What is a Windows FILETIME timestamp?

A Windows FILETIME timestamp is a 64-bit value representing the number of 100-nanosecond intervals that have elapsed since January 1, 1601 at 00:00:00 UTC. This epoch predates the more commonly known Unix epoch (January 1, 1970) by exactly 369 years. Microsoft chose this starting point because it marks the beginning of a 400-year cycle in the Gregorian calendar, which simplifies leap year calculations.

FILETIME values appear throughout Windows systems, including NTFS file metadata, Active Directory attributes (such as accountExpires, lastLogonTimestamp, and pwdLastSet), Windows Registry entries, and LDAP directory queries. Because these timestamps are stored as large integers rather than human-readable dates, converting them manually requires knowing both the epoch offset and the tick interval.

Tool description

This tool converts Windows FILETIME timestamps to readable date and time formats and back. Paste a FILETIME value to instantly see the corresponding date in multiple formats, or pick a date and time to generate the matching FILETIME value. All conversions are timezone-aware with a searchable timezone selector.

Examples

Windows FILETIME Date (UTC)
132812448000000000 2021-12-01 00:00:00
116444736000000000 1970-01-01 00:00:00 (Unix epoch)
130000000000000000 2012-02-17 05:46:40
133600000000000000 2024-05-17 04:26:40

Features

  • Bidirectional conversion between Windows FILETIME ticks and human-readable dates
  • Multiple output formats: FILETIME ticks, Unix timestamp (seconds), ISO 8601, UTC, local time, and relative time
  • Searchable timezone selector with UTC offset display for accurate local time conversion
  • One-click button to insert the current time as a Windows timestamp
  • Date and time picker for reverse conversion from a chosen date back to FILETIME

How it works

The converter applies a fixed offset to translate between the Windows and Unix epochs. The Windows epoch starts on January 1, 1601, while the Unix epoch starts on January 1, 1970. The difference between these two dates is exactly 11,644,473,600 seconds, or 116,444,736,000,000,000 in 100-nanosecond ticks.

To convert a FILETIME value to a date, the tool subtracts the epoch offset and divides by 10,000 to get milliseconds since the Unix epoch. For the reverse direction, it multiplies the Unix milliseconds by 10,000 and adds the offset back. All arithmetic uses BigInt to preserve the full 64-bit precision of FILETIME values.

Use cases

  • System administration: Decode Active Directory attributes like lastLogonTimestamp or pwdLastSet when troubleshooting account issues or auditing user activity
  • Digital forensics: Convert NTFS file timestamps during incident response to establish timelines from Windows disk images or event logs
  • Software development: Debug or verify FILETIME values encountered in Windows APIs, registry entries, or file metadata during application development