Chrome, Safari, and other WebKit-based applications store times as microseconds since January 1, 1601 (UTC) — the same epoch as Windows FILETIME but with microsecond, not 100-nanosecond, precision. Found in browser history databases, cookies, and forensics work.
Chromium (and therefore Chrome, Edge, Brave, Opera) and WebKit (Safari) use a timestamp format based on microseconds since 1601-01-01 00:00:00 UTC. This is the same epoch as Windows FILETIME and LDAP, but with different units.
You'll most commonly see this format when:
History SQLite database (last_visit_time, visit_time)expires_utc, creation_utc)unix_seconds = (chrome_value / 1_000_000) - 11_644_473_600
chrome_value = (unix_seconds + 11_644_473_600) * 1_000_000
If you're inspecting ~/Library/Application Support/Google/Chrome/Default/History (macOS) or %LOCALAPPDATA%\Google\Chrome\User Data\Default\History (Windows), the timestamp columns use this format:
-- SQLite query to convert Chrome timestamps to readable dates
SELECT
url,
title,
datetime(last_visit_time / 1000000 - 11644473600, 'unixepoch') as visited
FROM urls
ORDER BY last_visit_time DESC
LIMIT 20;
from datetime import datetime, timezone
CHROME_OFFSET_SEC = 11_644_473_600
def chrome_to_datetime(chrome_us: int) -> datetime:
unix_sec = (chrome_us / 1_000_000) - CHROME_OFFSET_SEC
return datetime.fromtimestamp(unix_sec, tz=timezone.utc)
def datetime_to_chrome(dt: datetime) -> int:
return int((dt.timestamp() + CHROME_OFFSET_SEC) * 1_000_000)
const CHROME_OFFSET = 11644473600;
function chromeToDate(chrome_us) {
const sec = chrome_us / 1_000_000 - CHROME_OFFSET;
return new Date(sec * 1000);
}
function dateToChrome(date) {
return (Math.floor(date.getTime() / 1000) + CHROME_OFFSET) * 1_000_000;
}