Open Outlook .msg Files
Read a .msg without Outlook installed. Message, headers and attachments — all in your browser, nothing uploaded.
Your files stay safe — processed entirely in your browser. Nothing is uploaded.
Drop a .msg file here
or click to select a file
Outlook message files (.msg). Nothing is uploaded.
How this MSG viewer works
A .msg is not an email file in the usual sense. It is a compound file — a small FAT filesystem inside a single file — and the message is spread across streams named after the MAPI property each one holds.
That container is the same one .doc, .xls and .ppt use, which is why all four share a single signature and have to be told apart by what is stored inside them.
- Reading the container
- The reader walks the CFB structures directly: the header, the FAT and its DIFAT continuation, the directory tree, and the mini FAT. No library sits in between, so nothing has to be uploaded for a server to do it.
- The mini stream matters
- Streams under 4096 bytes are packed into 64-byte mini sectors carved out of one ordinary stream. Almost every MAPI property in a message is that small, so a reader that skips the mini FAT reads essentially nothing. Both paths are covered and both are tested.
- Property streams
- Each property is a stream called __substg1.0_ followed by the property id and type in hex — 0037001F is the subject as Unicode, 0037001E the same subject in the message code page. Fixed-length values such as timestamps are packed into __properties_version1.0 instead.
- Filename resolution
- Attachment names come from PidTagAttachLongFilename (0x3707), then PidTagAttachFilename (0x3704), then PidTagDisplayName (0x3001). Reading only the short name is what produces 8.3 mojibake for Japanese filenames — the same trap as in winmail.dat, and handled the same way here.
- HTML safety
- PR_HTML is binary and follows the message code page rather than being Unicode like the other text. Once decoded it is sanitized with DOMPurify against an explicit allowlist and rendered inside a sandboxed iframe.
Where it stops
Messages embedded inside other messages are listed but not opened as messages. RTF-compressed bodies (PR_RTF_COMPRESSED) are not decompressed — if a message has only an RTF body and no plain-text or HTML version, the body will be empty. Encrypted or signed S/MIME content is not decrypted.