How to open a .msg file without Outlook, and without uploading it

Drop the .msg onto SATCHEL. It reads the file in your browser tab and shows the email with its sender, recipients, dates, formatted body and attachments, each attachment savable. Save it as an .eml and Apple Mail, Thunderbird and Outlook will all open it. Nothing is uploaded, so it is fine for an email you would not forward to a stranger.

Where .msg files come from

Outlook writes a .msg whenever an email leaves it as a file: dragged from the inbox onto the desktop, saved with Save As, or attached to another email as an item rather than forwarded. That last one is the common case. Someone forwards you "the email from the landlord" as an attachment, and what arrives is RE_ Deposit.msg.

Law firms, HR departments and anyone doing disclosure produce them in bulk, because a .msg keeps the message exactly as Outlook stored it: every property, every attachment, and often the internet headers it arrived with.

Why only Outlook opens one

A .msg is not text. Open one in a text editor and you get mostly unreadable bytes, because it is a small file system: the same compound file format as an old Word .doc, with the message's properties stored as separate streams inside it. The subject is one stream, the sender another, the plain-text body another, the formatted body another, each recipient a folder of streams, each attachment a folder of streams, and an attached email a whole second message nested inside the first.

Microsoft publishes the format, but reading it properly takes three layers of work, and each one can be wrong without showing an error:

• The container. Streams are stored in sectors chained through an allocation table, with small streams in a separate mini-stream of their own. Getting a chain wrong gives you a different stream's bytes, not an error.
• The properties. Each value is typed. Older messages store text in the message's own Windows code page, and the code page is itself one of the properties. Read a Polish or Russian email as if it were Western European and every accented letter comes out as the wrong character. SATCHEL reads the code page first and decodes the text with it.
• The body. The formatted body is often stored as compressed rich text, and that rich text is very often a wrapper Outlook put around an ordinary HTML email. Decompressing it and taking the wrapper off gives back the original HTML. Skipping that step gives you the plain-text fallback, or nothing.

Reading one in a browser tab

1. Open SATCHEL and drop the .msg on the page, or choose it.
2. The email appears with its header lines and body. Pictures that were sent inside it are shown; pictures that live on a server are not fetched, because loading them tells the sender the email was opened.
3. Attachments are listed below it. Save any of them, or Save every attachment. An attached email opens in place, and Back takes you to the message that contained it.
4. To keep the whole thing in your own mail program, choose Save it as an .eml. The .eml carries the body and every attachment. When the .msg kept the internet headers it arrived with, the .eml keeps them too, so you can still check where it really came from.

To print it or keep it as a PDF, open the .eml in your mail program and print from there, or use the browser's print to PDF on the message view.

The internet headers, and why they matter

A received email carries a block of header lines recording every server it passed through, and whether it passed SPF, DKIM and DMARC checks. Outlook keeps that block as a property of the message, and a .msg saved from a received email usually has it. A .msg saved from Sent Items or Drafts never went over the internet and has none.

If you are being asked whether an email is genuine, the headers are the evidence. Copy them from SATCHEL and paste them into HEADERPROOF to see the route and the authentication results, or open the saved .eml in MAILBOX.

Why not a converter website

Look at what a .msg holds before you upload one: the full text, every attachment, every name and address on it, and the headers that record the internal servers and IP addresses it passed through. A converter site receives all of that, keeps it for as long as its own policy says, and you have no way to check. For an HR complaint, a disclosure bundle or a client's contract, that alone can be a breach. What a website keeps when you hand it a file goes through it in detail.

What to check before opening an attachment

A .msg is a common way to pass on a phishing email as evidence, which means some of the .msg files people need to open contain exactly what they were warned about. SATCHEL does not run anything in the email. It warns on attachments that run code when opened, such as .exe, .js, .lnk or a macro-enabled Office file, and on a program whose name has been dressed up as a document, like invoice.pdf.exe. For a link you are unsure of, PHISHLENS reads it without visiting it.