Email Attachment Checker
Before you open a file from an email, check what it really is. This reads the file on your own device and warns you if an "invoice" or "PDF" is really a program, a shortcut, a script or a document with hidden macros.
The file is only read as data, never opened or run, and it never leaves your device.
Why the file name can lie
Windows decides what to do with a file by the letters after the last dot, and it hides those letters by default. So a file called Invoice_2291.pdf.exe shows up as "Invoice_2291.pdf" with a PDF-looking icon, but it's a program. Other tricks include a hidden "reverse text" character that flips the end of the name around, or dozens of spaces that push the real ending out of view.
The contents can't lie as easily. Almost every file type starts with a fixed "signature" in its first few bytes: a real PDF starts with %PDF, a Windows program with MZ. This checker reads that signature and compares it with the name.
Attachments you should never open from an email
| Type | Why |
|---|---|
.exe .scr .com .msi | Programs. They can install anything. |
.js .vbs .ps1 .bat .cmd .hta .wsf | Scripts that run commands the moment you double-click. |
.lnk | Shortcuts that can run hidden commands. |
.iso .img .vhd | Disk images used to sneak programs past email filters. |
.one | OneNote files, widely used to spread malware. |
.html .htm .svg | Often fake login pages built to steal your password. |
.docm .xlsm and "Enable Content" | Office files with macros: hidden programs inside a document. |
| Password-protected ZIP | Locked so email scanners can't look inside. The password is usually in the email. |
If you already opened something suspicious
- Disconnect from the internet (Wi-Fi off or cable out).
- Run a full scan with Microsoft Defender or your antivirus.
- From a different device, change the password for your email and any account you typed a password into.
- If it was a work computer, tell your IT person straight away. Speed matters.
Related free tools
What the email attachment checker does
Scammers often name a dangerous file so it looks like an invoice, a PDF or a photo. This checker reads the first bytes of a saved attachment to work out what the file really is, then compares that with its name. It tells you in plain words whether the file matches, needs care, or should not be opened at all.
Benefits
- Sees past the file nameThe verdict is based on the file's contents, not the letters after the dot, so a program renamed to .pdf is caught.
- Catches name tricksIt flags double extensions like report.pdf.exe, hidden reverse-text characters, long runs of spaces and files with no extension.
- Looks inside ZIP filesFor a ZIP it lists the files inside, highlights risky ones such as programs, scripts, shortcuts and web pages, and warns if the ZIP is password-protected.
- Spots Office macrosIt looks for macro code in Word, Excel and PowerPoint files, including older 97-2003 formats, and reminds you not to click Enable Content.
- Warns about fake login pagesHTML attachments that contain a form, and SVG images that contain code, get a clear danger warning.
- Simple four-level resultEach file gets a label: Matches, Be careful, Danger or Unknown, plus a short headline and notes that explain why.
- Shows the factsYou see what the file really is, what the name claims, its size and its first bytes, so you or your IT person can double-check.
- Check several files at onceChoose or drop more than one attachment and each one gets its own result card.
Who it is for
- Small-business owners who get invoices and purchase orders from people they don't know well.
- Office and accounts staff who want a quick second opinion before opening a file from an email.
- Older relatives and less technical users who have been warned about scam attachments but can't tell what a file is.
- IT helpers and freelancers who need to show a client why an attachment is suspicious.
- Anyone who received a ZIP and wants to see what is inside before unzipping it.
How to use it
- Save the attachment to your computer without opening it.
- Click to choose the file, or drag it onto the drop area. You can add several at once.
- Read the label and headline for each file: Matches, Be careful, Danger or Unknown.
- Check the notes and the list of files inside any ZIP, then delete anything marked Danger.
Your privacy
The file is read inside your browser as raw data. It is never opened, run or uploaded, and nothing about it is sent to ListaFix or anyone else.
Frequently asked questions
How do I check if an email attachment is safe?
Save it without opening it, then choose it here. The checker reads the file's first bytes to see what it really is and warns you about programs, scripts, shortcuts, macros and password-protected ZIPs. Also ask yourself whether you were expecting it.
Is my file uploaded?
No. The file is read inside your browser as plain data. It is never opened, run or sent anywhere.
Does "the type matches" mean the file is safe?
Not on its own. A real PDF or Word file can still contain a link to a fake website, or ask you to enable macros. A match only means the file isn't disguised as something else.
Is this a virus scanner?
No. It spots disguised and risky file types, which is how most email attacks start, but it doesn't look for known viruses. Keep Microsoft Defender or another antivirus switched on as well.
Why is a password-protected ZIP a warning sign?
Email security scanners can't look inside a locked ZIP, so criminals send them with the password in the message. Legitimate senders rarely need to.
What is a double extension?
A name like report.pdf.exe. Windows hides the last part by default, so you only see report.pdf, but the file is really a program.