Most email attachments are safe to open, but the risk depends on the file type and the app that opens it. Images and plain PDFs sit at the low end; Office documents with macros, HTML files, disk images (ISO/IMG), shortcuts and some archives sit at the high end because they can execute code or fetch remote content. The safe approach is to rank by what the file can do, not by who sent it.
Why file type matters more than the sender
Attackers can spoof a sender, compromise a real contact, or send from a lookalike domain. What they cannot easily change is the behaviour of the file they attach. A .jpg is decoded by an image viewer; a .docm can contain a macro that runs when you click Enable Content; an .html attachment opens in a browser and can render a fake login page or run script. That is why security teams rank attachments by capability: does the file merely display, or can it run something?
This is also why “it came from someone I know” is not a safety guarantee. If their account is compromised, the attachment may be malicious even though the address is genuine. Treat the file type as the first filter and the sender as a secondary signal.
The risk ranking: from lowest to highest
| File type | Examples | Risk level | What it can do |
|---|---|---|---|
| Plain image | .jpg, .png, .gif | Low | Displays content; may carry a QR code or hidden metadata |
| Plain text | .txt | Low | Shows text only; may contain links to phishing sites |
| Low to moderate | Views documents; can include links, forms and JavaScript | ||
| Office document (no macros) | .docx, .xlsx, .pptx | Moderate | Displays content; can contain links and external references |
| Macro-enabled Office file | .docm, .xlsm, .pptm, .doc, .xls | High | Can run macros that download payloads or steal data |
| HTML file | .html, .htm | High | Opens in a browser; can show fake login pages or run script |
| Disk image | .iso, .img | Very high | Mounts as a virtual drive; can hide executables from filters |
| Shortcut or script | .lnk, .js, .vbs, .ps1, .bat | Very high | Runs commands when opened |
| Archive | .zip, .rar, .7z | Variable | Contains other files; risk depends on contents and scanning |
| Executable or installer | .exe, .msi, .dmg, .pkg | High | Runs a program; rarely legitimate as an email attachment |
Low risk: plain images and text
Formats such as .jpg, .png, .gif and plain .txt are generally low risk because they are designed to display content, not execute it. That does not make them harmless: an image can contain a QR code that leads to a phishing site, and a text file can contain a fake invoice number or a link. But the file itself is unlikely to run code on your machine. Keep your viewer and operating system updated, and be wary of QR codes in unexpected emails.
Low to moderate: PDFs
Most PDFs are safe to view, but PDF is a complex format that can include JavaScript, embedded files and links. A PDF that asks you to open a link, enter a password on a web page, or enable something is worth pausing over. Open them in a viewer that does not run JavaScript by default, and never enter credentials into a PDF form that arrived by email.
Moderate: Office documents without macros
Modern .docx, .xlsx and .pptx files are less dangerous than their macro-enabled cousins, but they can still contain links, external references and exploits. If a document asks you to enable editing or content, stop and consider why. Documents from unknown senders that urge you to “enable macros to view” are a classic phishing pattern.
High: macro-enabled Office files
Files ending in .docm, .xlsm, .pptm or older .doc/.xls formats can contain macros. Macros are small programs, and they can download payloads, encrypt files or steal data. Recent versions of Office block macros in files downloaded from the internet by default, but the setting varies by version and organisation. Treat any macro-enabled attachment from an unexpected source as hostile, and do not click Enable Content.
High: HTML attachments
An .html or .htm attachment opens in your browser. It can display a fake login page that looks like your bank or email provider, or run script that tries to steal credentials. Because it is a local file, some email filters treat it differently from a link. If you receive an HTML attachment you did not expect, open it only in a browser with no saved passwords and never type credentials into it.
Very high: ISO, IMG and other disk images
Files such as .iso and .img are disk images. When opened, they mount as a virtual drive, and their contents may bypass some email filters because the dangerous file is inside the image. There is almost no legitimate reason to receive a disk image by email; treat it as suspicious.
Very high: shortcuts and script files
Shortcuts (.lnk) and script files (.js, .vbs, .ps1, .bat, .cmd) can run commands when opened. A .lnk file may look like a folder or document but point to a command. Do not open them unless you are a developer expecting them from a trusted colleague and you have verified the source through another channel.
