Documentation

Getting Started

Installation

OpenMSG is distributed exclusively through the Microsoft Store. No manual installer or elevated permissions are required.

1. Open the Microsoft Store on Windows 10 (version 19041.0+) or Windows 11.
2. Search for OpenMSG, or follow the link below.
3. Click Get. The app installs automatically (~15 MB).

System Requirements

Set as Default App

To open .msg files automatically with OpenMSG:

1. Right-click any .msg file in Explorer.
2. Select Open with → Choose another app.
3. Select OpenMSG from the list.
4. Tick Always use this app to open .msg files.

Using OpenMSG

Opening a File

There are three ways to open an MSG file:

• Double-click — if OpenMSG is set as the default app, the file opens directly.
• File picker — launch OpenMSG without a file to see the file picker. Click Open MSG File to browse.
• Command line / file association — pass the file path as the first argument: OpenMSG.exe "C:\path\to\email.msg".

Email View

Once a file is open, the main window shows:

• Header panel — sender name and avatar initials, email address, subject, sent date, To, CC, and BCC recipients.
• HTML body — rendered in an embedded WebView2 control. Inline images (CID references) are resolved from temporary local files. Plain-text emails are displayed in a pre-formatted view.
• Attachment panel — lists all attachments with their file-type icon, filename, and size. See the Attachments section for details.
• Full-screen viewer — the Open in full viewer button opens the email body in a larger pop-out window, inheriting the current window size.

Light / Dark Theme

A theme toggle button in the toolbar switches between Light and Dark mode. The choice is persisted across sessions. IT administrators can lock or pre-set the theme via the ForceTheme / DefaultTheme registry values.

Attachments

Attachments are extracted to a private temporary folder when the MSG file is opened. The folder is created fresh for each file and deleted automatically when the app closes.

Opening an Attachment

Click the attachment button to open it in its default Windows application. If the file extension is not in the safe list, a warning dialog is shown before opening. See Security for how the safe list works.

Saving an Attachment

Click the chevron (▾) on the right side of any attachment button to reveal the context menu, then select Save. A standard Windows Save dialog opens, pre-filled with the original filename. The Save option can be disabled by IT via the DisableAttachmentSave registry value.

Nested MSG Attachments

MSG files embedded inside other MSG files (forwarded or attached emails) are listed in the attachment panel like any other file. Opening them launches a new instance of OpenMSG.

Security

HTML Sanitisation

Before the email body is passed to the WebView renderer, OpenMSG sanitises the HTML:

• Inline JavaScript event handlers (onclick, onerror, onload, etc.) are stripped.
• javascript: hrefs and srcs are replaced with #.
• <meta http-equiv="refresh"> elements are removed to prevent auto-redirects.
• Right-click context menus inside the rendered body are disabled.
• When BlockThirdPartyAssets is enabled, a strict Content Security Policy is injected, preventing external images and resources from loading.

Attachment Extension Allowlist

Every attachment is checked against a configurable list of safe extensions before being opened. The default list is:

Attachments outside this list show a warning dialog. With BlockUnsafeAttachments enabled they are blocked entirely. The list is customisable via the SafeAttachments registry value.

Magic Bytes Verification

Even for files within the safe extension list, the first bytes of the file are read and compared against known file signatures. A file claiming to be a PDF but containing a Windows PE header (MZ) is blocked and a "Spoofed Attachment Blocked" error is shown. This protects against RTLO (Right-to-Left Override) filename spoofing attacks.

Unicode Bidirectional Spoofing Protection

Attachment filenames are scanned for Unicode bidirectional control characters (including U+202E, the Right-to-Left Override) before any extension check is performed. A filename containing these characters is treated as unsafe regardless of the claimed extension.

IT & Enterprise Configuration

OpenMSG reads configuration from the Windows Registry. Values are read in priority order — higher entries override lower ones:

Configuration Reference

Group Policy Deployment

Values written to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\OpenMSG take precedence over all others and cannot be overridden by the user. Use this path for enforced IT policy. Example PowerShell to lock the theme to Dark and disable telemetry across all users:

Privacy & Telemetry

Usage Analytics (PostHog)

OpenMSG sends anonymous usage events to PostHog to help prioritise development. Events include actions such as app launched, msg file opened, attachment opened, and theme toggled.

Each event includes:

• A hashed, anonymous device identifier (SHA-256 of the Windows MachineGuid)
• App version and OS version
• Session ID (random UUID, reset each launch)
• Corporate domain (UPN domain suffix only, not usernames or full addresses)

Telemetry can be disabled by setting DisableTelemetry = 1 in the registry. See IT & Enterprise Configuration.

Crash Reporting (BugSplat)

If the application crashes, a report containing the stack trace, OS version, and app version is sent to BugSplat. Crash reports do not contain email content or attachments.

Crash reporting can be disabled by setting DisableCrashReporting = 1 in the registry. See BugSplat's privacy policy at bugsplat.com/privacy.

Troubleshooting