Security

Your files never leave your computer

The engine that reads and writes PST, OST, MBOX, EML and MSG files is compiled to WebAssembly and runs inside your browser tab, in a background worker. Files are read directly from your disk; results are written to your browser's private storage and then saved where you choose. There is no upload step, so there is nothing on our servers to leak. The pages work with your internet connection switched off once loaded.

Your original is never changed

Every tool writes new files. Before a result is offered to you, the engine checks that the source file was not modified while it worked.

Every result is verified

A result is not shown until it has been read back and compared with the source: repaired and converted messages one by one, split parts against the original, archives entry by entry. The report you can save lists every check that ran and anything that could not be recovered or converted. Nothing is dropped silently.

Emails are shown safely

In the PST viewer, an email's HTML is shown in a sandboxed frame where its scripts cannot run, and pictures from the internet (which can tell a sender you opened a message) are blocked until you choose to show them. Attachments are saved as files, never opened by the page.

Built for damaged and hostile files

Old archives are often damaged, and files can be crafted to attack the programs that read them. The engine checks every structure it reads, bounds how much memory and work any file can demand, and refuses cycles and impossible sizes instead of following them. It is tested continuously with damaged files, crafted attack files and coverage-guided fuzzing (millions of generated inputs per release), and its results are checked against independent PST readers.

The website

• Pages are static and served over HTTPS only (HSTS).
• A strict content security policy lets pages run only scripts from our own site, so injected scripts cannot run, and the site cannot be framed by others.
• No third-party scripts, advertising or trackers; fonts are served from our own site.

Reporting a security problem

If you find a vulnerability, please write to [email protected] with "Security" in the subject and the steps to reproduce it. Please give us a reasonable time to fix it before making it public. We do not take legal action against good-faith research that respects users' privacy.