# MHTML
**MHTML** (MIME HTML) is a web page archive format, standardized in RFC 2557 as "MIME Encapsulation of Aggregate Documents, such as HTML", that bundles a complete web page, its HTML root together with the images, style sheets, scripts, and other resources it references, into a single MIME multipart file for e-mail transfer, offline viewing, or archiving.[1](https://datatracker.ietf.org/doc/html/rfc2557) Files typically carry the extensions .mhtml or .mht.[2](https://www.file-extension.info/format/mhtml)
| Key fact | Detail |
|---|---|
| Standard | RFC 2557, Proposed Standard, March 1999; obsoletes RFC 2110 (March 1997)[1](https://datatracker.ietf.org/doc/html/rfc2557) |
| Container | A MIME multipart/related message with a text/html root body part and one body part per subsidiary resource[1](https://datatracker.ietf.org/doc/html/rfc2557) |
| Linking mechanism | The Content-Location content header lets URIs in the HTML root reference other body parts of the same structure[1](https://datatracker.ietf.org/doc/html/rfc2557) |
| Encoding | Resources are encoded as base64 or quoted-printable; Content-Location headers preserve the original URLs[3](https://formats.jarhalab.com/formats/mhtml) |
| Browser support | Internet Explorer saved and opened .mht natively; Chrome and Edge open .mhtml/.mht; Firefox has no native support; Safari uses .webarchive instead[3](https://formats.jarhalab.com/formats/mhtml) |
| Alternatives | Safari .webarchive, SingleFile single HTML, WARC, MAFF, and "Web Page, Complete" HTML plus a resource folder[3](https://formats.jarhalab.com/formats/mhtml) |
## Purpose and standardization
An HTML document retrieved by a browser is rarely one file: the text/html root resource references subsidiary resources such as images, video clips, and applets by URI, and each is fetched separately. To move such a document in a single e-mail message, two things are needed: a way to aggregate the root and its subsidiaries into one composite message structure, and a way for URIs in the root to reference resources inside that structure. RFC 2557 solves the first with the MIME multipart/related content type and the second with the Content-Location header.[1](https://datatracker.ietf.org/doc/html/rfc2557)
The work began in the IETF MHTML working group, chaired by Einar A. Stefferud and edited by Jacob Palme of Stockholm University/KTH and Alex Hopmann of Microsoft. The group produced three Proposed Standards, RFCs 2110, 2111, and 2112, permitting transport of compound web documents in MIME multipart/related body parts; RFC 2112 defines multipart/related itself.[4](https://datatracker.ietf.org/wg/mhtml/about/) RFC 2110, published in March 1997, defined both Content-Location and a Content-Base header for resolving relative URIs.[5](https://datatracker.ietf.org/doc/html/rfc2110) RFC 2557 replaced it in March 1999.[1](https://datatracker.ietf.org/doc/html/rfc2557)
Although designed for e-mail, the specification notes that the same conventions can serve resources retrieved by HTTP or FTP, for a complete multi-resource document in a single transfer, or for storage and archiving of complete HTML documents.[1](https://datatracker.ietf.org/doc/html/rfc2557)
## File structure
An MHTML file is a MIME-encoded message, structurally like a saved e-mail with attachments.[6](https://archiveexplorer.com/formats/mht) It opens with message headers such as From, Subject, Date, and MIME-Version, followed by a multipart/related body whose parts are separated by a boundary string. The first part is the text/html root, carrying a Content-Location header with the page's original URL; subsequent parts hold each subsidiary resource with its own Content-Type, Content-Transfer-Encoding (base64 or quoted-printable), and Content-Location.[3](https://formats.jarhalab.com/formats/mhtml)
When rendering the text/html body part, a reader resolves each URI in the markup against a base, taking the first applicable of: a base specification inside the body part itself, such as the HTML BASE element; an absolute URI in the Content-Location header of the surrounding heading; or, recursively, a Content-Location in an enclosing multipart or message heading.[1](https://datatracker.ietf.org/doc/html/rfc2557) A URI that matches the Content-Location of another body part is served from that part rather than fetched over the network, which is what makes the file self-contained.[1](https://datatracker.ietf.org/doc/html/rfc2557)
## Browser support and history
**Microsoft Internet Explorer** popularized the format. Microsoft introduced saving a web page as a single file in [Internet Explorer](https://www.edgepedia.org/internet-explorer) 4.0 in 1997, initially with a proprietary format, and IE's "Web Archive, single file (.mht)" save option made .mht a common way to keep pages offline.[2](https://www.file-extension.info/format/mhtml) In IE, rendering an MHTML page actually used the MHTML URL handler implemented in [Outlook Express](https://www.edgepedia.org/outlook-express) rather than code in the browser itself.[7](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-014)
**Chromium browsers** can open .mhtml and .mht files, and Chrome's Save Page As can produce MHTML; a 2012 code review for the "Save Page As MHTML" feature noted that the generated file was viewable in Chrome on all four operating systems and in Opera, but not in [Firefox](https://www.edgepedia.org/firefox), Safari, or then-current IE.[8](https://codereview.chromium.org/10069014) Firefox has no native support, with extensions available, and Safari instead uses its own .webarchive format, an Apple binary property list.