eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information.
Extracted and generated information include but are not limited to:
- attachments
- hashes
- names
- from, to, cc
- received servers path
- subject
- list of URLs parsed from the text content of the mail (including HTML body/attachments)
Please feel free to send me your comments / pull requests.
For the changelog, please see CHANGELOG.md.
Installation:
pip install eml_parser[filemagic]
⚠️ Note: If you don't want to / cannot use file-magic (e.g. if you are using python-magic), install via:
pip install eml_parser
Known Issues
OSX users
Make sure to install libmagic, else eml_parser will not work.
Example usage:
import datetime
import json
import eml_parser
def json_serial(obj):
if isinstance(obj, datetime.datetime):
serial = obj.isoformat()
return serial
with open('sample.eml', 'rb') as fhdl:
raw_email = fhdl.read()
ep = eml_parser.EmlParser()
parsed_eml = ep.decode_email_bytes(raw_email)
print(json.dumps(parsed_eml, default=json_serial))
Which gives for a minimalistic EML file something like this:
{
"body": [
{
"content_header": {
"content-language": [
"en-US"
]
},
"hash": "6c9f343bdb040e764843325fc5673b0f43a021bac9064075d285190d6509222d"
}
],
"header": {
"received_src": null,
"from": "john.doe@example.com",
"to": [
"test@example.com"
],
"subject": "Sample EML",
"received_foremail": [
"test@example.com"
],
"date": "2013-04-26T11:15:47+00:00",
"header": {
"content-language": [
"en-US"
],
"received": [
"from localhost\tby mta.example.com (Postfix) with ESMTPS id 6388F684168\tfor <test@example.com>; Fri, 26 Apr 2013 13:15:55 +0200"
],
"to": [
"test@example.com"
],
"subject": [
"Sample EML"
],
"date": [
"Fri, 26 Apr 2013 11:15:47 +0000"
],
"message-id": [
"<F96257F63EAEB94C890EA6CE1437145C013B01FA@example.com>"
],
"from": [
"John Doe <john.doe@example.com>"
]
},
"received_domain": [
"mta.example.com"
],
"received": [
{
"with": "esmtps id 6388f684168",
"for": [
"test@example.com"
],
"by": [
"mta.example.com"
],
"date": "2013-04-26T13:15:55+02:00",
"src": "from localhost by mta.example.com (postfix) with esmtps id 6388f684168 for <test@example.com>; fri, 26 apr 2013 13:15:55 +0200"
}
]
}
}
Release files for eml-parser 4.0.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| eml_parser-4.0.0.tar.gz | 46.0 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| eml_parser-4.0.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 81.6 kB
Release files / eml_parser-4.0.0.tar.gz
| Download URL | eml_parser-4.0.0.tar.gz |
|---|---|
| Size | 46.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
4ea0baa3ea8d766791b4d758f953aad726d9004cea2b71bcaab1006240b2e67b
|
|
BLAKE2b-256 checksum How to use checksums |
61ed0aeffc7d960cb5953cfbe78a4b69d5d0a218f306f5498b8b86b5f5f1adb9
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 29, 2026.
Transparency logRelease files / eml_parser-4.0.0-py3-none-any.whl
| Download URL | eml_parser-4.0.0-py3-none-any.whl |
|---|---|
| Size | 35.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
d1096162d8791474a7350482befa7ec50dc25925d6d0d1ac2a5f4c7264855414
|
|
BLAKE2b-256 checksum How to use checksums |
604d642e59de7cff1da3f0e8feeea588458f1c5bcd76846ae1240fbdaba95da9
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 29, 2026.
Transparency log
