Distinguish seconds from milliseconds
Unix time counts elapsed time from 1970-01-01 00:00:00 UTC. A contemporary timestamp with 10 digits is usually seconds; a 13-digit value is usually milliseconds. This is a strong heuristic, not a universal law. Negative values represent dates before the epoch, while smaller values may describe test fixtures or durations rather than dates.
| Input | Likely unit | UTC result |
|---|---|---|
1704067200 | Seconds | 2024-01-01 00:00:00 |
1704067200000 | Milliseconds | 2024-01-01 00:00:00 |
0 | Seconds | 1970-01-01 00:00:00 |
Normalize to UTC before comparing events
Browser local time is convenient for reading, but it is a poor comparison format. Convert each source value to ISO 8601 UTC, keep the original beside it, and record the assumed unit. If a log already includes an offset such as -05:00, preserve that value and also calculate UTC.
source: 1767225600
assumption: Unix seconds
normalized: 2026-01-01T00:00:00.000ZDo not append Z to a local timestamp merely to make it look like UTC. The suffix changes the meaning. A time written without an offset remains ambiguous until the generating system or challenge description establishes its timezone.
Reconstruct a small CTF timeline
Suppose an access log records a login at 1767225600, a JWT contains iat: 1767225605, and an exported record shows 2026-01-01T00:00:09Z. Normalize all three values and sort them without rounding. The resulting sequence is login, token issue five seconds later, then export four seconds after that.
This sequence is evidence of order, not proof of causation. Clock drift, delayed logging, queueing, and separate hosts can produce small differences. Record which system created each value before drawing conclusions.
Milliseconds can decide the order of two requests that share the same visible second. Preserve the original integer even if your report displays a friendlier timestamp.
Common timestamp mistakes
Converting a 13-digit value as seconds
The result lands thousands of years in the future or becomes invalid. Check magnitude before assuming corruption.
Mixing UTC and browser-local output
Two strings can describe the same instant while displaying different clock times. Compare normalized instants, not their visual hour fields.
Assuming every number is a date
Request IDs, durations, counters, and random values can resemble timestamps. A plausible date plus surrounding field names such as created_at, iat, or mtime provides stronger evidence.
How this guide was verified
The examples were checked with the Hexforge timestamp converter using the fixed vectors 0, 1704067200, 1704067200000, and 1767225600. Second and millisecond forms were required to resolve to the same ISO instant where expected, and UTC output was compared independently with JavaScript Date.toISOString().
Repeatable timeline checklist
- Preserve the source value and field name.
- Identify seconds, milliseconds, or an ISO date.
- Convert to UTC without discarding precision.
- Record the source system and timezone assumption.
- Sort normalized instants and account for clock drift.
- Save the timeline and assumptions with the challenge notes.