EVTX Viewer
Open a Windows event log on any machine — no Windows box, no Event Viewer, no install. Drop an .evtx file below and it is parsed locally in this browser tab by a WebAssembly build of the same parser engine forensic tools use: summary first (record count, time range, channels, top providers and Event IDs), then a filterable table where every record opens to its structured fields and its raw XML. Event logs are evidence — they name users, machines, IP addresses and logon times — so the file is never uploaded, never logged and never leaves your device.
Last updated:
Drop an .evtx file here or choose one — up to 64 MB. Exported logs (right-click a log in Event Viewer → Save All Events As…) and files copied from C:\Windows\System32\winevt\Logs both work. Nothing is uploaded: parsing happens on your device, in a Web Worker, with progress as it goes.
Summary
Chunks that could not be read
Records
| Time (UTC) | Record | Event ID | Level | Provider | Channel | Computer |
|---|
No records match these filters.
Parsing is powered by the evtx crate (Rust, version 0.14.0), used under the MIT or Apache-2.0 license, compiled to WebAssembly with a thin wrapper maintained in this site’s repository. The parser runs entirely in your browser.
What this shows — and what an .evtx cannot tell you
An .evtx file stores each event as structured binary XML: a System block (Event ID, provider, channel, level, timestamp, record ID) and the event’s data fields (EventData or UserData). That structure is exactly what this viewer renders — sortable, filterable, exportable. What the file does not contain is the friendly message text Event Viewer displays (“An account failed to log on…”). Windows renders that text on the machine that wrote the log, from message DLLs belonging to each provider; values like %%14592 in the data are placeholders for those DLL strings. Any tool that shows you polished message text for a foreign .evtx is reconstructing or guessing it — this one shows you the fields, which are the part that is actually evidence, and the raw XML when you want to see the record exactly as stored. The companion guide, reading EVTX files without a Windows machine, works through a triage routine with real event IDs.
Two more honesty notes. Timestamps inside an .evtx are UTC; Event Viewer displays them converted to the local time of the machine you open it on, which has confused more than one timeline — the table here stays in UTC and says so. And a corrupt or truncated log is not silently “cleaned up”: chunks that fail to parse are listed above the table with their byte offsets, so you know exactly how much of the file you are not seeing. Chunk-level damage is normal in logs carved from disk images, and the records around the damage still parse. For the neighbouring file-forensics jobs, the PCAP analyzer reads packet captures under the same rule — locally, never uploaded.
Frequently asked questions
Can I open an .evtx file on a Mac or Linux machine?
Yes — that is the point of this page. Event Viewer only exists on Windows, but the .evtx format is a documented binary format, and the parser here (a WebAssembly build of the Rust evtx crate) runs in any modern browser on any operating system. Copy the file off the Windows machine or disk image, drop it here, and read it where you are.
Why don’t I see the event message text, like in Event Viewer?
Because it is not in the file. An .evtx stores the structured fields of each event; the sentence Event Viewer shows is rendered on a Windows machine from the provider’s message DLL, which does not travel with the log. Values such as %%14592 are references into those DLL strings. This viewer shows you everything the file actually contains — the System block, every EventData/UserData field, and the raw XML — instead of inventing message text it cannot know.
Is it safe to open a sensitive log here? Where does the file go?
Nowhere. The file is read by a Web Worker in your own browser tab; there is no upload endpoint, no account and no logging of file contents. You can confirm it the same way as with the other local tools on this site: load the page, go offline, and the analysis still works. That matters, because event logs name users, machines and IP addresses — treat them as evidence, not as something to paste into cloud converters or AI chats.
The summary lists chunks that could not be read. Is my file broken?
Partly, and that is normal for logs recovered from disk images or interrupted copies. An .evtx is a sequence of 64 KB chunks; damage usually kills individual chunks, not the file. The viewer reports each unreadable chunk with its byte offset and parses everything around it, so you know precisely what is missing instead of getting a silently shortened log. A chunk that is entirely zeros is preallocated space, not damage, and is skipped without comment — exactly as Windows treats it.
How large a log can I open?
Up to 64 MB, which at a typical Security log’s density is on the order of 130,000 records. Parsing streams in batches with progress, so even a file that size stays responsive; the table pages its results instead of rendering every row at once. If you need a bigger log split, export the filtered subsets you care about as JSON or CSV and work from those.