Timestamp Converter
Read any timestamp — Unix, Active Directory / FILETIME, .NET ticks, Chrome, Apple, Excel — or the time inside a UUID, ULID or ObjectId, across time zones.
How to use
- Paste a number, a date or an ID.
- If the number fits several formats, pick the one your system uses.
- Compare time zones, or paste a second value to get the time between them.
Every system counts time differently
Unix time counts seconds since 1 January 1970 UTC — or milliseconds in JavaScript and Java, microseconds or nanoseconds elsewhere. Windows FILETIME and Active Directory count 100-nanosecond intervals since 1601; .NET ticks use the same unit from the year 1; Chrome and WebKit count microseconds since 1601; Apple’s Cocoa time starts in 2001; and Excel counts days since 30 December 1899. The same number can therefore mean very different dates, which is why every plausible reading is listed.
Time zones in investigations
Logs from different systems rarely agree on time zone or daylight-saving rules, and an hour’s offset can reorder an attack timeline. Convert everything to UTC first, then compare zones side by side; paste a second value to get the exact difference between two events. ISO 8601 / RFC 3339 strings with an explicit offset are the safest format to store.
Times hidden inside IDs
Some identifiers record when they were created: UUID versions 1, 6 and 7, ULIDs and MongoDB ObjectIds. Paste one to read its timestamp — useful for ordering records or checking when an object was made. Random UUIDs (version 4) carry no time. Systems that store Unix seconds in a signed 32-bit integer overflow on 19 January 2038 at 03:14:07 UTC.
Active Directory has its own traps: 0 and 9223372036854775807 in accountExpires both mean “never”, and lastLogonTimestamp is only replicated every 9 to 14 days, so it can trail the real last logon by up to two weeks.
Common questions
How do I convert an Active Directory timestamp?
Paste the value of lastLogonTimestamp, pwdLastSet or accountExpires. It is read as a Windows FILETIME (100-nanosecond intervals since 1601), and 0 or 9223372036854775807 are shown as “never”.
Seconds or milliseconds?
The converter tries every common format and lists each reading that gives a sensible date, so you can pick the one your system uses.
Can I see when a UUID was created?
Yes, for UUID versions 1, 6 and 7, ULIDs and MongoDB ObjectIds, which store their creation time. Random UUIDs (version 4) do not.
Known limitations
- Numbers are read in every plausible format from 1990 to 2100; you pick.
- Leap seconds are ignored, as in Unix time.
- Browser extensions can read any page — use a private window for sensitive data. How the lock works
Related reading on CipherMind
Standards & references
- RFC 3339 — timestamps on the internet (opens in a new tab)
- Microsoft — FILETIME (opens in a new tab)
- RFC 9562 — UUIDs (v1, v6, v7) (opens in a new tab)
- ULID specification (opens in a new tab)