Skip to content
AZ Tools

EML File Viewer

Drop an .eml file and read the parsed message — key headers, plain-text and HTML body parts, and a list of attachments — all in the browser.

How to use

  1. Drop an .eml file or paste raw message source (everything from Received: down to the closing boundary).
  2. Pick a body part — typically text/plain for safe reading, text/html to see the marketing version.
  3. Attachments are listed but not extracted — for safety; copy the filename or use your mail client to save them.

About this tool

Show

Parses raw RFC 5322 / MIME mail (the .eml exports your client makes) without sending a byte to a server. It unfolds wrapped headers, splits multipart bodies on the declared boundary, decodes Quoted-Printable and Base64 transfer encodings, and lists attachments with their original filenames, MIME types and encoded sizes. Switch between plain-text and HTML parts when a message has both, and toggle raw mode to see exactly what's on the wire.

A MIME message is a tree rather than a document, and the viewer shows it as one. multipart/alternative holds the same content twice and the client is supposed to display the last part it understands, which is why the HTML version is usually what you saw in your mail app even though the plain-text one is listed first. multipart/mixed holds genuinely different parts, and multipart/related holds a body plus the images it references by Content-ID. A message can nest all three.

Attachment sizes are reported as encoded, which is what the file actually contains. Base64 inflates by roughly a third, so a 4 MB attachment occupies about 5.3 MB of the message, and a mailbox quota counts the larger figure. A filename is also just a header value: it can carry a different extension from the part's declared MIME type, and the two disagreeing is worth noticing rather than resolving.

What the parse cannot tell you is whether any of it is true. Every header, From included, is text the sender wrote, and the only parts with a cryptographic basis are a DKIM signature or the verdicts your own inbound server added. Reading a suspicious message here is safe because nothing is executed or fetched, but the content is still a claim.

Everything runs locally on the file you open, which is the point when the message is one you would not upload to a third-party parser.

Frequently asked questions

Why isn't the HTML body rendered as HTML?

Rendering arbitrary mail HTML in the browser is a security trap — tracking pixels, exfiltration via remote loads, even script if the parser slips. We show HTML source as text. Switch to plain part for reading.

Are attachments decoded?

No. They're listed (filename, MIME, encoded size) but not Base64-decoded into Blob downloads — this keeps the tool safe to drop random mail onto. Use your mail client for actual extraction.

The message looks different here than in my mail client. Why?

Because a client renders one chosen part of the message, and usually the HTML one, after applying its own rules: it blocks remote images, rewrites links, strips scripts and styles, and may collapse quoted history. This viewer shows the parts as they exist in the file, so the plain-text alternative and the HTML source can differ from each other and from what you remember seeing.

Can I trust the From line to say who sent it?

No. The From header is written by whoever composed the message, and nothing in the file itself proves it. Authentication happens at delivery time and is recorded by the receiving server in Authentication-Results, so that header — not From — is what tells you whether SPF, DKIM and DMARC passed. An .eml exported from a mailbox usually still carries it.

Related tools