Real Epoch Converter logo realepochconverter
ldap timestamp converter

LDAP Timestamp Converter. Active Directory FileTime to Date

Active Directory stores every important moment, password changes, account expirations, object creation, as an 18-digit count of 100-nanosecond intervals since January 1, 1601 UTC. Paste one here and it becomes a readable date instantly.

converter

LDAP / Active Directory time.

The 18-digit AD FileTime values from pwdLastSet, accountExpires, and LDAP whenChanged (decoded with plain arithmetic.

100-nanosecond intervals since January 1, 1601 UTC.

What an AD FileTime is

Windows represents timestamps as a count of 100-nanosecond intervals since the "Windows epoch": January 1, 1601, 00:00:00 UTC. The same format appears across the Windows ecosystem under different names:

  • LDAP attributes. pwdLastSet, accountExpires, lastLogon, whenCreated, whenChanged, lastLogonTimestamp.
  • Active Directory, the ADsLargeInteger 64-bit value shown by Get-ADUser and dsquery.
  • Win32. FILETIME, as returned by GetFileTime() and the registry's RegQueryValueEx.

A value around 134305344000000000 corresponds to August 7, 2026, the constant gap to the Unix epoch is 11644473600 seconds (1601 → 1970).

The FileTime-to-Unix offset, in seconds and milliseconds

  • LDAP → Unix seconds: value / 10_000_000 - 11644473600.
  • Unix seconds → LDAP: (unix + 11644473600) * 10_000_000.
  • In milliseconds: divide the LDAP value by 10_000 instead, and the offset becomes 11644473600000 ms.

AD attribute values, decoded

  • 116444736000000000 → January 1, 1970 00:00:00 UTC, the Unix epoch, in AD terms.
  • 134305344000000000 → August 7, 2026 00:00:00 UTC.

FromFileTime and friends in four languages

  • PowerShell: [DateTime]::FromFileTime(134305344000000000) and [DateTime]::UtcNow.ToFileTimeUtc().
  • C#: DateTime.FromFileTimeUtc(134305344000000000) / DateTime.UtcNow.ToFileTimeUtc().
  • Python: datetime(1601, 1, 1, tzinfo=timezone.utc) + timedelta(microseconds=value / 10).
  • Go: time.Unix(0, (value-116444736000000000)*100).

Gotchas: 64-bit precision, the 1601 epoch, and sentinel values

  • 64-bit precision, current values are ~18 digits, beyond JavaScript's safe-integer range. This converter uses BigInt, and so should your scripts.
  • Always UTC. FileTime values are UTC by definition; convert to local time only for display.
  • accountExpires, a value of 0 or 9223372036854775807 (max Int64) means "never expires", not a real date.
  • Not the same as Unix, the 1601 epoch predates 1970 by 11,644,736,000 seconds; forgetting the offset is the classic off-by-369-years bug.

First published · Last reviewed · Maintained and developed by the Real Epoch Converter team · Email · Contact · Methodology

Sources & references

Working with Active Directory time values

FileTime values rarely travel alone — these are the formats and tools that sit next to them:

Copied