Microsoft made a small change with a large blast radius. The new Outlook, the one that ships with Windows and replaces the old desktop client, will not open a saved .msg file unless you have an active Microsoft 365 subscription. People who had archived years of correspondence as individual files discovered that their own emails had become unreadable on their own computer.
MSGView exists for that moment. Drop the file into the page and the email opens: subject, sender, recipients, date, the formatted body, and every attachment listed and downloadable. From there it converts to PDF, HTML, EML or plain text. There is no account, no upload and no limit on how many files you open.
It also handles the file that support desks dread. When an Outlook sender uses the old Rich Text format, non-Outlook recipients receive a mysterious winmail.dat attachment with the real attachments trapped inside it. MSGView unpacks it and hands the original files back.
The file never leaves the device
Almost every other "open your .msg online" tool works by uploading. You hand a stranger's server an email that may contain a contract, a medical result or a client's personal data, and then you trust a privacy policy about what happens next.
MSGView never receives the file, because there is nowhere for it to arrive. The parser is JavaScript running in the browser tab. The page is static files behind a web server that has no endpoint capable of accepting an upload. That is not a promise about conduct — it is a property of the architecture, and it is the reason the product can be handed to someone in a regulated industry without a conversation about data processing.
A useful side effect: it works with the network unplugged, and it works on files far larger than most upload limits would allow.
What is actually inside a .msg file
A .msg is not an email in the format email is normally written in. It is an OLE2 Compound File — a small filesystem inside a single file, the same container Microsoft used for old Word and Excel documents — holding a tree of MAPI properties. Reading one means implementing that container, then decoding the property streams, then reassembling a message from them.
The formatted body is often stored as compressed RTF using an LZ variant specific to Microsoft, sometimes with the real HTML smuggled inside the RTF. Attachments can be nested: an email inside an email inside a TNEF blob. Each of those layers is a place to get it wrong quietly.
The engine, @msgview/core, implements all of it in plain isomorphic JavaScript with zero runtime dependencies. That was a deliberate constraint after a security review: a file parser fed hostile input by strangers is exactly the wrong place to inherit a supply chain, and it means the whole test suite runs offline on nothing but Node's built-in test runner.
- MS-CFB / OLE2 compound file reader, plus a writer used to build test fixtures
- MAPI property parsing, compressed RTF (LZFu) and HTML-in-RTF extraction
- TNEF (
winmail.dat) unpacking, including nested attachments - RFC 5322 / MIME parsing for
.eml, sharing the header and encoding decoders - An allowlist HTML sanitiser that strips scripts, trackers and remote images before anything renders
Rendering a stranger's email safely
An email body is untrusted HTML written by someone you have never met, and it is about to be rendered in a browser. Left alone it can run scripts, and it will certainly load remote images — which is how senders learn that you opened the message, and when, and roughly where you were.
The sanitiser works from an allowlist rather than a blocklist. Anything not explicitly permitted does not survive, so a tag or attribute nobody thought of is removed by default instead of being missed. Remote images are blocked outright: the message renders, the tracking pixel does not fire.
How people find it
Nobody searches for "MSGView". They search for what broke — new outlook won't open msg, convert msg to pdf, what is winmail.dat — usually in their own language, usually in a hurry.
So the product is surrounded by one page per real question, in thirteen languages, each answering the question completely rather than teasing the tool. The page a person lands on is the answer, and the tool happens to be on it. That is the entire acquisition channel: no ads, no outreach, no social presence.
At a glance
- Live at
- msgview.app
- Formats read
- .msg · .eml · winmail.dat (TNEF)
- Converts to
- PDF · HTML · EML · plain text · extracted attachments
- Engine
@msgview/core— isomorphic JavaScript, zero runtime dependencies- Runs in
- The browser tab. Nothing is uploaded; there is no endpoint that could receive it.
- Languages
- 13
- Price
- Free and unlimited
- Also exists
- A Tauri desktop build sharing the same engine
Questions people actually ask
Is the email uploaded anywhere?
No. The parser runs in the browser tab and the site is static files with no upload endpoint at all. You can disconnect from the network and it still works.
Why will the new Outlook not open my .msg file?
The new Outlook treats opening a saved .msg as a licensed feature and asks for an active Microsoft 365 subscription. The file is not damaged and nothing is wrong with your computer — the application is simply declining to read it.
What is winmail.dat and can I get my attachment back?
It is what non-Outlook mail clients receive when an Outlook sender uses Rich Text format: the real attachments are packed inside it in Microsoft's TNEF format. MSGView unpacks it and gives the original files back.
Is there a limit on file size or number of files?
No account, no daily limit, and no upload size ceiling to hit, because nothing is uploaded. The practical limit is what the browser tab can hold in memory.
PubOpener
SignalOps
ZALUPA Clicker