ToolSphare Mail Reader Security & Privacy First

Privacy-focused email reading, verification code extraction, and personal TOTP authenticator. Read local .eml files without signup, or connect your private mailboxes with read-only access.

📬

Instant Temporary Mailbox & Verification Code Reader

Paste any MailReader session UUID or URL above (compatible with mailreader.tech/read_code?uuid=...). ToolSphare will automatically poll the mailbox, detect incoming emails, and highlight your OTP verification codes with 1-click copy.

📥
Drag & Drop Your .EML File Here
Or click to select an email file from your device • Up to 50MB • Parsed 100% locally in your browser
✓ Zero Server Uploads ✓ Sandboxed Iframe ✓ Tracking Pixels Blocked
🔒

Sign In to Connect Your Mailbox

To protect your privacy and ensure strict tenant isolation, connecting Gmail, Outlook, or custom IMAP accounts requires a ToolSphare account. Your credentials and tokens are encrypted at rest with AES-256.

Sign In to ToolSphare Create Free Account

🔑 Live Verification Codes & OTPs

Automatically parsed from incoming 2FA, password-reset, and sign-in emails. Heuristically excludes dates, phone numbers, and prices.

Select "Verification Codes" to scan your mailboxes.

➕ Connect a Mailbox

Select an official OAuth provider or enter custom IMAP settings. ToolSphare requests read-only permissions.

Google OAuth: Set GOOGLE_MAIL_CLIENT_ID and GOOGLE_MAIL_CLIENT_SECRET in .env to enable one-click Gmail connection.
Microsoft OAuth: Set MICROSOFT_MAIL_CLIENT_ID and MICROSOFT_MAIL_CLIENT_SECRET in .env to enable Outlook/M365 sync.

Custom IMAP Connection

📋 Connected Mailboxes

Manage your connected accounts. You can pause sync, reconnect, or permanently delete all stored mailbox data.

No mailboxes currently connected.

ToolSphare Mail Reader Security & Privacy Architecture

1. Local Parsing Guarantee: The Local Email File Reader runs entirely in your browser using a custom client-side MIME engine. Files are never transmitted silently or stored on ToolSphare servers.

2. Anti-SSRF Protection on IMAP: Custom IMAP connections strictly reject loopback addresses (127.0.0.0/8), private LANs (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local & cloud metadata endpoints (169.254.169.254), and restrict network communication strictly to standard encrypted mail ports (993, 143, 995).

3. Read-Only Default: When authenticating with Google or Microsoft, ToolSphare requests minimum read-only scopes (https://www.googleapis.com/auth/gmail.readonly, Mail.Read). No emails can ever be deleted or sent from your remote provider account.

4. Hostile Input Sanitization: All HTML emails are treated as untrusted. Active scripts, plugins, iframes, forms, and inline event handlers are stripped. Remote images and web tracking beacons are blocked by default to prevent sender IP tracking.

5. Personal TOTP Authenticator: Built with the browser's native WebCrypto API (AES-GCM 256-bit with PBKDF2 100,000 iterations). Your 2FA secrets are encrypted with your master passphrase and never sent over the network or saved in plaintext.