EML Viewer
Open a saved EML email as text, inspect headers and export attachments with a SHA-256 inventory.
This tool processes its input contents in your browser instead of sending them to a processing service. Page, asset and fixed usage-measurement requests are described on the Privacy page.
Open one saved EML email locally as text, inspect its unverified headers and explicitly download attachments with an inventory of safe saved names, sizes and SHA-256 digests.
How to use it
- 1Choose one nonempty .eml message up to 10 MiB and select Read email.
- 2Review its text, headers and attachment inventory; HTML is never rendered and attached messages stay opaque.
- 3Download the body, inventory, selected attachment or a flat attachment ZIP with its manifest.
Example
- Input
- example.eml · From: Maya <maya@example.test> · Subject: Project notes · notes.txt contains the five bytes hello
- Output
- Plain-text message plus one 5-byte attachment, saved as notes.txt. SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.
Load example, then Read email to reproduce it. The example is not counted as a completed real-file task.
What happens to your data
The selected EML's bytes, header values, message text, attachment names and attachment bytes remain in browser memory. HTML email is not rendered, and remote email images are not loaded. Downloads are created locally. Fixed usage events exclude email contents, headers, filenames and raw parser errors; ordinary page and software-asset requests still use the network.
Last updated November 2026
Read one saved EML email without connecting a mailbox or uploading its contents. Inspect the sender-supplied headers, read its plain-text body and review the attachment inventory. Download an individual attachment, the text body, an inventory JSON or a flat ZIP containing every attachment plus its SHA-256 manifest. Images, links, scripts and attachments never open automatically.
How it works
Choose one nonempty .eml file up to 10 MiB, then select Read email. EML is a saved Internet email message containing RFC 5322 headers and, commonly, MIME body parts. Outlook MSG and multi-message MBOX files are different formats and are not supported. Parsing runs in a cancellable local Web Worker with a 15-second execution limit. Changing the selection, loading the example or clearing the page invalidates the old result, including a ZIP still being prepared.
The parser accepts at most 128 MIME parts, 16 nesting levels and a 128 KiB aggregate parser-header budget. Its budget includes a minimum charge for each header line, so a file can reach the limit even when the literal header bytes look smaller. Toolvore additionally rejects more than 500 top-level headers, 50 attachments, a body above 2,000,000 characters or decoded bodies and attachments above 16 MiB combined. An exceeded limit fails the entire view rather than returning an apparently complete partial inventory. Attached message/rfc822 messages remain opaque attachments and are not recursively opened. Browser memory can still exceed the source file size while decoding; the limits are practical safeguards rather than a universal memory guarantee.
The plain-text MIME body is shown when available. If there is only HTML, an inert parser tree projects its text without creating a browser document; scripts, styles, forms, frames and embedded objects are omitted. This is a text projection, not the email's visual appearance: CSS visibility, layout and images are not evaluated. The optional HTML-source view remains escaped text inside a read-only text box. HTML is never rendered, remote resources are not fetched and clickable links are not created from email content.
Attachment filenames are normalized, stripped of path separators, control characters, reserved device names and problematic punctuation, then made collision-safe without directories. The inventory retains the original name alongside the saved name, MIME type claimed by the email, byte count and SHA-256 digest. The ZIP uses those flat saved names and includes manifest.json; a conflicting attachment name receives a suffix. File bytes are preserved. Header values and MIME types are sender-supplied claims, not proof of sender identity or content safety. No DKIM, S/MIME, PGP or malware verification is performed. Downloaded attachments can be dangerous; review and scan them before opening.
File bytes, email text, headers, attachment names and selected filenames stay in browser memory; neither tool posts them to a server. Normal page and usage measurement described on Privacy can record a fixed tool action, success, failure code or download action. Those events exclude file contents, filenames, email addresses and checksums. Downloads are created only after an explicit click. Clear removes the current input and result from this page; it cannot remove a file already downloaded to your device.
Worked example: Read the sample message and verify its attachment
- Input
- example.eml · From: Maya <maya@example.test> · Subject: Project notes · notes.txt contains the five bytes hello
- Result
- Plain-text message plus one 5-byte attachment, saved as notes.txt. SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824.
Load example, then Read email to reproduce it. The example is not counted as a completed real-file task.
Common use cases
- Reading an exported support email without granting mailbox access
- Reviewing all headers and duplicate header fields in a saved message
- Recovering attachments while retaining an inventory of their original and saved names
- Comparing a downloaded attachment's digest with a separately trusted expected value
Frequently asked questions
Do I need Outlook or a mailbox sign-in?＋
No. Choose a local .eml file already saved on your device. The viewer does not connect to Gmail, Outlook or any mailbox. MSG and MBOX are not EML and are not supported.
Why does an HTML email look like plain text?＋
Toolvore deliberately does not render email HTML. When there is no plain-text part, it projects text from an inert parser tree. Layout, remote pictures, styles and CSS visibility are not reproduced; you can inspect the escaped original HTML source separately.
Does the From field prove who sent the message?＋
No. From, To, Date, Message-ID and other displayed headers are claims contained in the file. This viewer does not authenticate senders or verify DKIM, S/MIME or PGP signatures.
Are downloaded attachments guaranteed safe?＋
No. Attachments retain their original bytes and can contain harmful content. The tool makes download filenames safer and computes digests; it is not antivirus. Do not open an attachment until you trust and have checked it.
What happens to a nested email attachment?＋
A message/rfc822 attachment stays an opaque downloadable email file. Its body and own attachments are not recursively merged into this message's inventory, so the inventory explicitly describes only the outer message's parsed attachments.
Why can a small email be rejected?＋
A file may exceed the header, MIME-part, nesting, attachment-count or decoded-body limits before reaching the 10 MiB source limit. The parser fails as a whole rather than presenting incomplete output.
Related tools
File Hash Checker
Hash multiple files locally, verify expected digests and export SHA manifests, SRI values or JSON reports.
ZIP Creator
Create a ZIP locally with editable archive paths, Store or Deflate compression, and exact file bytes.
Text Encoding Converter
Decode supported text encodings and save UTF-8 or UTF-16 with strict byte checks and BOM options.
HTTP Header Inspector & Compare
Compare pasted headers and check CORS origins, credentials and preflights without fetching a URL.