An email obfuscator rewrites an address so it still works for visitors but is harder for harvesting scripts to read from your page source. Encoding characters as HTML references stops the laziest scrapers; building the link with a script stops more. None of it is a guarantee, so pair it with a spam filter.
| Method | Clickable | Stops | Weak spot |
|---|---|---|---|
| HTML character references | Yes | Plain-text pattern matching | Any parser that decodes HTML reads it back |
| Script-assembled link | Yes, once scripts run | Scrapers that do not run scripts | Headless browsers; no link without scripts |
| CSS-reversed text | No | Source scanning for name@domain | Copy and paste gives the reversed text |
| Words: name [at] domain [dot] com | No | Simple pattern matching | Easy to reverse; awkward for people |
| Contact form instead | Not an email link | Address never appears | Needs a form handler and its own spam control |
Updated
Everything here runs in your browser, nothing is sent anywhere. Pick the method that fits your page, copy the snippet, and read the trade-offs table so you know what each one can and cannot do.
Type an address, an optional link label, subject and body. The tool writes four versions you can paste into a page: character references, a script-assembled link, CSS-reversed text and an at/dot spelling.
These are the same patterns the tool writes, shown with a placeholder address so you can see the shape of each one.
Decimal (&#NNN;) and hex (&#xHH;) references are mixed so a single find-and-replace does not decode everything. Browsers turn them back into normal characters.
<a href="mailto:hi@example.com">Email us</a>The address is stored backwards in data attributes and only joined when the script runs. Without scripts the link still goes to your contact section.
<a class="js-mail" data-u="ih" data-d="moc.elpmaxe" href="#contact">Email us</a>
<script>
document.querySelectorAll(".js-mail").forEach(function (a) {
var rev = function (s) { return s.split("").reverse().join(""); };
a.href = "mailto:" + rev(a.dataset.u) + "@" + rev(a.dataset.d);
});
</script>The source holds the address backwards and CSS flips it for display. It is not a link, and copying it gives the reversed string, so use it only where reading is enough.
<style>.mail-rev { direction: rtl; unicode-bidi: bidi-override; }</style>
<span class="mail-rev">moc.elpmaxe@ih</span>Fields you can add after the address. The first one starts with ?, the rest with &.
| Field | Example | Note |
|---|---|---|
| subject | ?subject=Quote%20request | Spaces become %20 |
| body | &body=Hi%2C%0D%0AThanks | Line breaks are %0D%0A |
| cc | &cc=office%40example.com | Extra visible recipient |
| bcc | &bcc=archive%40example.com | Hidden recipient |
Address harvesters are programs that download pages and look for text shaped like [email protected], including inside mailto: links. The cheapest ones read raw HTML and never run JavaScript, which is why light encoding filters them out.
Better-funded scrapers parse the HTML properly, decode character references, and some drive a real browser. Against those, only keeping the address off the page works, which is what a contact form does.
For a footer link on a small business site, character references are a fair default: zero JavaScript, the link stays clickable, screen readers announce it normally, and casual scrapers miss it.
If spam is already a problem, use the script-assembled link and keep a plain fallback such as a link to your contact page. Use the reversed-text trick only for display, never for a link, because copying it yields the address backwards.
Whatever you choose, keep the address you publish on a filter you control, and never obfuscate an address that people must type in an emergency.
Partly. It reliably defeats scripts that scan raw page text, which are still common because they are cheap to run. It does not stop scrapers that decode HTML or run a full browser. Treat it as one layer next to a spam filter, not as protection.
Yes. The browser decodes character references before anything is displayed or read aloud, so visitors and screen readers get the normal address and link. Only someone reading the page source sees the codes.
Add ?subject= after the address, then &body= for body text, with every value percent-encoded. Line breaks in the body are written as %0D%0A. The tool does this encoding for you when you fill in the subject and body fields.
A form keeps the address off the page completely, which is the strongest option. It needs somewhere to send submissions and its own protection against form spam, so many sites show a form and an obfuscated address together.
Related: HTML entities reference, Send a form to email, Email signature generator, Regex tester.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.