What is a Unix hex timestamp?

A Unix hex timestamp is just a standard Unix timestamp (seconds since 1970-01-01 UTC) written in hexadecimal instead of decimal. There's no separate "hex format" — it's the same value, different base.

You'll encounter hex timestamps in:

Binary file formats — many file headers store timestamps as 4-byte big-endian or little-endian hex values
Memory dumps and hex editors — when inspecting raw structures
Network protocols — packet headers, ETag values, session tokens
Git commit hashes' surrounding data — git stores timestamps as decimal but adjacent metadata may be hex
Cookies and tokens — some systems encode timestamps as hex for compactness
Forensics — extracting timestamps from PCAP files, memory dumps, embedded systems

Quick reference

Decimal	Hex	Date
`0`	`0x00000000`	1970-01-01 00:00:00 UTC
`946684800`	`0x386D4380`	2000-01-01 00:00:00 UTC
`1735689600`	`0x67742800`	2025-01-01 00:00:00 UTC
`2147483647`	`0x7FFFFFFF`	2038-01-19 03:14:07 UTC (Y2038!)

Byte order matters

When extracting timestamps from binary files or network packets, you need to know the byte order (endianness):

Big-endian (network byte order, most file formats)

1735689600 (2025-01-01 UTC) → bytes: 67 74 28 00

Little-endian (x86 / x64 native)

1735689600 (2025-01-01 UTC) → bytes: 00 28 74 67

If you see what looks like a date but it's converting to an impossible value, try byte-swapping it.

Conversion

Hex string → Unix seconds

unix_seconds = parseInt(hex_string, 16)

Unix seconds → hex string

hex_string = unix_seconds.toString(16)

Code examples

JavaScript

// Hex to date (handles both "0x..." and bare hex)
function hexToDate(hex) {
  const clean = hex.toLowerCase().replace(/^0x/, '');
  const sec = parseInt(clean, 16);
  return new Date(sec * 1000);
}

// Date to hex (8-character zero-padded)
function dateToHex(date) {
  const sec = Math.floor(date.getTime() / 1000);
  return '0x' + sec.toString(16).padStart(8, '0');
}

// Swap byte order (big-endian ↔ little-endian)
function swapBytes(hex) {
  const clean = hex.replace(/^0x/, '').padStart(8, '0');
  return clean.match(/.{2}/g).reverse().join('');
}

Python

def hex_to_unix(hex_str: str) -> int:
    return int(hex_str.lstrip('0x'), 16)

def unix_to_hex(unix_sec: int) -> str:
    return format(unix_sec, '08x')

# Byte-swap (4-byte big-endian to little-endian and vice versa)
def swap_bytes(hex_str: str) -> str:
    h = hex_str.lstrip('0x').zfill(8)
    return ''.join(reversed([h[i:i+2] for i in range(0, len(h), 2)]))

Bash

# Hex to date
echo "67742800" | xargs -I {} printf "%d\n" 0x{} | xargs -I {} date -u -d @{}

# Date to hex
printf "%x\n" $(date +%s)

Tips for forensic work

Length matters. A 4-byte hex (8 chars) is Unix seconds. An 8-byte hex (16 chars) is likely Unix milliseconds or 64-bit time, or a Windows FILETIME. Check the magnitude.
Trust but verify. If a hex value converts to a plausible date, it's probably a timestamp. If it converts to 1970 or far-future, byte-swap and try again.
Watch for FILETIME. If a value is 16 hex chars and decodes to a date in the 1600s, you have a Windows FILETIME, not a Unix timestamp. Use the LDAP converter instead.