Windows FILETIME Converter

## Convert Windows FILETIME and Active Directory Timestamps Windows and Active Directory store many timestamps in a format humans cannot read at a glance: a 64-bit FILETIME value counting 100-nanosecond intervals since January 1, 1601 (UTC). This converter turns those values, along with related LDAP and AD timestamp formats, into ordinary dates and times. It also handles batch conversion, so you can paste a column of values pulled from `lastLogon`, `pwdLastSet`, `accountExpires`, and similar attributes and translate them all at once. ## Where These Values Come From If you query Active Directory with PowerShell, `dsquery`, LDAP browsers, or CSV exports, you will run into raw integer timestamps on attributes such as: - `lastLogon` and `lastLogonTimestamp` — when an account last authenticated. - `pwdLastSet` — when the password was last changed. - `accountExpires` — when the account is set to expire. - `badPasswordTime` and `lockoutTime` — security and lockout auditing. ## Format Nuances Worth Knowing - **FILETIME epoch is 1601**, not the Unix epoch of 1970, so the raw numbers are very large. - A `pwdLastSet` of `0` means "must change password at next logon," and `-1` (or `0x7FFFFFFFFFFFFFFF`) on `accountExpires` means "never expires." - `lastLogon` is not replicated between domain controllers; `lastLogonTimestamp` is the replicated, slightly stale one. - Values are stored in UTC, so convert to your local zone deliberately when comparing against user reports. ### Why Use This Tool Manually decoding FILETIME math is error-prone. Batch conversion is faster than scripting a one-off and helps when auditing stale accounts, investigating a security incident, or cleaning up an identity export. Because the conversion is arithmetic on values you paste in, the work happens in your browser rather than on a remote server.