Tool to convert a Windows timestamp (Filetime) to a readable UTC or local date, understand Active Directory, NTFS and Win32 API timestamps, and perform reverse conversions.
Timestamp Windows - dCode
Tag(s) : Date and Time, Informatics
dCode is free and its tools are a valuable help in games, maths, geocaching, puzzles and problems to solve every day!
A suggestion ? a feedback ? a bug ? an idea ? Write to dCode!
Timestamp Windows
Windows Timestamp Converter
Answers to Questions (FAQ)
What is a Windows timestamp? (Definition)
A Windows timestamp is a 64-bit integer representing the number of 100-nanosecond intervals that have elapsed since January 1, 1601, at 00:00:00 UTC.
This time format is historically associated with Windows NT systems and is used in many system components, including:
— Active Directory
— NTFS (file timestamping: creation, modification, access)
— Win32 API (FILETIME and SYSTEMTIME structures)
This format is also known as Windows Filetime, Windows NT Time, Windows NT timestamp, or 18-digit timestamp (although this is not always the case).
How do I convert a Windows timestamp into a readable date?
To convert a Windows timestamp into a readable date, the only way is to count the number of seconds, hours, and days since 1601.
A useful technique is to divide the value by 10,000,000 to obtain a number of seconds (1 interval = 100 ns), then subtract 116,444,736,000, which represents the number of seconds between January 1, 1601, and January 1, 1970. The resulting value is a 32-bit integer in Unix timestamp format, which computer programs can instantly convert to a UTC date.
Windows timestamp: 123456789100000000, which in seconds is 12345678910. Calculating 12345678910 - 11644473600 = 701205310, this value corresponds to the date 1992-03-21 19:15:10 UTC
How do I convert a date to a Windows timestamp?
To convert a date to a Windows timestamp, the only way is to calculate the number of seconds, hours, and days since 1601.
From a computer science perspective, it's practical to convert the date to seconds elapsed since January 1, 1970 (Unix timestamp) and add 11644473600 to return to the Windows origin (1601) before multiplying the total by 10000000 to obtain the number of 100-nanometer intervals.
Why are some AD timestamps at 0 or 9223372036854775807?
In Active Directory, certain timestamp values have special meanings:
— 0: Indicates an undefined or never initialized value.
Example: lastLogon: Account never logged in
Example: pwdLastSet: Password never changed
— 9223372036854775807: Corresponds to the maximum value of a 64-bit signed integer. This value is used as a logical indicator meaning never or infinite.
Example: accountExpires: Account with no expiration date
How to manage time zones with Windows timestamps?
Windows timestamps are always expressed in UTC, without time zone information.
To obtain local time, apply the offset to the desired time zone (for example, UTC+1 for Paris) and take into account any applicable daylight saving time depending on the date and geographical location.
Why use the year 1601?
The choice of the year 1601 corresponds to the adoption of the Gregorian, providing a consistent basis for calendar calculations.
Source code
dCode retains ownership of the "Timestamp Windows" source code. Any algorithm for the "Timestamp Windows" algorithm, applet or snippet or script (converter, solver, encryption / decryption, encoding / decoding, ciphering / deciphering, breaker, translator), or any "Timestamp Windows" functions (calculate, convert, solve, decrypt / encrypt, decipher / cipher, decode / encode, translate) written in any informatic language (Python, Java, PHP, C#, Javascript, Matlab, etc.) or any database download or API access for "Timestamp Windows" or any other element are not public (except explicit open source licence). Same with the download for offline use on PC, mobile, tablet, iPhone or Android app.
Reminder: dCode is an educational and teaching resource, accessible online for free and for everyone.
Cite dCode
The content of the page "Timestamp Windows" and its results may be freely copied and reused, including for commercial purposes, provided that dCode.fr is cited as the source (Creative Commons CC-BY free distribution license).
Exporting the results is free and can be done simply by clicking on the export icons ⤓ (.csv or .txt format) or ⧉ (copy and paste).
To cite dCode.fr on another website, use the link:
In a scientific article or book, the recommended bibliographic citation is: Timestamp Windows on dCode.fr [online website], retrieved on 2026-01-21,
