What is a Windows FILETIME?

FILETIME is a 64-bit value that counts the number of 100-nanosecond intervals since midnight on 1 January 1601 in UTC. Windows uses it for file timestamps and many system APIs.

How does FILETIME relate to Unix time?

The Unix epoch of 1 January 1970 is 116,444,736,000,000,000 intervals after the FILETIME epoch. The tool subtracts that constant to convert to a normal date and a Unix timestamp.

Can I enter the value in hexadecimal?

Yes. Prefix the value with 0x to enter it as hexadecimal, which is how FILETIME often appears in registry dumps, memory, and forensic tools. Plain decimal input is also accepted.

Why use BigInt arithmetic?

A FILETIME spans the full unsigned 64-bit range, which is larger than a JavaScript number can hold exactly. BigInt keeps every digit precise so the conversion is not silently rounded.

What date range does it cover?

Values must fit in an unsigned 64-bit integer. The epoch is 1601-01-01, and the maximum value reaches the year 30828, far beyond any practical timestamp you will encounter.

Windows FILETIME Converter

What a FILETIME value is

Windows records timestamps as a FILETIME: a 64-bit count of 100-nanosecond intervals since the start of 1 January 1601, in UTC. You will see these values in the registry, in file metadata, in event logs, and in forensic tooling, usually as a large decimal or a hex blob. This tool converts a FILETIME to a readable UTC date and back, and accepts either decimal or hexadecimal input.

How it works

The conversion hinges on the offset between the FILETIME epoch and the Unix epoch. Midnight on 1 January 1970 sits 116,444,736,000,000,000 intervals after the FILETIME origin. Subtracting that constant maps the FILETIME onto Unix-based time: dividing the remainder by 10,000 gives milliseconds for a standard date, and dividing by 10,000,000 gives whole Unix seconds. The reverse direction adds the offset back after scaling the date’s milliseconds.

133100064000000000        ->  2022-10-12T00:00:00Z
0x01D8DCE000000000        ->  parsed as a FILETIME then converted
2022-12-01T00:00:00Z      ->  133143264000000000

All arithmetic uses BigInt so the high-order digits of the 64-bit value are never lost to floating-point rounding.

Example and notes

FILETIME values are always in UTC, so the tool reads and writes them as UTC; if you have a local time, convert it first. When entering hexadecimal, include the 0x prefix so the tool knows the base. The result also shows the equivalent Unix timestamp in seconds, which is handy when correlating Windows artifacts with logs that use Unix time.