Email Privacy

Obfuscate an email address to make it harder for scraper bots to harvest

Enter a valid email address (e.g. name@example.com).
All obfuscation happens locally in your browser, your email address is never sent anywhere.

About this tool

Publishing a plain mailto: link is an open invitation for scraper bots that crawl the web harvesting addresses for spam lists. This tool gives you three different ways to hide an email address from simple scrapers while still keeping it usable (to varying degrees) for real visitors, so you can pick the right tradeoff between spam protection, usability and where you're pasting it.

How to use it

  1. Type your email address into the field above.
  2. Review the three obfuscation methods generated below, each with a plain-language explanation of its strength and tradeoffs.
  3. Copy whichever snippet fits where you're pasting it, an HTML page, a script-enabled page, or a plain-text context like a forum post.

Tips: none of these methods are unbreakable against a determined, well-resourced scraper, they mainly stop the cheap, high-volume bots that scan raw HTML for the @ symbol. If spam volume is a serious problem, pair obfuscation with a contact form instead of a public address, or a CAPTCHA-gated reveal button.

Which method should I use?

Use the JavaScript method for a normal web page where JavaScript is expected to run, it's the strongest against basic scrapers. Use HTML entity encoding for simple pages where you want a clickable mailto link with minimal setup. Use the at/dot rewrite anywhere you can't use HTML or JavaScript at all, like plain-text documents, forum posts, or comment sections.

Does HTML entity encoding actually stop bots?

It stops the crudest bots that only look for a literal "@" character in raw HTML, but any browser (and most modern scrapers) automatically decodes HTML entities back to plain text when parsing the page, so it's a fairly weak deterrent against anything more sophisticated than the simplest scanners.

Does the JavaScript version break for anyone?

Yes, visitors with JavaScript disabled, some screen readers, and non-JS crawlers (including certain search engine bots) won't see the assembled address at all, since it only exists after the script runs in the browser. It's stronger against scrapers precisely because of this tradeoff.

Why bother with the at/dot rewrite if it's the weakest?

Because it's the only method that works absolutely everywhere, plain text, PDFs, chat apps, printed material, with zero setup, and it still stops the most naive scrapers that only pattern-match on a literal "@" symbol.

Is my email address sent anywhere when I use this tool?

No, every transformation happens locally in your browser with JavaScript. Nothing you type is uploaded, logged, or stored anywhere.