dc=tools
Policy durations are stored as negative counts of 100-nanosecond ticks. Read them, write them, and work out when one account's password expires or its lockout ends. Everything runs in your browser, so nothing you paste leaves your machine. The page's Content-Security-Policy also stops it from sending anything, which you can check in its source.
Paste the stored values, which are negative counts of 100-nanosecond ticks, or type a length such as 42 days, 90d or 30 minutes to get the value to store. A plain number means days for password ages and minutes for lockouts. Fine-grained policies store the same format in msDS-MaximumPasswordAge and its siblings.
These filters use the domain policy above. Accounts under a fine-grained policy expire on its schedule instead; msDS-UserPasswordExpiryTimeComputed gives each account's real date but can't be used in a filter.