Drop a raw .eml message here
A message exported from a mail client, or a raw message saved off a server.
Dropping again replaces what is on screen, so a failed file leaves nothing stale behind.
Read a raw .eml message without a mail client: the whole header block, both bodies and every attachment, downloadable. The file never leaves your browser.
The .eml file is opened here, on your machine. Its headers, its bodies and its attachments are parsed in the page and never sent anywhere — no upload, no account, no mail client.
Drop a raw .eml message here
A message exported from a mail client, or a raw message saved off a server.
Dropping again replaces what is on screen, so a failed file leaves nothing stale behind.
An .eml file is a mail message saved exactly as it travelled: the header block, then the MIME parts, in plain bytes. It is what a mail client exports, what a server hands over when you ask for the original, and what a colleague forwards when the question is not what the mail said but how it got there. Drop it here and it is taken apart in the page — every header, the sender, the recipients, the date, both the plain-text and the HTML body, and every attachment with a download button beside it.
The file never leaves this machine. A saved message names who wrote to you, who else was on it, which servers it passed through and what they attached, which is not something to hand to a stranger's server just to read it — so the message is parsed and the attachments rebuilt in your browser, and there is no upload endpoint to send the file to even by accident.
The HTML body is treated as what it is: markup written by whoever sent the message. It is drawn inside a sandboxed frame that cannot run a script, cannot reach this page, and by default cannot fetch anything over the network — so the tracking pixel that would tell the sender you opened the mail stays unfetched until you tick the box that allows it, and that box clears again the moment you open another file. Links are shown with their real target printed beside the text instead of being clickable, because in a message you did not expect, the target is the part worth reading.
The header block is kept whole rather than reduced to the six fields a mail client shows. Received chains, Authentication-Results, List-Unsubscribe, DKIM-Signature — all of it is listed as written, because that is usually the reason someone opens a raw message in the first place. When something in the file is damaged — a multipart that never closes, a base64 body with stray characters, a character set the browser cannot decode — the page says so in a line of its own instead of showing you a partial message as though it were the whole one.
Drop it on this page. The raw message is parsed in the browser and you get the headers, the sender, the recipients, the date, both bodies and the attachments — no mail client, no import, no account.
No. The browser reads the file off your own disk and does everything in the page. There is no server involved, and closing the tab leaves no copy behind.
Not unless you decide otherwise. Remote images — including one-pixel tracking images — are blocked by default: the HTML body runs under a policy that permits no network requests at all. The page tells you how many remote references it found, and loading them is one explicit checkbox that resets every time you open a new file.
No. The body is rendered in an iframe whose sandbox grants neither scripting nor same-origin access, so no script in the message executes, and nothing in the message can read this page. The plain-text body is shown first by default.
Yes. Every header line is listed as written, in file order, with duplicates kept — Received hops, Authentication-Results, DKIM-Signature, List-Unsubscribe and the rest. Folded lines are joined back into one, and encoded-words are decoded; nothing else is changed.
Both, and they are the same instant. Unlike an Outlook .msg, a raw message records the offset the sender's clock was on, so the page can show the sender's local reading and the UTC one side by side without guessing. Neither is taken from your own machine's zone.
Yes — each attachment has its own download button, and the bytes come straight out of the .eml you already have. Inline images referenced by the HTML body are listed too, marked with the cid: the body uses. Nothing is fetched, and nothing is sent.
Because the name inside the message is written by the sender and can contain directory separators, .. segments, control characters or the invisible marks used to make invoice.exe read as invoice.txt. Those are stripped before the name reaches your download folder, and the page shows you the cleaned name whenever it differs.
It says so specifically. A file with no header block at all, a multipart that never reaches its closing boundary, a base64 body with stray characters, a character set the browser cannot decode — each gets its own line, and the parts that did parse are still shown rather than thrown away with the rest.
Open an Outlook .msg file without Outlook, attachments included.
Open an .ics calendar file: events, a month view and a CSV export.
Identify a file by its bytes when the extension is wrong or missing.