Windows FILETIME Converter

About this calculator

Windows represents timestamps internally as FILETIME values — a 64-bit count of 100-nanosecond intervals ("ticks") elapsed since January 1, 1601, 00:00:00 UTC, a reference date chosen because it starts the first full 400-year Gregorian calendar cycle before the epoch. This format shows up throughout the Windows ecosystem: NTFS file creation/modification timestamps, Windows Event Log entries, and Active Directory attributes like lastLogonTimestamp and pwdLastSet are all stored this way.

Converting to a human-readable date (or to the more familiar Unix epoch of January 1, 1970) requires subtracting the offset between the two epochs — 11,644,473,600 seconds, or 116,444,736,000,000,000 in 100-nanosecond ticks — then dividing by 10,000,000 to get Unix seconds. Digital forensics investigators and incident responders decode FILETIME values constantly when reading raw Windows artifacts that don't display a formatted date on their own.