Email network analyzer

About this tool

A mailbox is a social network hiding in plain text. Every message carries a From: address and one or more To:/Cc: addresses, and that is all you need to reconstruct who talks to whom, how often, and over what period. This tool reads that metadata out of raw email text and builds the graph.

Paste an mbox export (messages separated by a From postmark line), a single .eml file, or even just the headers. Each message contributes one link from its sender to every distinct recipient, weighted by how many messages travelled along it. You get message, participant, and link totals, the date span, the top senders, the top recipients, the top correspondents by combined volume, and the heaviest links with the first and last date each was used. Set Your address and the report adds a personal section: who you mail most, who mails you most, and a reciprocity ratio.

Switch Nodes to domains for an organisation-level rollup, Link direction to undirected to merge A → B with B → A, or Output to CSV, JSON, GraphML, or Graphviz DOT when you want to load the graph into Gephi, NetworkX, or Graphviz instead of reading it here. Message bodies are never parsed and nothing leaves the browser.

Worked example

Paste this three-message mbox:

From [email protected] Mon Jan  1 00:00:00 2024
From: Alice <[email protected]>
To: [email protected]
Cc: [email protected]
Date: Tue, 2 Jan 2024 10:00:00 +0000
Subject: kickoff

hello

From [email protected] Mon Jan  1 00:00:00 2024
From: Bob <[email protected]>
To: [email protected]
Date: Wed, 3 Jan 2024 09:00:00 +0000
Subject: re: kickoff

ack

From [email protected] Mon Jan  1 00:00:00 2024
From: Alice <[email protected]>
To: [email protected]
Date: Fri, 5 Jan 2024 11:30:00 +0000
Subject: status

update

With the defaults (address nodes, To: and Cc:, directed) the report opens with:

Email network
  3 messages, 3 addresses, 3 links
  View: directed graph of addresses, recipients = To+Cc
  Dates: 2024-01-02 .. 2024-01-05

Alice leads the top-senders list with 2 messages to 2 contacts, Bob follows with 1, and the heaviest link is [email protected] -> [email protected] with 2 messages spanning 2024-01-02 .. 2024-01-05. Switching Link direction to undirected merges Alice→Bob and Bob→Alice into a single pair link carrying all 3 messages; switching Nodes to domains leaves just example.com -> example.org, because the mail inside example.com becomes a self-loop and self-loops are dropped by default.

Limits and edge cases

• Input is capped at 4 MiB and 20,000 messages. This is a paste-sized tool — split a multi-gigabyte archive before pasting, or filter it with From date / To date first.
• Rows per ranked list accepts 1–100; Minimum messages per link accepts 1–10,000. Neither affects the CSV, JSON, GraphML, or DOT exports, which always contain the full graph.
• A message needs a From: header and at least one recipient address to count. Blocks that fail either test are skipped and tallied in the report's Notes section.
• mbox splitting keys on a line starting with From (with a space) at column 0. A body line that starts exactly like that will split a message in two — rare, but it is how the format works.
• Dates are read from the Date: header and compared as calendar days in the message's own timezone. While From date or To date is set, undated messages are skipped, not kept.
• Recipients are de-duplicated per message, so someone listed in both To: and Cc: counts once.
• Bcc: normally survives only in your own sent mail; on received mail to-cc-bcc behaves like to-cc.
• Only addresses are read — no subjects, bodies, attachments, or In-Reply-To threading. Centrality measures such as betweenness are out of scope; export GraphML and compute them in Gephi or NetworkX.

FAQ