Non-Unix Epoch Formats — LDAP, Windows Filetime, Apple, NTP Explained

Unix time uses January 1, 1970 as its epoch. Other systems use different dates. Windows Filetime uses 1601. Apple Cocoa uses 2001. NTP uses 1900. LDAP uses 1601 like Windows but counts in 100-nanosecond intervals. Mix them up and you get dates that are off by decades or centuries.

This guide covers the most common non-Unix epoch formats and how to convert them to a regular Unix timestamp or human date.

Non-Unix Epoch Format Reference

Format	Epoch	Unit	Used by
Unix time	1970-01-01 UTC	seconds	POSIX, Linux, macOS, JavaScript (ms)
Windows Filetime	1601-01-01 UTC	100-nanosecond intervals	Windows file metadata, NTFS
LDAP / Active Directory	1601-01-01 UTC	100-nanosecond intervals	Active Directory, lastLogon, accountExpires
NTP timestamp	1900-01-01 UTC	seconds (32 bits) + fractional	Network Time Protocol, NTPv4
Apple Cocoa / NSDate	2001-01-01 UTC	seconds (double)	macOS, iOS, NSDate references
Apple Mac HFS+	1904-01-01 UTC	seconds	Older Apple file metadata
WebKit / Chrome	1601-01-01 UTC	microseconds	Chrome cookie expiration, history database
Excel serial date	1899-12-30 (or 1904 on Mac)	days (float)	Excel internal date storage

Each of these stores a "moment in time" — they just count it differently. To get to a Unix timestamp, you need the offset between their epoch and 1970, plus a unit conversion.

Sell Custom Apparel — We Handle Printing & Free Shipping

Windows Filetime and LDAP — 1601 Epoch

Windows Filetime and Active Directory use the same format: 100-nanosecond intervals since January 1, 1601 UTC. The difference between 1601 and 1970 is exactly 11644473600 seconds.

// Filetime to Unix seconds
unix_seconds = (filetime / 10000000) - 11644473600

// JavaScript example
const filetime = 132939840000000000n;  // BigInt for safety
const unixSeconds = Number(filetime / 10000000n - 11644473600n);
const date = new Date(unixSeconds * 1000);

// Python example
import datetime
filetime = 132939840000000000
unix_seconds = (filetime / 10000000) - 11644473600
dt = datetime.datetime.fromtimestamp(unix_seconds, tz=datetime.timezone.utc)

The 10000000 divisor converts 100-nanosecond intervals to seconds (100ns × 10,000,000 = 1 second). Use BigInt or 64-bit integers — Filetime values are too big for regular JavaScript numbers without precision loss.

LDAP-specific gotcha

Active Directory stores some attributes (like accountExpires) with special values: 0 means "never set" and 9223372036854775807 (max int64) means "never expires." Check for these before converting or you will get nonsense dates around the year 30000.

Apple Cocoa, NTP, and Other Formats

Apple Cocoa NSDate (2001 epoch)

// Cocoa to Unix
unix_seconds = cocoa_seconds + 978307200

// 978307200 is the seconds between 1970-01-01 and 2001-01-01

// Example
const cocoa = 730000000;  // a typical NSDate value
const unixSec = cocoa + 978307200;
const date = new Date(unixSec * 1000);

NTP timestamp (1900 epoch)

// NTP integer seconds to Unix
unix_seconds = ntp_seconds - 2208988800

// 2208988800 is the seconds between 1900-01-01 and 1970-01-01

// NTP also has a 32-bit fractional part — for sub-second precision:
ntp_fractional = ntp_value & 0xFFFFFFFF
fractional_seconds = ntp_fractional / (2 ** 32)

WebKit / Chrome timestamp (1601 epoch in microseconds)

// WebKit timestamp (used in Chrome cookie expiration, history.db)
unix_seconds = (webkit_time / 1000000) - 11644473600

// Example: convert a Chrome cookie expiration
const webkitTime = 13340000000000000;
const unixSec = (webkitTime / 1000000) - 11644473600;

Excel serial date

// Excel date to Unix (Windows Excel uses 1899-12-30 as day 0)
unix_seconds = (excel_date - 25569) * 86400

// 25569 is the days between 1899-12-30 and 1970-01-01
// Mac Excel uses 1904 as base — different offset

The pattern is the same for every format: subtract the offset between their epoch and 1970, convert to seconds, then treat it as a normal Unix timestamp. Once you have a Unix timestamp, the free converter handles the rest.

Frequently Asked Questions

What is Windows Filetime?

Filetime is Windows's native timestamp format: a 64-bit integer counting 100-nanosecond intervals since January 1, 1601 UTC. NTFS file metadata, registry timestamps, and Active Directory all use it. To convert to Unix time: (filetime / 10000000) - 11644473600.

How do I convert an LDAP timestamp to a date?

LDAP uses Windows Filetime format. Divide by 10,000,000 to get seconds, then subtract 11644473600 to shift from the 1601 epoch to the 1970 Unix epoch. The result is a normal Unix timestamp you can convert to a date.

Why does Apple use a different epoch?

Apple Cocoa (NSDate) uses January 1, 2001 because that was when Mac OS X launched. Older Mac HFS+ filesystem used January 1, 1904 because that fit a 32-bit second counter ending in 2040. Both choices were practical at the time and stuck.

What is the offset between NTP and Unix time?

2,208,988,800 seconds — the number of seconds between January 1, 1900 (NTP epoch) and January 1, 1970 (Unix epoch). To convert NTP to Unix, subtract this number. NTP also has a 32-bit fractional second component for sub-second precision.

Why does Chrome use Filetime for cookies?

Chrome was originally developed on Windows where Filetime is the native timestamp format. The format propagated through the codebase and is still used in Chrome's cookie store, history database, and download metadata even on macOS and Linux versions.

Is there a universal "non-Unix epoch" library?

Most general date libraries (Pandas, date-fns, Joda-Time, Noda Time) handle multiple epoch formats. For one-off forensic conversions, the offset math is simple enough to do manually using the offset values in this guide.