Parse a .eml file: headers, Received chain, links, attachment hashes, sender mismatches.
New
Email Header Parser
Runs locally
Use Email Header Parser
What it does
Paste the raw headers of a suspicious message to see From, To, Date and Subject, every Received hop in order, and a table of all headers including Reply-To, Return-Path and Authentication-Results.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Spoofed bank notice
Return-Path: <bounce@mailer.example.net>
Received: from mail.example.net (mail.example.net [203.0.113.25])
by mx.example.com with ESMTPS id 4Xk2Lm; Mon, 19 Oct 2026 09:14:07 +0000
Received: from [198.51.100.10] (unknown [198.51.100.10])
by mail.example.net with ESMTPSA id 77QaZ1; Mon, 19 Oct 2026 09:14:05 +0000
Authentication-Results: mx.example.com; spf=pass smtp.mailfrom=mailer.example.net; dkim=none; dmarc=fail (p=reject) header.from=example.org
From: "Example Bank Security" <security@example.org>
Reply-To: <help-desk@example.net>
To: <alice@example.com>
Subject: Action required: verify your account
Date: Mon, 19 Oct 2026 09:14:03 +0000
Message-ID: <20261019091403.1234@mail.example.net>Return-Path: <bounce@mailer.example.net>
Received: from mail.example.net (mail.example.net [203.0.113.25])
by mx.example.com with ESMTPS id 4Xk2Lm; Mon, 19 Oct 2026 09:14:07 +0000
Received: from [198.51.100.10] (unknown [198.51.100.10])
by mail.example.net with ESMTPSA id 77QaZ1; Mon, 19 Oct 2026 09:14:05 +0000
Authentication-Results: mx.example.com; spf=pass smtp.mailfrom=mailer.example.net; dkim=none; dmarc=fail (p=reject) header.from=example.org
From: "Example Bank Security" <security@example.org>
Reply-To: <help-desk@example.net>
To: <alice@example.com>
Subject: Action required: verify your account
Date: Mon, 19 Oct 2026 09:14:03 +0000
Message-ID: <20261019091403.1234@mail.example.net>The top fields show the From display name and address, then two Received hops (Hop 1 is the server that received the message last). The table of all 10 headers shows a Reply-To on another domain and dmarc=fail, two signs of a spoofed sender.
FAQ
How do I read the Received hops?
Hop 1 is the topmost Received header, added by the last server that handled the message; the bottom hop is closest to the sender. Only hops added by your own mail provider can be trusted, because a sender can forge any Received lines below them.
Does it check SPF, DKIM or DMARC?
No. It lists Authentication-Results, Received-SPF and DKIM-Signature as the receiving server wrote them, without verifying anything, decoding =?UTF-8?B?...?= subjects or reading the body, and it shortens long values (hops to 200 characters, table cells to 300). For a full .eml file, use EML Analyzer.
Are the headers uploaded?
No. Parsing happens in your browser and nothing is sent anywhere. Headers can contain personal addresses and internal IPs, so remove those before you share them.