Email Attachment Checker
Before you open a file from an email, check what it really is. This reads the file on your own device and warns you if an "invoice" or "PDF" is really a program, a shortcut, a script or a document with hidden macros.
The file is only read as data, never opened or run, and it never leaves your device.
Why the file name can lie
Windows decides what to do with a file by the letters after the last dot, and it hides those letters by default. So a file called Invoice_2291.pdf.exe shows up as "Invoice_2291.pdf" with a PDF-looking icon, but it's a program. Other tricks include a hidden "reverse text" character that flips the end of the name around, or dozens of spaces that push the real ending out of view.
The contents can't lie as easily. Almost every file type starts with a fixed "signature" in its first few bytes: a real PDF starts with %PDF, a Windows program with MZ. This checker reads that signature and compares it with the name.
Attachments you should never open from an email
| Type | Why |
|---|---|
.exe .scr .com .msi | Programs. They can install anything. |
.js .vbs .ps1 .bat .cmd .hta .wsf | Scripts that run commands the moment you double-click. |
.lnk | Shortcuts that can run hidden commands. |
.iso .img .vhd | Disk images used to sneak programs past email filters. |
.one | OneNote files, widely used to spread malware. |
.html .htm .svg | Often fake login pages built to steal your password. |
.docm .xlsm and "Enable Content" | Office files with macros: hidden programs inside a document. |
| Password-protected ZIP | Locked so email scanners can't look inside. The password is usually in the email. |
If you already opened something suspicious
- Disconnect from the internet (Wi-Fi off or cable out).
- Run a full scan with Microsoft Defender or your antivirus.
- From a different device, change the password for your email and any account you typed a password into.
- If it was a work computer, tell your IT person straight away. Speed matters.
Related free tools
Frequently asked questions
How do I check if an email attachment is safe?
Save it without opening it, then choose it here. The checker reads the file's first bytes to see what it really is and warns you about programs, scripts, shortcuts, macros and password-protected ZIPs. Also ask yourself whether you were expecting it.
Is my file uploaded?
No. The file is read inside your browser as plain data. It is never opened, run or sent anywhere.
Does "the type matches" mean the file is safe?
Not on its own. A real PDF or Word file can still contain a link to a fake website, or ask you to enable macros. A match only means the file isn't disguised as something else.
Is this a virus scanner?
No. It spots disguised and risky file types, which is how most email attacks start, but it doesn't look for known viruses. Keep Microsoft Defender or another antivirus switched on as well.
Why is a password-protected ZIP a warning sign?
Email security scanners can't look inside a locked ZIP, so criminals send them with the password in the message. Legitimate senders rarely need to.
What is a double extension?
A name like report.pdf.exe. Windows hides the last part by default, so you only see report.pdf, but the file is really a program.