Windows FILETIME Converter

Why 1601?

1601 was chosen because it's the start of the first 400-year Gregorian calendar cycle before Windows' original design era, letting engineers use a single unsigned 64-bit integer without needing a sign bit for dates before the epoch, while comfortably covering every date Windows would ever need. The same epoch, coincidentally, is shared by Active Directory's timestamp fields — see the LDAP/Active Directory Timestamp Converter if that's what you're actually decoding.

Where you'll run into this

FILETIME shows up constantly in Windows forensics and systems administration: NTFS $STANDARD_INFORMATION and $FILE_NAME attributes, Windows Event Log records, Prefetch files, and any Win32 API call returning a FILETIME struct (which splits the 64-bit value into two 32-bit halves — dwLowDateTime and dwHighDateTime — that need to be recombined before converting).