Drop an Outlook .msg file here
A message saved or dragged out of Outlook — or click to browse.
Dropping again replaces what is on screen, so a failed file leaves nothing stale behind.
Read a .msg file someone sent you without installing Outlook: the header, both bodies and every attachment, downloadable. The file never leaves your browser.
The .msg file is opened here, on your machine. Its header, its body and its attachments are parsed in the page and never sent anywhere — no upload, no account, no Outlook.
Drop an Outlook .msg file here
A message saved or dragged out of Outlook — or click to browse.
Dropping again replaces what is on screen, so a failed file leaves nothing stale behind.
A .msg file is what Outlook writes when a message is dragged onto the desktop or saved from a mailbox, and it is the one attachment that opens on almost nothing else: no Outlook, no preview, just an icon that refuses. Drop it here and it is taken apart in the page — sender, recipients, the date it was sent, the subject, both the plain-text and the HTML body, and every attachment with a download button beside it.
The file never leaves this machine. A saved message names who wrote to you, who else was on it and what they attached, which is not something to hand to a stranger's server just to read it — so the container is opened, the properties decoded and the attachments rebuilt in your browser, and there is no upload endpoint to send the file to even by accident.
The HTML body is treated as what it is: markup written by whoever sent the message. It is drawn inside a sandboxed frame that cannot run a script, cannot reach this page, and by default cannot fetch anything over the network — so the tracking pixel that would tell the sender you opened the mail stays unfetched until you tick the box that allows it. Links are shown with their real target printed beside the text instead of being clickable, because in a message you did not expect, the target is the part worth reading.
Underneath is a CFB container: a little filesystem of storages and streams, with the message's MAPI properties written into it. That structure is parsed byte by byte against MS-CFB and MS-OXMSG rather than guessed at, and when something in the file is damaged — a truncated stream, a sector chain that loops, a code page the browser cannot decode — the page says so in a line of its own instead of showing you a partial message as though it were the whole one.
Drop it on this page. The .msg container is parsed in the browser and you get the sender, the recipients, the date, the subject, the body and the attachments — no Outlook, no import into a mail client, no account.
No. The browser reads the file off your own disk and does everything in the page. There is no server involved, and closing the tab leaves no copy behind.
Not unless you decide otherwise. Remote images — including one-pixel tracking images — are blocked by default: the HTML body runs under a policy that permits no network requests at all. The page tells you how many remote references it found, and loading them is one explicit checkbox that resets every time you open a new file.
No. The body is rendered in an iframe whose sandbox grants neither scripting nor same-origin access, so no script in the message executes, and nothing in the message can read this page. The plain-text body is shown first by default.
Yes — each attachment has its own download button, and the bytes come straight out of the .msg you already have. Nothing is fetched, and nothing is sent.
Because the name inside the file is written by the sender and can contain directory separators, .. segments, control characters or the invisible marks used to make invoice.exe read as invoice.txt. Those are stripped before the name reaches your download folder, and the page shows you the cleaned name whenever it differs.
Because that is how the message stores them. Outlook records a UTC FILETIME, and shifting it into whichever zone your machine happens to be set to is how a message ends up looking like it was sent tomorrow. The value is shown as recorded, labelled UTC.
It says so specifically. A file that is not a Compound File Binary container at all, a stream shorter than its declared length, a sector chain that loops, a code page the browser cannot decode — each gets its own line, and the parts that did parse are still shown rather than thrown away with the rest.
Open an .ics calendar file: events, a month view and a CSV export.
Turn a .vcf contact export into a CSV Excel opens cleanly.
Identify a file by its bytes when the extension is wrong or missing.