1.2 KiB
Privacy and security
Messages are read through browser file APIs or pasted text and kept only in memory. There is no storage, telemetry, analytics, remote-resource request or server integration. Closing/reloading the page clears the workbench.
Limits reduce accidental resource exhaustion but do not make Mail Tools a
forensic parser. HTML loses links, styling and external embedded resources by
design; only bounded safe image parts referenced by cid: can be embedded.
Downloaded attachments remain untrusted. Authentication results and Received
headers are self-asserted text.
The optional DKIM lab performs local cryptographic verification against a DNS TXT value pasted by the user. It never resolves DNS, so a passing result means only that the message bytes match that supplied key. It does not prove that the key is current, authoritative or obtained securely, and it does not turn other authentication headers into verified evidence.
Focused redaction removes a fixed set of top-level transport/authentication
headers. It does not rewrite nested message/rfc822 content and can leave names,
addresses, message IDs, MIME metadata, tracking tokens, body content, document
metadata and attachments. Review outputs independently.