Windows FILETIME converter
A Windows FILETIME counts 100-nanosecond intervals since 1 January 1601 UTC. It turns up in file metadata, the registry and Active Directory.
How to use the windows filetime converter
The 1601 epoch is not arbitrary: the Gregorian calendar repeats on a 400-year cycle, and 1601 was the start of the first full cycle before Windows NT was designed, which made date arithmetic simpler. The tick size of 100 nanoseconds is a compromise that gives good precision while still spanning about 58,000 years in a 64-bit integer. In practice you meet FILETIME values as an eighteen-digit number in a registry export or an LDAP attribute, and the same encoding is what Active Directory uses for lastLogonTimestamp, pwdLastSet and accountExpires. A value of 0 means never, and 9223372036854775807 also means never, which is worth knowing before treating it as a date in the year 30828.
Questions
The Gregorian calendar repeats every 400 years, and 1601 began the first full cycle before NT was designed. It made the arithmetic easier.
100 nanoseconds. There are 10,000,000 to a second.
Never, in most Windows and Active Directory contexts. So does the maximum value, 9223372036854775807.
No, everything here is UTC. Timestamps are stored in UTC precisely so they are unambiguous; converting to a local zone is a separate step and needs to know the zone.
Yes. Active Directory uses FILETIME for lastLogonTimestamp, pwdLastSet and similar attributes.