Inspect the file.
Not the sender.

What this does

Opens a raw .eml file in a bounded parser worker, lists its top-level headers in parser order, exposes selected invisible characters, and groups attachments whose decoded bytes match. It never displays email HTML, opens URLs, previews attachments or extracts them. Decoded text may be generated from HTML by the parser. It is not an exact MIME-part, byte-preserving or original-source view.

Not a mail client, Outlook .msg viewer, mailbox importer, forensic certification, spam/phishing detector, malware scanner, MIME validator or identity/authentication check. From, Reply-To, SPF, DKIM, Authentication-Results, filenames, dates and MIME types are unverified file claims. Repeated headers are inventory, not a verdict: repetition is normal for some headers. The parser already preserves repeated headers; our UI makes them visible rather than changing parser semantics.

Controls and text

Unfolded header values and MIME encoded-word decoded values are shown separately. Decoding an address header does not validate or parse its mailbox. Unicode format characters (Cf), C0/C1 controls (Cc), and U+2028/U+2029 are escaped as literal \u{XXXX} labels. Backslashes are doubled so an actual escape-looking string remains different. Body tabs and newlines are preserved for reading. Control indices use zero-based Unicode codepoint positions, not UTF-16 offsets. Ordinary Arabic/Hebrew and other scripts remain text; this is not a confusable-character or all-invisible-character detector. Controls can have legitimate uses. No inference about intent is made. Body display is limited to the first 60,000 UTF-16 code units; the JSON report keeps the full decoded text.

What the hashes mean

Whole input SHA-256 covers the selected input bytes. Attachment SHA-256 covers parser-decoded bytes, including transfer decoding, not encoded transport text. Matching groups additionally compare every decoded byte, not just the hash or name. Empty attachments can match. A hash is not a signature, proof of origin, safety check or malware verdict. MIME calendar parts may be normalized by the parser into UTF-8/LF; matching then describes that normalized output. Attached messages remain opaque attachments and their inner parts are not inventoried.

Bounds and omissions

Nonempty input up to 4 MiB, 128 MIME parts, MIME depth 16, 128 KiB cumulative parser header budget, and an 8-second worker timeout. The parser counts each header line as at least 64 bytes, so the header limit is a resource budget rather than just wire size. Files outside bounds are refused, not partially certified. A MIME parser can recover imperfect messages; success is not proof of standards compliance or completeness. Encrypted bodies are not decrypted, signatures are not verified, archives are not unpacked and nested mail is not opened.

Privacy

Parsing, hashing and byte comparison run in this page. Tested flows request only same-origin static code and the synthetic example; no upload, external image, analytics or account service is configured. No cookies or persistent mail storage are used. Hosting logs, browser extensions, OS file history and downloaded reports are outside this claim. Clear terminates the active worker and drops app references; it is not secure-memory erasure. Reports retain mail text, header values, identifiers and hashes. They are not sanitized, anonymous or private to an intended recipient. Review before sharing.

Source and licences

Uses PostalMime 4.2.1, revision 31df8366b05b740ab71d726227472ca114473496, by Andris Reinman. Full original MIT-0 licence. Parser semantics unchanged; TypeScript source is bundled as browser ESM with esbuild 0.25.0. Upstream browser example already reads EML locally, displays headers and renders HTML/attachments. This adaptation replaces that viewer with text-only control/header/byte-group inspection and bounded worker execution; privacy alone is not a novelty claim.

New Chawso UI, worker, inventory, byte comparison and report code uses scoped MIT terms. Notices · Download source · Chawso Credits. Unicode control behavior: Unicode Bidirectional Algorithm. Revised November 13, 2026.