What is MHTML and Why It Matters for Digital Evidence

What is MHTML?

MHTML stands for MIME HTML, formally defined in RFC 2557("MIME Encapsulation of Aggregate Documents, such as HTML"). It was standardized in 1999 and has been supported by major browsers ever since.

The core idea is straightforward. When a browser renders a web page, it pulls in dozens - sometimes hundreds - of external resources: images, CSS stylesheets, JavaScript files, fonts, favicons, and more. A standard HTML save only captures the markup itself. All those external resources are either saved as separate files in a folder or lost entirely.

MHTML takes a different approach. It uses the same MIME (Multipurpose Internet Mail Extensions) encoding that email attachments use, bundling the HTML document and every referenced resource into a single .mhtml or .mht file. Each resource is Base64-encoded and stored inline, separated by MIME boundary markers. The result is one file that contains everything the browser needs to render the page exactly as it appeared at the time of capture.

What an MHTML File Contains

A typical MHTML file includes:

• The full HTML source - the complete DOM as rendered at capture time, including dynamically loaded content
• All images - photos, icons, logos, and background images, encoded inline
• CSS stylesheets - both linked and inline styles that control the page layout and appearance
• JavaScript files - the scripts that power interactive elements and dynamic content
• Fonts and other assets - web fonts, SVGs, and any other resources the page references

Because all of these resources are embedded in a single file, the MHTML archive is completely self-contained. You can open it months or years later, even offline, and the page renders exactly as it did at the time of capture. No broken image links. No missing stylesheets. No layout shifts.

Why MHTML Matters for Legal Evidence

When web content is used as evidence - in DMCA takedowns, trademark disputes, litigation, regulatory filings, or internal investigations - the format of that evidence matters. MHTML addresses several problems that other capture methods do not.

Self-contained and portable

An MHTML file has no external dependencies. Every asset the page needs lives inside the file. This means the evidence does not degrade over time. A screenshot might show what a page looked like, but an MHTML file preserves the actual page - structure, styling, and content - in a form that any browser can open and verify.

No broken links or missing resources

Web pages depend on external servers for images, stylesheets, and scripts. If you save only the HTML, those external resources will eventually go offline - and your evidence degrades into an incomplete document. MHTML eliminates this risk entirely because every resource is encoded inside the file.

Preserves visual state

An MHTML capture shows the page as the user actually saw it, including responsive layout, dynamic content that was loaded via JavaScript, and applied CSS styles. This is critical for cases where the visual presentation is the evidence - for example, misleading product claims, deceptive pricing displays, or infringing brand elements.

Machine-readable and inspectable

Unlike a screenshot (which is just a flat image), an MHTML file retains the underlying HTML structure. An attorney, forensic examiner, or technical expert can open the file and inspect individual elements - links, metadata, alt text, hidden content, embedded tracking codes. This level of detail can be the difference between evidence that raises questions and evidence that answers them.

How MHTML Compares to Other Capture Methods

There is no single perfect capture format. Each method preserves different aspects of a web page, and the strongest evidence packages include multiple formats. Here is how MHTML stacks up:

Screenshot (PNG) gives you a visual record, but nothing underneath - no source code, no links, no metadata. You cannot inspect what the page actually contained.

HTML only preserves the source code, but without images, stylesheets, and scripts the page looks nothing like the original. External resources break as servers go offline.

PDF gives you a visual snapshot with text that is usually selectable, but it flattens the page. Interactive elements, JavaScript state, and underlying HTML structure are lost.

MHTML is the only single-file format that preserves both the visual presentation and the complete underlying source - HTML, CSS, images, and scripts - in a form that remains fully functional and inspectable.

That said, MHTML is strongest when combined with other formats. A screenshot provides a quick visual reference. A PDF is easy to attach to legal filings. And an MHTML file provides the deep, inspectable record. The best evidence packages include all three.

How Snapoena Captures MHTML Automatically

The Snapoena Chrome extension captures MHTML automatically as part of every evidence package. When you click the capture button, the extension uses the browser's native MHTML export to save a complete archive of the current page - including logged-in content, dynamically loaded elements, and everything else visible in your browser.

This happens alongside the screenshot, HTML source capture, and metadata collection. You do not need to configure anything or run a separate export. The MHTML file is included in your evidence bundle automatically.

Because the extension captures the page from your browser session, it can preserve content that server-side capture tools cannot reach - private messages, authenticated dashboards, social media feeds, and paywalled articles. The MHTML archive ensures that all of that content is preserved in full fidelity.

MHTML and the Evidence Strength Score

Snapoena assigns every capture an evidence strength score from 0 to 100 based on how complete the evidence package is. Including an MHTML archive contributes to that score because it adds a layer of preservation that screenshots and HTML alone do not provide.

Captures that include MHTML are more complete, more inspectable, and harder to challenge. If you are building evidence for legal proceedings, maximizing your evidence score means your package covers more potential objections before they are raised.

When to Use MHTML for Evidence

MHTML capture is especially valuable in these scenarios:

• Content that may be deleted. If you suspect the page will be taken down or edited, an MHTML archive preserves the complete state before it disappears.
• Pages behind authentication.Content that requires a login cannot be captured by server-side tools. The browser extension's MHTML capture is often the only way to preserve these pages in full.
• Complex or dynamic pages. Pages that rely heavily on JavaScript to render content - single-page applications, dynamic dashboards, interactive product pages - are best preserved as MHTML because the archive includes the scripts and their rendered output.
• Cases where source code matters. If the evidence involves hidden elements, metadata, embedded links, or tracking codes, MHTML preserves all of this where a screenshot would not.

The Bottom Line

MHTML is not new, and it is not glamorous. It is a two-decade-old standard that does one thing well: it packages a complete web page into a single file that anyone can open and verify. For digital evidence, that reliability is exactly what matters.

Screenshots show what a page looked like. MHTML preserves what a page actually was. When your evidence needs to withstand scrutiny, you want both.