View - Message Body As - and then your options are Original HTML, Simple HTML, and plaintext.<p>Loading of external images is fully disabled by default.  You can enable it per-email by clicking as well as per-sender (which I don&#x27;t personally do or recommend).<p>Showing as text is mostly unnecessary, though, as Thunderbird does not allow Javascript or any plugins within messages. As a result, the attack surface is <i>significantly</i> reduced compared to a browser as most browser-based attacks are via Flash, PDF, Java, Javascript, etc in decreasing order of popularity.  That wipes out the vulnerabilities used in the vast majority of attacks right off the bat.  Thunderbird uses the Gecko engine underneath which is up to date and version tied to Firefox ESR, so the engine gets security updates basically same-day as Firefox itself, which is another big point in its favor.