LDAP Timestamp Converter
LDAP timestamp to date
Paste an 18-digit FILETIME value, a Generalized Time string such as 20260826040509.0Z, or a negative duration from maxPwdAge. Spaces and commas are ignored.
Date to LDAP timestamp
For writing a value back, or for building a filter such as (accountExpires<=…).
Active Directory and Windows FILETIME values to a readable date, including the ones that are not dates at all.
Converting an Active Directory timestamp
Active Directory stores times as Windows FILETIME: the number of 100-nanosecond intervals since 1 January 1601 at 00:00 UTC. A present-day value is 18 digits, so 133801632000000000 is 1 January 2025. The arithmetic is a division by 10,000 to reach milliseconds and a subtraction of 11,644,473,600,000 to reach the Unix epoch.
The catch is that 18 digits is past what a JavaScript or spreadsheet number holds exactly, so a conversion done in a float quietly loses the last few digits. This page does the arithmetic in arbitrary precision and keeps the sub-millisecond remainder, which is why it can print the seven fractional digits .NET shows.
When the value is not a date: zero and Int64 max
Two values are sentinels, and what they mean depends on the attribute they came from. This is the part that sends people to forums, because a converter that renders accountExpires = 0 as a date in 1601 is arithmetically correct and completely unhelpful.
- accountExpires = 0 or Int64 max: the account never expires.
- pwdLastSet = 0: the user must change their password at next logon.
- lockoutTime = 0: the account is not locked out.
- lastLogon = 0: no logon recorded on the domain controller you asked.
Int64 max is 9223372036854775807. As a date it lands in the year 30828, which is a dependable sign that you are holding a sentinel rather than a time.
Negative values: maxPwdAge and lockoutDuration
A handful of attributes store a span rather than an instant, as a negative count of the same 100-nanosecond intervals. The default domain policy maxPwdAge of -36288000000000 is 42 days, and -18000000000 is the 30 minute lockoutDuration. Paste a negative value above and it is read as a duration instead of being run through the date arithmetic, which is what produces the impossible sixteenth century results people report.
lastLogon against lastLogonTimestamp
Both are FILETIME values and they routinely disagree, which is by design rather than a fault. lastLogon is exact but is not replicated, so it is only true for the domain controller you queried and finding the real answer means asking all of them. lastLogonTimestamp is replicated but deliberately lagged, by default up to 14 days, to keep replication traffic down. If you are hunting stale accounts, the lag is the thing to account for.
LDAP timestamp FAQs
What is an LDAP or Active Directory timestamp?
A count of 100-nanosecond intervals since 1 January 1601 at 00:00 UTC. Windows calls it FILETIME, and Active Directory stores pwdLastSet, accountExpires, lastLogon, lastLogonTimestamp, badPasswordTime and lockoutTime in it. Present-day values run to 18 digits, for example 133801632000000000 for 1 January 2025.
Why does 1601 matter?
It is the start of the 400-year Gregorian calendar cycle that was current when Windows NT was designed, which made leap-year arithmetic tidy. It has no significance beyond that, and it is the only reason an Active Directory timestamp is not simply a Unix timestamp.
What does accountExpires = 0 mean?
That the account never expires. It does not mean 1 January 1601. Zero is a sentinel, and its meaning depends on the attribute: on pwdLastSet it means the user must change their password at next logon, on lockoutTime it means the account is not locked out, and on lastLogon it means no logon has been recorded on that domain controller. Converters that render zero as a date in 1601 are the reason this question keeps being asked.
What does 9223372036854775807 mean?
It is Int64 max, and it also means never. Active Directory uses both zero and Int64 max for accountExpires depending on how the value was written, so a tool has to recognise both. As a date it would be somewhere in the year 30828, which is a reliable sign you are looking at a sentinel rather than a real time.
Why is my maxPwdAge value negative?
Because it is a duration, not an instant. Active Directory stores maxPwdAge, minPwdAge and lockoutDuration as a negative count of 100-nanosecond intervals. The default domain policy value of -36288000000000 is 42 days, and -18000000000 is the 30 minute lockout duration. Paste a negative value here and it is read as a span.
What is the difference between lastLogon and lastLogonTimestamp?
lastLogon is accurate but is not replicated, so it is only true for the domain controller you queried, and you have to check every DC to find the real answer. lastLogonTimestamp is replicated but is deliberately lagged, by default by up to 14 days, to keep replication traffic down. Neither is wrong; they answer different questions.
What is Generalized Time?
The other format Active Directory uses, seen on whenCreated and whenChanged: YYYYMMDDHHMMSS.0Z, always in UTC. This page accepts it as well and converts in both directions.
Is anything I paste sent to a server?
No. The conversion runs entirely in your browser and the page works offline. Directory timestamps come out of incident investigations and audit exports, and they stay on your machine.