Introduction
Email harvesters crawl the web looking for mailto links and plain-text email addresses to build spam lists. According to research by the Center for Democracy and Technology, 97% of published email addresses receive spam within 6 months. The simplest defense is obfuscation: encode your email address so that browsers can still render it as a clickable link, but crawlers cannot easily extract it. This tool provides four obfuscation methods: HTML entity encoding, hex entity encoding, JavaScript document.write, and CSS reversed text. Paste your email, pick a method, and copy the result into your HTML.
What this tool does
- HTML entity encoding: converts each character to its numeric HTML entity (e.g., @ becomes @).
- Hex entity encoding: converts each character to its hexadecimal HTML entity (e.g., @ becomes @).
- JavaScript document.write: splits the mailto link across string concatenation so it does not appear as a contiguous email string.
- CSS reversed text: reverses the email string and uses CSS bidirectional override to display it correctly.
- All methods output HTML or JavaScript you can paste directly into a web page.
How this tool works
Each method targets a different class of email harvester:
HTML entity encoding converts every character in the email address to its numeric HTML entity. The browser decodes entities when rendering, so visitors see a normal email address. But simple regex-based harvesters that look for patterns like [a-z]+@[a-z]+\.[a-z]+ will not match the encoded string.
Hex entity encoding works the same way but uses hexadecimal entity codes. Some harvesters decode numeric entities but miss hex entities, so this provides slightly different coverage.
JavaScript document.write splits the email across a string concatenation: "mai" + "lto:..." This prevents the email from appearing as a contiguous string in the HTML source. Harvesters that do not execute JavaScript will not find it.
CSS reversed text reverses the email string in the HTML and uses direction:rtl and unicode-bidi:bidi-override to display it correctly. Harvesters that read the DOM text get the reversed string, which is not a valid email address.
All methods run entirely in your browser. No email address is transmitted anywhere.
How email obfuscation works
Email harvesting is the primary method spammers use to build their lists. A 2003 study by the Federal Trade Commission found that email addresses posted on public websites received spam within hours. Modern harvesters use several techniques:
1. Regex matching: Scan HTML source for patterns matching email addresses. 2. DOM parsing: Render the page and extract text content from anchor elements. 3. Entity decoding: Decode HTML entities before matching (some harvesters do this, some do not). 4. JavaScript execution: Run JavaScript to capture document.write output (rare, but increasing).
No single obfuscation method defeats all harvester types. The most effective approach is to combine methods or use a contact form instead of a mailto link. However, obfuscation significantly reduces the rate of harvest compared to plain-text email addresses.
A 2006 study by Silic and Back tested various obfuscation techniques and found that HTML entity encoding reduced harvested spam by over 90% compared to plain-text addresses. JavaScript-based methods were even more effective, reducing spam by 98%, because most harvesters do not execute JavaScript.
The tradeoff: obfuscation can break accessibility. Screen readers may not decode entities or execute JavaScript. If accessibility is a priority, consider a contact form or an image-based email address with an alt text.
How to use this tool
- Enter your email address in the input field.
- Select an obfuscation method from the buttons above the output.
- Copy the obfuscated HTML or JavaScript from the output panel.
- Paste it into your web page where you want the email link to appear.
- Test the page in a browser to verify the email renders and is clickable.
Real-world examples
Personal website contact link
A developer adds a contact email link to their personal website. Instead of writing `alice@example.com`, they use the HTML entity encoding method. The output replaces every character with its numeric entity. When they paste it into their HTML, the browser renders it as a normal clickable link, but harvesters scanning the source see only entity codes.
Company footer email
A marketing team adds a "Contact Us" email to their company website footer. They use the JavaScript document.write method, which splits the mailto link across string concatenation. The email never appears as a contiguous string in the HTML source. Visitors with JavaScript enabled see and can click the link. Harvesters that do not execute JavaScript find nothing.
Open-source project maintainer
An open-source maintainer wants to list their email for security disclosures on a GitHub Pages site. They use the CSS reversed text method. The HTML source contains the reversed email string with a CSS bidirectional override. The browser displays it correctly, but a harvester scraping the raw HTML gets "moc.elpmaxe@ecila" which is not a valid email address.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| HTML entity encoding | Low | Simple obfuscation, defeats regex harvesters |
| JavaScript document.write | Low | Stronger obfuscation, defeats most harvesters |
| CSS reversed text | Low | Visual obfuscation, defeats DOM text extraction |
| Contact form (server-side) | High | Complete protection, no email in HTML at all |
Limitations or considerations
Obfuscation is not security. Determined harvesters that execute JavaScript and decode entities can still extract your email. The methods reduce automated harvesting but do not eliminate it. If your email is already in a data breach or a public directory, obfuscation will not remove it from existing spam lists. Accessibility is a concern: screen readers may not decode entities or execute JavaScript, making the email invisible to visually impaired users. For maximum protection, use a server-side contact form that never exposes your email address in the HTML.
Frequently asked questions
Which method is best?
JavaScript document.write is the most effective against automated harvesters because most do not execute JavaScript. HTML entity encoding is the simplest and most compatible. Use 'All Methods' to see all options and pick the one that fits your page.
Will obfuscation break my email link?
No. Browsers decode HTML entities and execute JavaScript, so visitors see a normal clickable link. Test in multiple browsers to be sure.
Can I use this for a mailto link with a subject?
Yes, but you need to manually add the subject parameter to the mailto URL before obfuscating. This tool obfuscates the email address itself.
Does this prevent all spam?
No. It reduces automated harvesting from your website. If your email is already known to spammers from other sources, obfuscation will not stop existing spam.
Is this accessible?
HTML entity encoding is generally accessible because screen readers decode entities. JavaScript and CSS methods may not be accessible to all users. Consider a contact form for full accessibility.
Conclusion
Email obfuscation is a pragmatic first step to reduce spam from web-published addresses. Use the JavaScript method for the best protection, or HTML entities for simplicity. For complete protection, replace mailto links with a server-side contact form. To check if your email has appeared in known breaches, use a service like Have I Been Pwned. For generating strong passwords for your email accounts, try the Password Generator.