EML Viewer and MIME Email Decoder

How to view an email’s source

1. Get the raw message from your mail client (see the table below) and paste it, or drop the .eml or .mht file on the page.
2. The summary shows From, To, Cc, Subject, Date and Message-ID, decoded. All headers lists every header with its decoded and raw value.
3. Read the Message body as plain text or HTML. HTML is shown in a sandbox.
4. Attachments lists each file with name, type, size and content ID, a Download button and a preview for images.
5. MIME structure shows how the parts nest, which helps when an attachment seems to be missing.

What the decoder handles

• Encoded headers: RFC 2047 words in Base64 (B) and quoted-printable (Q), adjacent words merged, any charset the browser knows, plus raw UTF-8 headers.
• Attachment names in RFC 2231 form, such as filename*=UTF-8''Rechnung%20M%C3%A4rz.pdf and split filename*0*= continuations.
• Bodies in base64 and quoted-printable, decoded with the declared charset. f=C3=BCr becomes für.
• Nested messages: a forwarded email attached as message/rfc822 is walked like the outer one.
• Inline images: cid: references in the HTML are resolved to the attached images.
• Partial input: a lone Base64 MIME part, a whole message that was Base64-encoded, or a multipart body that starts at --boundary without headers.

A message that was Base64-encoded as a whole usually starts with UmV0dXJuLVBhdGg6 (Return-Path:) or UmVjZWl2ZWQ6 (Received:). Paste it as is; the decoder unwraps it first.

Checking a suspicious message

The headers say more about a phishing attempt than the body does. Things to compare in All headers:

• From against Return-Path and Reply-To. A reply address on a different domain is a classic sign.
• Authentication-Results, added by the receiving server: spf=, dkim= and dmarc= with pass or fail.
• Received lines, read bottom to top, show the path from the sending server to yours.
• Attachment types: a .html, .iso or .zip attachment from an unknown sender deserves suspicion, and so does a double extension like invoice.pdf.html.

Because remote content is blocked, viewing the HTML body here does not load tracking pixels or confirm that your address is read. The page CSS is dropped as well, so newsletters look plainer than in a mail client.

Extracting attachments in Python

from email import policy
from email.parser import BytesParser

with open("message.eml", "rb") as f:
    msg = BytesParser(policy=policy.default).parse(f)

print(msg["Subject"])
for part in msg.iter_attachments():
    name = part.get_filename()
    with open(name, "wb") as out:
        out.write(part.get_payload(decode=True))
    print("saved", name)

policy.default decodes encoded-word headers, so msg["Subject"] is already readable. In real use, sanitise name before writing, since it comes from the sender. More on how attachments are encoded is in Base64 in email, and the MIME Base64 encoder produces the 76-column format.

Known limits

• Outlook .msg files are not supported. A winmail.dat (TNEF) part is listed as an attachment but not unpacked.
• Links inside the HTML body do nothing, by design.
• Messages with an extreme number of MIME parts are cut off with a notice.

FAQ