Variable: archives (ZIP, RAR, 7z)
Archives are a container, not a file type in themselves. The risk depends on what is inside. A ZIP containing a PDF is different from a ZIP containing an .exe or .js. Some email gateways scan inside archives, some do not, and password-protected archives can evade scanning. Inspect the contents before extracting, and never extract to a folder that runs files automatically.
High: executables and installers
Files ending in .exe, .msi, .dmg, .pkg or .app are programs. Legitimate software is rarely distributed as an email attachment; vendors use download pages and app stores. An executable attachment from an unknown sender is a serious red flag. Even from a known sender, verify through a second channel before running it.
How do I open an unexpected attachment safely?
If you need to inspect an attachment you did not expect, use a routine that limits the damage. The exact steps vary by operating system and email client, but the principles are consistent.
- Verify through a second channel. If the sender is someone you know, contact them by phone or a separate messaging app and ask whether they sent it. Do not reply to the email to ask.
- Check the file extension, not just the icon. Your email client may hide extensions. Enable viewing of file extensions so you can see whether a “PDF” is really
.pdf.exe. - Use a sandbox or isolated environment. Open unknown files in a virtual machine, a dedicated sandbox, or a separate device with no access to your main accounts.
- Do not enable macros or content. If a document asks you to enable editing, macros or content, close it and treat it as suspicious.
- Scan with an up-to-date antivirus. This is a last line of defence, not a guarantee. Some malware is designed to evade detection.
- Report and delete. If you suspect phishing, report it to your email provider and delete the message. Do not forward the attachment to others.
If you are using a disposable inbox to receive a one-time code, attachments are rarely part of the deal. Most verification emails contain none at all. If one arrives with an attachment, that is a reason to be more careful, not less. Our guide to how OTP verification works explains what a legitimate code email usually looks like.
Which attachment types should you never open?
A short list of types that should trigger an immediate stop, regardless of who appears to have sent them:
- Executables and installers (
.exe,.msi,.dmg,.pkg) — legitimate vendors use download pages, not email attachments. - Scripts and shortcuts (
.js,.vbs,.ps1,.bat,.cmd,.lnk) — these run commands when opened. - Disk images (
.iso,.img) — they mount as drives and can hide executables from filters. - Macro-enabled Office files (
.docm,.xlsm,.pptm) from unexpected sources — do not click Enable Content. - HTML files that ask you to log in — these can be fake login pages.
- Password-protected archives you did not expect — encryption can hide contents from scanning.
If any of these arrive from someone you know, verify through a second channel before doing anything else. The file type is the signal; the sender is not a guarantee.
What changes when you use a disposable inbox?
A disposable inbox such as MailboxTemp is receive-only and short-lived, which changes the attachment threat model in useful ways. Because the address is random and temporary, it is less likely to be targeted by a known attacker, and any malicious attachment is contained to an inbox that expires. That does not make attachments safe to open, but it does reduce the consequences of a mistake. You can read more about the limits in Is Temp Mail Safe?
Do not open attachments from a disposable inbox on your main device without the same precautions you would use for any unknown file. And if you need to receive a file for a legitimate signup, consider whether the service could instead provide a download link. Our guide to temporary email for signups and downloads covers when a disposable address is appropriate.
When is a real address the better choice?
Disposable inboxes are not the right tool for every attachment. If you are expecting a contract, an invoice, a legal document or a file from your employer, use a real address with a provider that scans attachments and gives you a recovery path. Disposable inboxes expire, and you cannot rely on them for long-term access. Our comparison of temp mail, VPNs and email aliases can help you choose.
Sources
- CISA: Secure Our World — general guidance on email and account security, including phishing awareness.
- NIST SP 800-63-4: Digital Identity Guidelines — the official framework covering authentication and account security.
The bottom line
Rank attachments by what they can do. Images and plain text are low risk; PDFs are usually fine but watch for links and forms; Office documents without macros are moderate; macro-enabled Office files, HTML, ISO/IMG, shortcuts and scripts are high risk. Archives are only as risky as their contents, and executables should almost never arrive by email. Verify unexpected attachments through a second channel, open them in a sandbox if you must, and never enable macros or content. A disposable inbox reduces the blast radius of a mistake, but it does not make a dangerous file safe.