Paste a message or open an .eml file and press Inspect locally: headers, body, an isolated HTML preview and every MIME part — with Save for the decoded bytes — stay in the page, and nothing is uploaded.
Paste the source of a message into the box, or open an .eml file from disk, and press Inspect locally. The whole reading happens in the tab: nothing is uploaded and the page fetches nothing while it works. The result is split into the decoded headers, the plain-text body, a sandboxed HTML preview and a list of the MIME parts, so a message that mixes text, HTML and attachments can be read part by part.
Headers and bodies are decoded with the character set that each part declares: a subject sent as =?windows-1252?Q?Rechnung_=80_offen?= reads “Rechnung € offen”, a GB2312 body reads 后台任务已完成。, and UTF-8 keeps its accents. Parts are cut line by line at the MIME boundary instead of searching for that text anywhere in the body, so a line of dashes inside quoted text no longer ends the message early.
The character set comes from each part’s own Content-Type header, not from the page: windows-1252 (“Betrag: €12,50 – fällig am Montag.”), GB2312/GBK (后台任务已完成。), UTF-8 and an unknown label that falls back to a tolerant byte reading all come out as text. Encoded words in headers (RFC 2047) are decoded, and the space between two adjacent encoded words is dropped the way the standard requires, so “Deploy finished” is not spaced twice.
Structure is followed line by line: a multipart part is split only where a line is exactly --boundary (trailing spaces allowed), so a quoted reply containing ----b1---- keeps its text. A multipart header without a boundary parameter, a boundary="" that carries no value and a single-quoted boundary no longer lose the body — it is shown as text. A message forwarded as message/rfc822 is parsed as a message, its body appears in the text pane and the wrapper is listed in the attachment table; a message nested deeper than twelve levels is flattened to text instead of vanishing.
The preview keeps the message’s own markup and its <style> rules but removes whatever could load or run something else: script, iframe, object, embed, link, meta, base, form and form controls are deleted, on* handlers are dropped, and every URL attribute (src, href, poster, background and the rest) is pointed at an inert fragment unless it is a data: URL. srcset keeps only its inline candidates. That is what “external resources are disabled” means here: in a set of 25 tracking tricks — a plain pixel, a srcset, @import and url() inside a style block, an inline style — the patched preview made no request to the tracking host, where the version before it made four.
This is a filter for reading mail, not a malware scanner. It does not run scripts, does not fetch remote content, and cannot tell you whether a link in the message is safe to open.
The viewer decodes the message as it was written; it does not verify S/MIME or PGP signatures, does not decrypt protected messages, and does not repair a file that is not a message. Text parts are joined in the order they appear, so a message carrying several text/plain parts shows them one after another. Attachments are saved as bytes rather than opened, and there is no JSON export: the headers, the body, the preview and the part list are what the page produces.