Mail Tools is a local-first browser workbench for inspecting .eml, MIME and mbox files. It unfolds headers, decodes RFC 2047 words, builds a bounded multipart tree, threads mailbox messages, inventories attachments, compares text bodies, and creates canonical or focused redacted exports. File imports are parsed from their original octets, retain exact source byte ranges for raw MIME entities, and assemble RFC 2231 continued parameters.

HTML bodies are sanitized and displayed only in an opaque sandbox with an embedded default-src 'none' policy. Remote images, links, forms, scripts, styles, media, frames and active documents are removed. Referenced CID images of a small safe type can be embedded from the same message. No message, address, attachment, URL or telemetry leaves the browser.

Development and release

Requires Node.js 22+ and npm 11+.

npm ci
npm run check
npm run test:browser
npm run release:artifact

The last command creates deterministic release/mail-tools-0.2.0.zip and its SHA-256 sidecar. The app uses relative assets and is tested beneath /deep/nested/mail/. It can run standalone or from add·ideas Toolbox.

v0.1 boundary

source limit: 8 MiB; at most 2,000 headers, 500 MIME parts, nesting depth 20, and a conservative 16 MiB decoded-data budget;
folded headers, duplicate fields, RFC 2047 B/Q words, and RFC 2231 parameter continuations;
multipart and nested message/rfc822, Base64 and quoted-printable;
bounded mbox/mboxrd import and local Message-ID/References threading;
safe text previews, sanitized HTML with local CID images, attachment inventory/download;
address/date and SPF/DKIM/DMARC/ARC claim diagnostics;
RFC 6376 simple/relaxed RSA-SHA256 and RFC 8463 Ed25519-SHA256 DKIM verification against a public-key TXT record pasted by the user;
bounded line comparison and normalized EML plus top-level header redaction with a JSON report.

This is not a mail client, spam detector, forensic verifier or anonymity tool. It does not contact mail or DNS servers, decrypt S/MIME/OpenPGP, establish sender identity, scan malware, open maildir/PST/OST containers, or guarantee that the deliberately normalized canonical export is byte-identical. DKIM verification proves only that the preserved bytes match the pasted key record; the tool cannot establish whether that record is authentic or current. The untouched source octets remain available for inspection. See docs/PRIVACY-SECURITY.md.

Licensed under GPL-3.0-or-later.