Extract Email Attachments

An email is one file, and the attachments are inside it. They are not stored beside the message — they are written into the same text, encoded so that bytes which would confuse a mail server can travel through it. That encoding is base64, and it costs a third: a three-megabyte photo occupies four megabytes of the message.

Extracting is the decode, and nothing else. Each part is found, its declared encoding is undone, and the original bytes come back exactly as they were sent. No part of that requires opening the file, and nothing here does: a PDF is not rendered, an image is not decoded to pixels, an archive is not looked into. They are byte ranges that get written to your disk under the name the message gave them.

That distinction is the whole reason to do it here. The riskiest moment with a suspicious attachment is the moment something opens it, and every online tool that saves .eml attachments asks you to upload the message to a server first — which for an email means handing over the message as well as the file.

Names are read properly and then made safe. A filename in Arabic, Japanese or French is encoded across several header parameters and has to be reassembled before it makes sense; a name that arrives as %D9%85%D9%84… in another tool is that reassembly not happening. Path separators are then stripped, because a filename in an email is a string a stranger chose and it is about to become an entry in a zip.

Two files with the same name are both kept, with the second numbered. Phones name every photograph the same thing, so a message with four pictures in it routinely carries four parts called image.jpg — and a tool that keys them by name quietly saves one of the four.

Small images that the message displays inside itself — a signature logo, a header banner — are listed too, marked as inline. They are files in the message like any other, and leaving them out of the list would be deciding for you which of them you meant.

Press Load a sample. The message is an invoice with three parts worth saving, and the list shows what each one is before anything is written anywhere.

logo.png is 133 bytes and marked inline: it is the picture in the sender’s signature, and it travelled inside the message rather than being fetched from a server. invoice-1042.csv is 42 bytes of ordinary text. The third is called ملاحظات.txt — a name written across two header parameters in percent-encoded UTF-8, which is why an extractor that does not reassemble it produces something unreadable.

Press the button beside the CSV and it lands in your downloads folder as it was sent, 42 bytes, decoded from the 56 characters of base64 that carried it. Or press Download all 3 as .zip — the archive is built on your device too, by the same code that packages pages from a split PDF.

Before you open any of it, it is worth knowing where the message came from. The headers of this sample say the From line and the domain that actually passed the checks are two different domains, and the message itself carries a tracking pixel. An attachment on a message like that is not one to double-click.