[3](https://formats.jarhalab.com/formats/mhtml) [Microsoft Edge](https://www.edgepedia.org/microsoft-edge) retains handling for local .mht and .mhtml files, including a policy controlling whether they open automatically in Internet Explorer mode.[9](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-browser-policies/internetexplorerintegrationlocalmhtfileallowed)
## Security
Because an MHTML file is a local document that reassembles content from many origins, browsers treat it with restrictions. WebKit, for example, loads MHTML pages only from the local file system for security reasons.[10](https://bugs.webkit.org/show_bug.cgi?id=86540) When Chromium saves a page as MHTML, its FrameSerializer sanitizes the DOM by removing scripting attributes such as onload, and deliberately strips the original document's [Content Security Policy](https://www.edgepedia.org/content-security-policy) headers and meta tags so that subresources load correctly.[11](https://issues.chromium.org/issues/503865896) Sanitization defects have been reported: a case-sensitive attribute filter allowed a mixed-case ONLOAD attribute injected via DOM APIs to bypass stripping and execute when the archive was opened,[11](https://issues.chromium.org/issues/503865896) and a separate report described incomplete script stripping that left both private data and malicious script in the saved file, with the script able to exfiltrate data over a [WebSocket](https://www.edgepedia.org/websocket) even though ordinary fetch calls are blocked in MHTML contexts.[12](https://issues.chromium.org/issues/499194407)
Older Microsoft implementations had their own flaws. MS03-014 fixed a vulnerability in which the Outlook Express MHTML URL handler could render any text file as if it were HTML, potentially executing script with Local Computer Zone privileges; the patch restricted the handler to .mht and .mhtml files.[7](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-014) A related CERT vulnerability note described the Outlook Express MHTML protocol handler treating content from one domain as if it were in the Local Machine Zone, violating the cross-domain security model.[13](https://www.kb.cert.org/vuls/id/323070)
## Comparison with other archive formats
MHTML is one of several ways to keep a web page as one file. Safari's .webarchive stores the page in an Apple binary property list and reopens natively only in Safari, while MHTML reopens natively in Chrome and Edge; neither replaces WARC, the format used by web archives and crawlers.[14](https://formats.jarhalab.com/comparisons/webarchive-vs-mhtml) The Mozilla Archive Format add-on's MAFF container is comparable to MHTML for single-file archiving, though the two formats differ in other respects.[15](https://www.amadzone.org/mozilla-archive-format/maff-specification.html) SingleFile-style tools embed resources as data URIs in a plain HTML file, and Chrome's "Web Page, Complete" option saves an HTML file plus a folder of resources rather than a single file.[3](https://formats.jarhalab.com/formats/mhtml)
MHTML also has limits as a preservation format. For large-scale collection, web archives use WARC instead.[16](https://arxiv.org/abs/2003.14046)
## References
1. [Palme, J., Hopmann, A., Shelness, N. (1999). MIME Encapsulation of Aggregate Documents, such as HTML (MHTML). RFC 2557, IETF.](https://datatracker.ietf.org/doc/html/rfc2557)
2. [MHTML File - What It Is, How to Open & Convert It, File-Extension.info](https://www.file-extension.info/format/mhtml)
3. [MHTML .mhtml Format, File Formats (Jarhalab)](https://formats.jarhalab.com/formats/mhtml)
4. [MIME Encapsulation of Aggregate HTML Documents (mhtml) Working Group, IETF Datatracker](https://datatracker.ietf.org/wg/mhtml/about/)
5. [Palme, J., Hopmann, A. (1997). MIME E-mail Encapsulation of Aggregate Documents, such as HTML (MHTML). RFC 2110, IETF.](https://datatracker.ietf.org/doc/html/rfc2110)
6. [MHT / MHTML file format, Archive Explorer](https://archiveexplorer.com/formats/mht)
7. [Microsoft Security Bulletin MS03-014, Microsoft Learn](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-014)
8. [Issue 10069014: Save Page As MHTML, Chromium Code Review](https://codereview.chromium.org/10069014)
9. [InternetExplorerIntegrationLocalMhtFileAllowed policy, Microsoft Learn](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-browser-policies/internetexplorerintegrationlocalmhtfileallowed)
10. [Bug 86540: MHTML files should be loadable from all schemes considered local, WebKit](https://bugs.webkit.org/show_bug.cgi?id=86540)
11. [Issue 503865896: Potential Information Leak via Case-Sensitive Attribute Filter Bypass in FrameSerializer (MHTML), Chromium](https://issues.chromium.org/issues/503865896)
12. [Issue 499194407: Information Leak via Incomplete Script Stripping in FrameSerializer (MHTML), Chromium](https://issues.chromium.org/issues/499194407)
13. [VU#323070: Outlook Express MHTML protocol handler does not properly validate source of alternate content, CERT/CC](https://www.kb.cert.org/vuls/id/323070)
14. [Safari WebArchive vs MHTML: Which to Use?, File Formats (Jarhalab)](https://formats.jarhalab.com/comparisons/webarchive-vs-mhtml)
15. [MAFF Specification, Mozilla Archive Format Add-on](https://www.amadzone.org/mozilla-archive-format/maff-specification.html)
16. [The Case For Alternative Web Archival Formats To Expedite The Data-To-Insight Cycle, arXiv](https://arxiv.org/abs/2003.14046)
---
*Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Networks and security › HTTP and web communication protocols*
*Initially written Sep 17, 2026 · Reviewed: Oct 15, 2026 · Edited: Oct 15, 2026 · Last review: Oct 15, 2026*
*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*
License: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license