Skip to main content
Book Consultation →
Date tools100% FreeInstant

FILETIME Converter: Windows File Time to Date

This free tool converts Windows FILETIME values (100-nanosecond intervals since 1 January 1601 UTC) into dates and back. It also shows the Unix timestamp and the .NET ticks for the same moment.

By Debmedia Technologies LLP · Kolkata, India · Updated

What Is It and When Do You Need It?

FILETIME values look like random 18-digit numbers. System administrators and forensic analysts must turn them into dates all the time.

Paste a value or type a date.

How to Use This Tool

  1. Enter or paste your input in the box or boxes above.
  2. Choose the options, if there are any.
  3. Press the button to run the tool.
  4. Read the result and use the copy button where one is shown.

How the Calculation Works

The tool uses exact whole-number arithmetic. The FILETIME is divided by 10,000 to get milliseconds since 1601, and 11,644,473,600,000 milliseconds are taken away to reach the Unix epoch of 1970. Going the other way, the steps are added back and multiplied by 10,000. .NET ticks are FILETIME plus 504,911,232,000,000,000.

Worked Example

The value 133170048000000000 is 1 January 2023 00:00:00 UTC. The Unix time is 1672531200.

Common Uses

  • Active Directory checks.
  • Forensics and logs.
  • Registry values.
  • Programming with Windows APIs.

Tips and Common Mistakes

  • A FILETIME is always UTC.
  • Hex values start with 0x.
  • Dates before 1601 cannot be stored.
  • Check the first result against a case you already know, so you can trust the tool for the rest.
  • Nothing you type leaves your device. The work is done by your browser, so it also works with a slow connection once the page has loaded.

Next, you may need the Unix timestamp converter, Excel serial date converter, day of the week calculator, date difference calculator.

Everything runs in your browser. Nothing you type is uploaded, stored or sent to any outside service.

Frequently Asked Questions

A 64-bit number used by Windows to store times. It counts 100-nanosecond steps from 1 January 1601 UTC.
In Active Directory attributes such as lastLogon and pwdLastSet, in registry data, in NTFS timestamps and in forensic tools.
The same 100-nanosecond steps, but counted from 1 January 0001. The two differ by a fixed number.
Active Directory uses them to mean "never". The tool says so.

Disclaimer: results are calculated in your browser from the numbers you enter. Check important results before you rely on them for money, health, safety or legal decisions.