This tool takes one header value and tells you what it really says. Paste a Subject, a From, a display name, or an attachment filename.
It deliberately does not reconstruct delivery paths, time hops, or read authentication results. Those belong to the header analyzer, which takes a whole header block rather than a single value. The two are separate because they answer separate questions, and running them together would produce a page that does neither well.
Decoding is only half of it
Plenty of tools will turn =?UTF-8?B?...?= back into text. The part that matters is what you do with the result, because decoded output can still be deliberately misleading — a domain that looks like a brand but is spelled with Cyrillic letters reads as perfectly ordinary once decoded.
So the decoded text is scanned for three things: characters that imitate Latin letters, characters that are invisible but present, and the presence of more than one writing system. The first two are reported as problems because they have almost no legitimate use in a sender identity. The third is reported as a warning, because multilingual mail is real and a mixed script is not automatically an attack.
If the domain in a decoded value looks suspicious, the DNS lookup will tell you whether it resolves at all, and the disposable email checker whether it is a throwaway provider.