Windows FILETIME Converter
Paste a Windows FILETIME integer and instantly see the UTC date, ISO 8601 string, and Unix timestamp. Commonly needed when reading Active Directory, LDAP, or Win32 API timestamps.
Where you will see FILETIME values
FILETIME is the native timestamp format for the Windows kernel and the Win32 API. You will encounter it in several places:
- Active Directory attributes —
lastLogon,pwdLastSet,accountExpires - NTFS file system — file creation, modification, and access times stored internally as FILETIME
- Windows event log — raw event timestamps before formatting
- Win32 API —
GetSystemTimeAsFileTime(),FindFirstFile()return structures, PE binary timestamps - WMI / CIM — some properties use FILETIME integers rather than the WMI datetime string format
FILETIME shares its 100-nanosecond resolution with .NET's DateTime.Ticks, just measured from a different starting year.
Converting FILETIME in PowerShell and C#
Frequently asked questions
What is a Windows FILETIME?
A FILETIME is a 64-bit integer that counts 100-nanosecond intervals since January 1, 1601 at 00:00:00 UTC. It is the standard timestamp format for the Win32 API and is used internally by Windows to store file timestamps, event log entries, and directory service attributes.
Why does Windows start counting from 1601?
The year 1601 is the start of the first 400-year cycle of the Gregorian calendar. Microsoft chose it so that FILETIME values can represent all dates within a complete Gregorian cycle without any edge-case arithmetic. The year 0001 baseline used by .NET DateTime.Ticks is a separate convention.
How are FILETIME values used in Active Directory and LDAP?
Active Directory stores many timestamps as FILETIME integers: lastLogon, lastLogonTimestamp, pwdLastSet, accountExpires, and others. When querying with LDAP or PowerShell, these attributes appear as large integers like 133500000000000000 rather than formatted dates. This converter decodes them into readable dates.
How do I convert FILETIME to a date in PowerShell?
[DateTime]::FromFileTimeUtc(133500000000000000) returns a UTC DateTime. Use [DateTime]::FromFileTime() (without Utc) if you want the value interpreted in your local time zone, but FromFileTimeUtc is safer for server-side scripts that run across time zones.
What is the difference between FILETIME and .NET DateTime.Ticks?
Both use 100-nanosecond intervals, but their epochs differ: FILETIME starts at 1601-01-01, while DateTime.Ticks starts at 0001-01-01. Converting between them requires adding or subtracting 504,911,232,000,000,000 ticks (the difference between year 1 and year 1601).
How do I convert a FILETIME to a Unix timestamp in C?
Subtract the FILETIME value of the Unix epoch (116,444,736,000,000,000) to get 100-ns intervals since 1970, then divide by 10,000,000 to get seconds: time_t unix = (filetime - 116444736000000000ULL) / 10000000ULL;