I build a browser tool that opens mail archives locally. Before a file is parsed as a PST, MBOX or EML, a short sniff looks at the first bytes and, when they are not mail, the UI shows a hint for that kind.

For files sniffed as html , the hint used to cover only one explanation: the page a sharing or download link returns when it needs a sign-in or has expired.

What the commit records

A visitor dropped the same 1–10 MB file four times in a minute. Each time it sniffed as html . They left after seeing only the sign-in / expired-link explanation.

I did not open that visitor's file, and I did not watch the session. The size range, the four attempts, and the fact that they left come from the commit message. What I can confirm from the source is the hint they would have been shown, and how html is detected.

How a drop becomes html

The sniffer does not look at the file name.…