Open EML files
Opening an unexpected .eml is the awkward case: the safe way to read it is in something that is not your mail client, because your mail client is signed in as you and will happily fetch every image the sender put in it. A viewer that never makes a request on the message's behalf removes that problem entirely.
This one parses the message as real MIME — nested multiparts, alternative text and HTML bodies, RFC 2047 and RFC 2231 encoded headers, international character sets, inline CID images, calendar invitations and malformed structures that no client agrees on. The HTML body is sanitised and shown in a sandboxed frame with scripting disabled at four independent layers; every remote image, stylesheet and font is blocked and listed instead. Headers, the delivery chain, authentication results and attachment hashes are all shown next to the message.
The file is read by code running in this tab. It is not uploaded, not queued on a server and not seen by anyone but you — which also means there is no size limit imposed from outside, only what your own device can hold.
- 1.Drop an .eml file. Its format is confirmed from the bytes; the extension is treated as a claim, not evidence.
- 2.Read the message with remote content blocked. Switch between the rendered body, the plain-text alternative, the raw source and the MIME tree.
- 3.Inspect the headers, the received chain and the security findings; download attachments individually or as a ZIP with hashes.
Drop email files here
Built for .eml, .mbox, .msg. Nothing is uploaded — the file is read by code running in this tab.
What this page cannot do
- Remote images and remote stylesheets are never loaded, and there is no switch to turn them on. The reasoning is in the FAQ below and on the privacy page.
- The rendered body is a sanitised version of the sender's HTML. Scripts, forms, frames, embedded objects, meta refresh, event handlers and CSS url() are removed, so a message that depends on any of those will look different here than in a mail client. The original bytes are always downloadable unchanged.
- Because the preview frame is sandboxed without script access, it cannot report its own height. Drag its bottom edge to resize it.
- Authentication results are read from the headers the message already carries. Nothing is verified live — no DNS lookup, no DKIM signature check — because both would require sending the sender's domain to a third party.
If it did not work
- The message body is blank.
- Why: Some newsletters have no text body at all and build the entire message from remote images, all of which are blocked here.
- Try: Check the external resources panel — it lists every image the message wanted to fetch. The raw source view shows exactly what the message contains.
- Accented or non-Latin characters look wrong.
- Why: The message declares a character set that does not match its bytes, which is common in older mail.
- Try: The viewer says so in the parse notes when it had to fall back. The raw source view shows the declared charset and the undecoded bytes.
- An attachment has a name like part-1.2.bin.
- Why: The message did not give that part a filename.
- Try: That is recorded rather than hidden: the attachment list marks generated names, and so does the export manifest.
Questions
Is my email actually uploaded anywhere?
No. There is no server here that accepts a file. The page's Content-Security-Policy sets connect-src to 'self', so the browser itself refuses any request to another origin, and form-action is 'none' so nothing can be submitted anywhere. The only network requests this site makes are for its own JavaScript, its own font files, and the Vercel page-view counter — which records that a page was viewed and nothing about what you opened. You can confirm all of it in your browser's network panel with the page open.
Why can't I load the remote images in a message?
Because turning them on would mean weakening the site's Content-Security-Policy for every page and every visitor, and a policy broad enough to fetch one sender's images is broad enough to fetch anyone's. Rather than offer a switch that quietly undoes the guarantee, this viewer lists every remote resource the message references — the full URL, the element that referenced it, and which of them look like open-trackers — so you can see what would have been fetched without fetching it. Download the original message and open it in a mail client if you need the images rendered.
Can this open an .eml safely if I think it is a phishing attempt?
That is the case it is built for. No script from the message can run: the preview frame is sandboxed without allow-scripts and without allow-same-origin, its document carries default-src 'none', the markup has been through DOMPurify with active elements forbidden, and the site-wide policy blocks off-origin requests regardless. Links are shown with their real destination and cannot be followed from inside the frame. The security panel calls out display names containing a different address, mixed-alphabet look-alike domains, executable attachments and double extensions.
Does it show the original headers?
All of them, in file order, unfolded, with the RFC 2047 decoding shown alongside the raw value. The Received chain is laid out oldest-first with the delay at each hop, and the raw source view gives you the bytes exactly as they are on disk.
Can I open a .msg or an .mbox here too?
Yes — drop any of the three and the right reader is used. The dedicated pages for Outlook .msg files and for mailboxes have copy specific to those formats, but the workspace is the same.
Related
- Open Outlook MSG files — Open .msg files from Outlook in your browser: body, HTML, recipients, dates, attachments and embedded messages, read from the real Compound File structure. Nothing is uploaded.
- Convert EML to PDF — Convert .eml email files to PDF without uploading them. Headers, body text, reply chains and a full attachment index with SHA-256 hashes, laid out on real pages — entirely in your browser.
- Analyse email headers — Paste or open an email and read its Received chain, SPF, DKIM and DMARC results, sender inconsistencies and external resources — analysed in your browser, never sent anywhere.