EML Viewer ProView Open any Rendering is tuned for Outlook-generated HTML, which is where most viewers fall down: MSO conditional comments, VML graphics, inline CID-referenced images, and deeply nested table layouts are handled rather than mangled. What is a
|
| Command | What it does |
|---|---|
EML Viewer: Open MIME Tree |
Opens a text outline of the MIME structure in a new tab. |
EML Viewer: Extract HTML |
Opens the raw HTML body in a new tab. |
EML Viewer: Extract Text |
Opens the plain-text body in a new tab. |
EML Viewer: Validate Email |
Runs diagnostics and summarises errors and warnings. |
EML Viewer: Export HTML |
Saves a portable HTML file with relative attachments/ paths. |
EML Viewer: Export Attachments |
Saves every attachment to a folder you choose. |
EML Viewer: Export Complete Package |
Writes <name>-package/ containing email.html, attachments/, and metadata.json. |
EML Viewer: Toggle Dark Mode |
Toggles the Outlook dark-mode simulation. This is not a VS Code theme toggle. |
Settings
| Setting | Default | Description |
|---|---|---|
emlInspector.privacy.loadRemoteImages |
false |
Load remote images automatically for every message. Off by default (see below). When off, each message offers a one-time Load images action. |
emlInspector.limits.maxFileSizeMB |
50 |
Largest .eml that will be opened. Larger files are refused before being read. |
emlInspector.diagnostics.largeAttachmentThresholdKB |
1024 |
Per-attachment size at which the diagnostic fires. |
emlInspector.diagnostics.aggregateSizeWarningMB |
10 |
Total message size at which the diagnostic fires. |
Privacy and security
.eml files often arrive precisely because something about them is suspicious, so every message is treated as untrusted.
- Remote images are blocked by default. A remote image is effectively a read receipt: loading it tells the sender the message was opened, when, and from which IP address. When a message references remote content, the preview says so and offers a Load images action that applies to that message only and is not remembered.
- Active content is always removed, and this cannot be switched off:
<script>,<iframe>,<object>,<embed>,<base>,<form>,on*handlers,javascript:andvbscript:URLs (including control-character-obfuscated variants),pingbeacons,meta refresh, and remote stylesheets in both<link>and@importform. - The message renders in a sandboxed frame with scripting disabled entirely, behind a restrictive content security policy.
- Nothing leaves your machine. The extension makes no network requests of its own and collects no telemetry.
One thing worth knowing: exported HTML keeps its remote images, because they are part of the message you asked to export. Opening an exported file in a browser can therefore contact the sender's server. Active content is still stripped from exports.
Known limitations
- VML is never pixel-rendered. It is detected, preserved in the source view, and flagged in diagnostics, but Chromium (the engine behind VS Code's webviews) has no VML renderer. This is a platform limitation, not a shortcut.
- "Preview as" modes are approximations, not real rendering engines. They apply a rule table of known-unsupported CSS plus MSO conditional-comment filtering; there is no way to embed the real Word rendering engine or a live OWA instance.
- Contrast and HTML validity checks are best-effort, using a nearest-ancestor background walk rather than a full CSS cascade, and a curated set of structural checks rather than exhaustive HTML5 conformance.
- No network checks. External image references are reported, never fetched to verify them.
Requirements
VS Code 1.90.0 or newer. Nothing else. The extension ships pre-built.
License
MIT. Bundled dependency licenses are reproduced in THIRD-PARTY-NOTICES.txt, included with the extension.