FILETIME Converter

Windows FILETIME values count 100-nanosecond intervals since January 1, 1601 UTC. They appear in Windows APIs, NTFS metadata, Active Directory attributes, and forensic exports. This FILETIME converter turns those large integers into readable UTC datetimes and encodes calendar dates back into FILETIME form for tests, incident response, and migrations.

When to use FILETIME conversion

Security analysts decode last-logon and password-set attributes. Developers debug Windows services that log FILETIME ticks. Forensic notes often paste 18-digit integers that mean nothing until converted. If your value is Unix epoch seconds, use Unix timestamp instead. Excel day serials belong on the Excel date converter.

Directory-focused context also appears on the LDAP timestamp page — often the same underlying tick format with attribute semantics spelled out. Treat FILETIME as an absolute UTC instant; displaying it in a local zone is a separate formatting step after you decode the ticks.

How FILETIME works

One tick is 100 nanoseconds. There are 10,000,000 ticks per second. The epoch is January 1, 1601 at midnight UTC, chosen for Windows historical reasons. Values are usually 64-bit integers. Some APIs expose FILETIME as two 32-bit halves (dwLowDateTime and dwHighDateTime); combine them into one integer before converting.

Sentinel values matter. A zero FILETIME often means never or not set in directory attributes. Extremely large or negative-looking values when misread as signed integers usually indicate a parsing error. Confirm endianness and string trimming when values arrive from hex dumps or log fragments.

How to use this page

Paste a FILETIME integer into the value field to decode UTC, or pick a calendar date to encode ticks for midnight UTC on that day as implemented by the tool. Read the ISO and UTC string outputs. Keep the tab open for repeated conversions during an investigation. Ordinary use stays in the browser without uploading attribute values.

When documenting findings, store both the raw ticks and the decoded UTC time. Raw ticks remain the source of truth if someone else displays the same instant in a different zone or format.

LDAP and Active Directory notes

Attributes such as lastLogonTimestamp and pwdLastSet commonly use FILETIME. Replication delay can make lastLogonTimestamp coarser than lastLogon on a specific domain controller. Do not treat a single attribute as a perfect audit trail without understanding AD semantics. This page converts ticks; it does not interpret directory policy or legal retention rules.

If you also need Unix times for Linux logs in the same incident, convert both to UTC and compare on a shared timeline. Mixing local-time strings without zones creates false gaps that waste investigation hours.

Edge cases and format confusion

FILETIME is UTC; Excel serials are civil day numbers without a zone. Do not add or subtract them interchangeably. Hex dumps of FILETIME need conversion to decimal integers first. When the payload is Unix epoch in hexadecimal, use the Unix hex timestamp tool instead.

The 32-bit Unix epoch limit applies to Unix seconds, not to 64-bit FILETIME. Clock skew between systems can make a future FILETIME appear in logs — validate against multiple hosts before assuming tampering. Round-trip a known timestamp before trusting a batch of forensic artifacts.

Worked example

An alert includes pwdLastSet with a long integer. Paste the value, read the UTC timestamp, and compare it to the user’s reported password change. If the decoded time is far from expectations, check for a zero or never sentinel or a truncated copy-paste that dropped digits.

For test fixtures in 2026, encode a known UTC midnight and assert your parser round-trips to the same ticks. Pair investigation notes with civil planning on the date tools hub only when you need human calendar context, not tick arithmetic.

NTFS, event logs, and file metadata

NTFS creation and modification timestamps surface as FILETIME in many forensic tools. When correlating a file’s MFT entry with Active Directory logon events, decode both to UTC on one timeline before inferring sequence. Copy-paste errors that drop leading digits are common when exporting from GUI viewers — verify string length against expected 18-digit magnitudes for 2026 instants.

Windows Event Log XML sometimes embeds FILETIME in SystemTime attributes with different formatting. Normalize to decimal ticks before using this converter. Cross-reference with the Unix timestamp page when Linux-side logs participate in the same incident.

Testing and synthetic fixtures

Developers writing unit tests for directory sync or backup software should encode known UTC instants and assert parsers round-trip. Keep three fixtures: epoch boundary near January 1 1601 UTC (sanity only), a typical 2026 afternoon, and a zero sentinel labeled never in documentation. Tests that only cover Unix epoch miss off-by-584-year bugs when someone pastes the wrong column from AD exports.

Staging environments that seed fake users should document pwdLastSet ticks in test data README files so QA can decode expected values without opening production tools. Synthetic ticks make regression tests deterministic across developer laptops and CI runners.

Incident timelines and reporting

Executive summaries should list UTC first, then one local example city, when describing credential rotation or last-seen activity. FILETIME integers alone confuse non-technical readers; decoded UTC strings align legal, IT, and communications teams on the same instant. When exporting to PDF, include both representations in appendix tables.

Long-running investigations spanning daylight saving changes still decode correctly because FILETIME is UTC-native. Display layers may shift labels; the tick count does not. Store ticks in evidence bags and decode at presentation time to avoid stale local labels in archived reports.

Forensic runbooks should store raw FILETIME ticks alongside decoded UTC in evidence exports so downstream reviewers can re-decode with a different display zone without treating a formatted string as the authoritative source of truth.

SIEM correlation rules merging Windows and Linux events should document FILETIME conversion steps used in 2026 incident runbooks for repeatability.

Related tools

See LDAP timestamp, Unix timestamp, and ISO 8601 on the converters hub. Time-of-day clocks live under time tools.