	Linux, macOS, web APIs, databases, logging
Windows FILETIME	1 Jan 1601	100 nanoseconds	1601 – 30828	Active Directory, Event Logs, NTFS, Registry, Intune
ISO 8601	N/A (calendar)	Variable	N/A	APIs, logging, config files, human readability

Frequently Asked Questions

What is a Windows FILETIME value?

Windows FILETIME is a 64-bit integer representing the number of 100-nanosecond intervals since 1 January 1601 UTC. Active Directory uses FILETIME for timestamp attributes like lastLogon, pwdLastSet, and accountExpires. The 1601 epoch predates Unix by 369 years, so FILETIME values are typically much larger numbers than Unix timestamps.

How do I convert an Active Directory lastLogon timestamp?

Active Directory stores lastLogon as a FILETIME integer. Copy the 18-digit number (e.g. 133428288000000000) and paste it into this tool — it will auto-detect the format and show the corresponding date in UTC and local time. Note that lastLogon is not replicated between domain controllers; for a replicated approximation, use lastLogonTimestamp instead.

What does FILETIME 0 mean in Active Directory?

A FILETIME value of 0 (1 Jan 1601) means "never" in Active Directory. It appears in lastLogon when a user has never logged in, and in pwdLastSet when a password has never been set. This tool flags the value with an explanation when it detects a FILETIME of 0.

What does FILETIME 9223372036854775807 mean?

The value 9223372036854775807 is INT64_MAX and means "never expires" in Active Directory. It is commonly used for accountExpires when an account has no expiration date. This tool detects it and shows an explanatory note alongside the conversion.

How accurate is Unix timestamp vs FILETIME?

A standard Unix timestamp has 1-second resolution. Unix timestamps in milliseconds (used by JavaScript Date.now()) have 1-ms resolution. Windows FILETIME has 100-nanosecond resolution — 10,000 times finer than millisecond precision. For most IT operations, second-level accuracy is sufficient; FILETIME’s extra precision matters in forensic timeline analysis and high-frequency event correlation.