Windows FILETIME Converter

Convert Windows FILETIME and Active Directory Timestamps

Windows and Active Directory store many timestamps in a format humans cannot read at a glance: a 64-bit FILETIME value counting 100-nanosecond intervals since January 1, 1601 (UTC). This converter turns those values, along with related LDAP and AD timestamp formats, into ordinary dates and times.

It also handles batch conversion, so you can paste a column of values pulled from lastLogon, pwdLastSet, accountExpires, and similar attributes and translate them all at once.

Where These Values Come From

If you query Active Directory with PowerShell, dsquery, LDAP browsers, or CSV exports, you will run into raw integer timestamps on attributes such as:

• lastLogon and lastLogonTimestamp — when an account last authenticated.
• pwdLastSet — when the password was last changed.
• accountExpires — when the account is set to expire.
• badPasswordTime and lockoutTime — security and lockout auditing.

Format Nuances Worth Knowing

• FILETIME epoch is 1601, not the Unix epoch of 1970, so the raw numbers are very large.
• A pwdLastSet of 0 means "must change password at next logon," and -1 (or 0x7FFFFFFFFFFFFFFF) on accountExpires means "never expires."
• lastLogon is not replicated between domain controllers; lastLogonTimestamp is the replicated, slightly stale one.
• Values are stored in UTC, so convert to your local zone deliberately when comparing against user reports.

Why Use This Tool

Manually decoding FILETIME math is error-prone. Batch conversion is faster than scripting a one-off and helps when auditing stale accounts, investigating a security incident, or cleaning up an identity export. Because the conversion is arithmetic on values you paste in, the work happens in your browser rather than on a remote server.