Timestamp converter
Paste a number from a log, a database or Active Directory and the tool works out its format and turns it into a readable date in UTC and your local time. It also works the other way round, from a date.
How to use it
- Copy the timestamp – a number from a log, an Active Directory attribute (such as pwdLastSet), a browser database, or a date like 2026-11-06T14:30:00Z.
- Paste it into the box and click Convert. Spaces and underscores between digits are fine.
- If the number makes sense in more than one format, the tool shows every option – pick the one that matches where the data came from.
- Under The same moment in other formats, copy the value you need for a query or a ticket.
How it works
When you investigate an incident, time turns up in many shapes: a web server writes a date, an application logs Unix time in milliseconds, Windows and Active Directory count in hundreds of nanoseconds since 1601, and Chrome counts in microseconds since the same year. You can't build a timeline of events without converting them.
The tool supports these formats:
- Unix time (epoch time) – the number of seconds since 1 January 1970 00:00 UTC. Common in Linux, databases and APIs. Variants in milliseconds (JavaScript, Java), microseconds and nanoseconds are told apart by the number of digits.
- Windows FILETIME – the number of 100-nanosecond intervals since 1 January 1601 UTC. Used for NTFS file times and for Active Directory attributes such as
pwdLastSet,lastLogonTimestampandaccountExpires(often called LDAP or AD timestamps). Hexadecimal input0x…works too. - Chrome / WebKit – microseconds since 1 January 1601 UTC. This is how the Chromium engine behind Chrome and Edge keeps time, so you'll find values in this format in those browsers' data, for example during a forensic review of browsing history.
- ISO 8601 / RFC 3339 – for example
2026-11-06T14:30:00Zor2026-11-06 15:30:00+01:00.
The result is shown in UTC, in your computer's local time and relative to now. The Now button fills in the current Unix time.
FAQ
Is the value I enter sent anywhere?
No. The conversion runs as a script in your browser. Nothing is sent to a server or stored.
How does the tool tell which format a number is in?
It tries every supported format and only shows the ones that land between 1980 and 2099. A decimal number is treated as Unix seconds, and a number starting with 0x as Windows FILETIME. A date without a time zone is treated as UTC, and the tool tells you so.
Why is local time different from UTC?
UTC is a single worldwide time with no daylight saving. Local time comes from your computer's settings. When you line up logs from different systems, it's safest to work in UTC.
What does 0 or 9223372036854775807 mean in Active Directory?
The pwdLastSet, lastLogonTimestamp and accountExpires attributes store time as a FILETIME. For accountExpires, both 0 and the maximum value 9223372036854775807 (0x7FFFFFFFFFFFFFFF) mean the account never expires. According to Microsoft, 0 in pwdLastSet means the user must change their password at next logon (unless the password is set never to expire). The tool doesn't show these values as dates – it explains them instead.
Sources
Updated