Skip to content
LegacyFile
← Learn

What Is an MBOX File? Email Archives Explained

By LegacyFile ·

You requested your Gmail data from Google Takeout, or exported a mailbox from Thunderbird or Apple Mail, and got a file called something like All mail Including Spam and Trash.mbox — possibly gigabytes of it. Open it in a text editor (if the editor survives) and you'll see something surprisingly readable: your actual email, headers and all, one message after another. This article explains what an MBOX file actually is, how the messages are separated, and why some of the headers look like =?UTF-8?B?...?= gibberish.

What an MBOX file is

MBOX ("mailbox") is the oldest email storage format still in daily use — it dates back to early Unix mail systems in the 1970s. The idea is as simple as storage formats get: an entire mail folder is one plain-text file, with every message appended one after another. No database, no index, no per-message files. That simplicity is exactly why it became the universal exchange format for mail archives: Thunderbird stores its folders this way, Apple Mail exports mailboxes as .mbox, and Google Takeout delivers your whole Gmail history as one.

The From_ separator line

If every message is just concatenated into one file, how does a program know where one message ends and the next begins? Each message starts with a separator line that looks like this:

From jane@acme.example Mon Jul 14 09:30:00 2026

Note there's no colon — this is not the From: header. It's a line beginning with the literal five characters From (called the "From* line"), followed by the sender's address and a timestamp. Everything after it, up to the next From* line, is one complete message.

That raises an obvious problem: what if an email's body contains a line starting with From ? Someone quoting a previous message could easily produce one. The classic fix is From-stuffing: the mail program prepends > to any such body line, so it's stored as >From ... and no longer matches the separator. The mboxo and mboxrd variants of the format differ only in exactly which lines get stuffed — but every variant agrees that a line starting >From is quoted body text, never a boundary.

Inside one message: headers, then body

After the From_ line, each message follows the standard email layout (RFC 5322): a header block, a blank line, then the body.

The headers are Name: value lines — From:, To:, Cc:, Subject:, Date:, and Message-ID: are the ones you'll care about in an archive. Two quirks make them harder to read than they look:

  • Folding. Header lines are length-limited, so a long recipient list wraps onto following physical lines, each starting with a space or tab. A parser has to rejoin them before the header means anything.
  • Encoded-words. Email headers are ASCII-only by rule. Any subject or display name with accents, non-Latin scripts, or emoji is wrapped in RFC 2047 syntax: =?UTF-8?B?UsOpc3Vtw6k=?= is base64-encoded UTF-8 for "Résumé", and =?utf-8?Q?Caf=C3=A9?= is the quoted-printable spelling of "Café" (with _ standing in for spaces). Your mail client decodes these silently; a text editor shows them raw.

The body is where sizes explode. A modern message is usually MIME multipart: plain-text and HTML versions of the same content, plus any attachments, all separated by boundary strings. Each attachment part carries headers of its own — Content-Type, and a Content-Disposition: attachment; filename="q3-summary.pdf" line that names the file — with the file itself base64-encoded below it. That's why a mailbox with a few dozen attachments can dwarf the text of the mail it contains.

What you can (and can't) easily do with one

Because MBOX is plain text, it's wonderfully durable — any language, script, or tool can read it, decades from now. But it's a terrible format to ask questions of. There's no index: to count messages from one sender, or list every attachment, something has to scan the entire file, split on From_ lines, unfold and decode the headers, and walk the MIME parts.

Mail clients do that scan when you import the file — but importing gigabytes into Thunderbird just to answer "what's in here?" is heavy. The lighter path is to build a spreadsheet index: one row per message with its date, sender, recipients, subject, Message-ID, and attachments. The free MBOX to CSV converter here does exactly that in your browser — the mailbox is never uploaded — and How to convert MBOX to CSV walks through the whole workflow, Google Takeout included.