Souus Tools
Sponsor

FILETIME & LDAP Timestamp Converter

Free online FILETIME and LDAP/Active Directory timestamp converter. Convert 18-digit Windows FILETIME to human-readable dates and back. Live clock included.

Current FILETIME (updates every 10s)
Unix:
ISO 8601 (UTC)
2025-03-04T08:00:00.000Z
UTC String
Tue, 04 Mar 2025 08:00:00 GMT
Local Time
3/4/2025, 8:00:00 AM
Unix Timestamp (s)
1741075200
Unix Timestamp (ms)
1741075200000
FILETIME (100ns ticks)
133855488000000000

What Is a FILETIME / LDAP Timestamp?

A FILETIME (also known as an LDAP or Active Directory timestamp) is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). It is used extensively in Microsoft Windows APIs, NTFS file system metadata, Active Directory, and LDAP directory attributes such as 'whenCreated', 'pwdLastSet', 'accountExpires', and 'lastLogonTimestamp'. The timestamp is stored as an 18-digit decimal number — for example, 133855488000000000 represents January 1, 2025 00:00:00 UTC. Unlike Unix timestamps (which count seconds since 1970), FILETIME uses a much earlier epoch and a much finer resolution (100-nanosecond ticks).

How to Use the FILETIME Converter

  1. To convert FILETIME to a date: enter the 18-digit value in the input field. The tool instantly displays the corresponding date in ISO 8601, UTC, local time, and Unix timestamp formats.
  2. To convert a date to FILETIME: switch to the 'Date to FILETIME' tab, select year, month, day, hour, minute, second, and timezone using the dropdown selectors, then read the generated FILETIME value.
  3. The live clock at the top shows the current FILETIME and Unix timestamp, updating every 10 seconds.
  4. Click the copy button next to any value to copy it to your clipboard.

Common Use Cases

  • Active Directory Troubleshooting — Decode AD attributes like 'pwdLastSet', 'accountExpires', 'lastLogonTimestamp', and 'lockoutTime' to understand when events occurred.
  • NTFS File System Analysis — Convert NTFS file timestamps ($MFT records, $STANDARD_INFORMATION, $FILE_NAME) during forensic analysis or file recovery.
  • Windows API Development — Debug FILETIME values returned by Windows APIs like GetFileTime(), GetSystemTimeAsFileTime(), and FindFirstFile().
  • LDAP Query Interpretation — Translate 18-digit timestamps from LDAP search results into human-readable dates for reporting and auditing.

FAQ

What is the difference between FILETIME and Unix timestamp?
Unix timestamps count seconds since January 1, 1970 (UTC). FILETIME counts 100-nanosecond intervals since January 1, 1601 (UTC). To convert: Unix_seconds = (FILETIME - 116444736000000000) / 10000000.
How can I get the current FILETIME on Windows?
In PowerShell: [DateTime]::UtcNow.ToFileTimeUtc() returns the current FILETIME. In a batch file, you can use PowerShell inline: powershell -c "[DateTime]::UtcNow.ToFileTimeUtc()". In C/C++, use GetSystemTimeAsFileTime(). In C#, use DateTime.UtcNow.ToFileTimeUtc().
What is the maximum date a FILETIME can represent?
The maximum FILETIME (2^63 - 1 = 9223372036854775807) corresponds to approximately the year 30828. However, most practical uses stay well within the current century.
What is the 'Never Expires' value in Active Directory?
The value 0 and 9223372036854775807 (0x7FFFFFFFFFFFFFFF) both mean 'never' or 'not set' for the accountExpires attribute in Active Directory. The value 0 typically means the attribute has not been set.
Are there other LDAP timestamp formats?
Yes. Active Directory also uses 'Generalized Time' format (e.g., 20250101000000.0Z) for attributes like 'whenCreated' and 'whenChanged'. This is an 18-character string in YYYYMMDDHHmmss.fZ format, not to be confused with the 18-digit integer FILETIME.

Related Tools

Unix Timestamp ConverterDate-Time Converter with Timezone Support