Windows FILETIME Converter

How to use

1. 1Pick FILETIME to date or Date to FILETIME at the top.
2. 2In FILETIME to date mode, paste a decimal value (such as 133456992000000000), a 0x-prefixed hex value, or 8 hex bytes from a hex dump. Use the byte order toggle if the bytes came from a memory dump rather than the on-disk little-endian order.
3. 3Read the decoded UTC date, ISO 8601 string, Unix timestamp, and the original FILETIME in decimal, hex, and both byte orders. Active Directory sentinel values are flagged.
4. 4In Date to FILETIME mode, pick a date and time or paste an ISO 8601 string with up to seven fractional second digits, and copy the matching FILETIME for the format your tool needs.
5. 5Use the presets (Unix epoch, AD Never sentinel, Windows releases) or the Use now button when comparing against a live system clock.

About this tool

Windows FILETIME Converter decodes the 64-bit timestamp Windows uses internally (the FILETIME structure, counted in 100-nanosecond ticks since January 1, 1601 at 00:00:00 UTC) into a readable UTC date and back, with the full precision the format actually carries. FILETIME is the timestamp format you see in NTFS file metadata, Active Directory attributes such as lastLogon, lastLogonTimestamp, pwdLastSet, accountExpires, lockoutTime, and badPasswordTime, LDAP INTEGER8 fields, Kerberos tickets, EVTX event log records, and almost every Win32 API that returns a date. The tool accepts the value as a decimal number, as a 0x-prefixed hex literal, or as eight hex bytes separated by spaces, dashes, commas, or colons in either little-endian (the on-disk order used by NTFS and EVTX) or big-endian order, and runs every internal computation as BigInt so the full 100-nanosecond precision is preserved through the conversion (the numeric value typically exceeds 2^53 and would lose precision if it were treated as a JavaScript Number). It detects common Active Directory sentinel values such as 0 (often Never logged on) and 9223372036854775807 (the max signed Int64 used as Never in accountExpires and lockoutDuration) and flags them so a decoded date is not mistaken for a real event. The reverse direction takes any ISO 8601 date with up to seven fractional second digits and outputs the matching FILETIME as decimal, hex, and both little-endian and big-endian byte layouts, plus the equivalent Unix timestamp in seconds and milliseconds. A live now panel shows the current moment as a FILETIME for quick comparisons against logs. Everything runs locally in your browser, so timestamps from AD audits, forensic captures, or production logs never leave your device.

Free to use. Works in your browser. No signup, no login.