Email Obfuscator: Free Online Tool
FREE TOOL · NO SIGN-UP
This email obfuscator hides an email address from spam bots that scrape websites, while keeping it usable for real visitors. Enter your address, pick one of four methods (HTML entities, JavaScript, CSS reverse text or [at]/[dot] text) and copy the code into your page. Most methods keep a working mailto link, so people can still click to email you. It is a quick fix for contact pages, footers and author bios where a plain address attracts spam. The tool runs in your browser, so your address is not sent anywhere.
How to Use the Email Obfuscator
Enter one address, choose a method, copy the code.
Step 1: Enter or paste your input
Type or paste a single email address, such as hello@yourdomain.com. The tool checks that it looks like a valid address and shows a warning if not. If you have several addresses, run them one at a time.
Step 2: Choose your options
Pick a Method:
- HTML entities (mailto link): a clickable link with every character encoded.
- JavaScript (assembled in browser): a script that builds the link when the page loads.
- CSS reverse text: the address stored backwards and flipped back by CSS.
- [at] / [dot] text: plain text like hello [at] yourdomain [dot] com.
Add optional Link text such as “Email us” for the HTML entity and JavaScript methods. If left blank, the address itself is shown.
Step 3: Copy, download or apply the result
Copy the code from the result panel, or download it as a text file. In WordPress, paste HTML or script output into a Custom HTML block, not a Paragraph block, so the editor does not change it. Then check the live page: click the link and make sure your email app opens with the right address.
Why Email Obfuscation Stops Harvesters
Email obfuscation is the practice of disguising an email address in a web page’s code so automated scrapers cannot read it, while browsers still show it normally to people.
Spam lists are built partly by bots that crawl websites looking for patterns like name@domain.com or mailto: links in the raw HTML. Simple harvesters read the page source as text and use pattern matching. They do not render the page or run JavaScript, because that is slower and costs more.
Obfuscation works by making the source code not contain a readable address. An HTML entity version stores h as h, so the pattern search finds nothing, while the browser decodes it and shows a normal address. A JavaScript version stores the address in reversed pieces and only assembles it in the visitor’s browser. A CSS version stores it backwards and displays it forwards.
None of this affects people visiting the page. They see the address and, with the link methods, can click it. The bots that skip the page are the cheap, high-volume ones, which are responsible for a large share of harvested addresses.
HTML Entity, JavaScript and CSS Methods Compared
| Method | Clickable mailto | Works without JavaScript | Protection level | Notes |
|---|---|---|---|---|
| HTML entities | Yes | Yes | Basic | Stops simple pattern scrapers; easy to decode for smarter bots |
| JavaScript | Yes | No | Stronger | Address never appears in source; hidden if JS is off |
| CSS reverse text | No | Yes | Moderate | Copying the text gives the reversed address |
| [at] / [dot] | No | Yes | Basic | Clear to humans, but common patterns are known to bots |
HTML entities are the easiest choice and keep the link fully functional. JavaScript gives the best protection against scrapers that read source code, but uses document.write, which only works when the script runs as the page loads. It is fine in a Custom HTML block but may not work in content loaded later by page builders or AJAX. CSS reverse text shows correctly but cannot be clicked, and copying it gives the backwards version, which is a real usability cost. [at] / [dot] is simple and transparent but needs the visitor to retype the address.
Keeping Mailto Links Clickable and Accessible
Obfuscation should protect the address without making it hard to use.
Keep a clickable link where you can. The HTML entity and JavaScript methods both produce a normal mailto: link once the page is displayed. If you need a subject or body in the email, build the link with the Mailto Link Generator and protect your address separately.
Screen readers. HTML entities are decoded by the browser, so screen readers read the address normally. JavaScript output is also read normally once it runs. CSS reverse text can be read backwards by some screen readers, because they read the underlying text. Text like “[at]” is read literally, which is understandable but clumsy.
Meaningful link text. If you use “Email us” as link text, consider showing the address nearby too, since some people want to copy it into a different email account.
Always offer another route. A contact form or phone number helps anyone whose setup blocks the link.
How Effective Obfuscation Really Is
Obfuscation reduces spam but does not stop it. Modern scrapers can decode HTML entities, and some render pages in a headless browser that runs JavaScript, which defeats every client-side method. Your address can also leak through data breaches, public records, social profiles, newsletters and other sites.
Think of it as one layer:
- It filters out cheap, high-volume harvesters.
- JavaScript protection is stronger than entities, but not bulletproof.
- Once an address is on spam lists, obfuscation will not remove it.
For best results, combine it with a good spam filter, a separate public address (like hello@) rather than your personal one, and a contact form with spam protection for most enquiries. Some site owners also use their CDN’s email protection feature, such as Cloudflare’s Email Address Obfuscation, which applies similar techniques automatically.
Key Features of Our Email Obfuscator
- Free with no signup.
- Four methods: HTML entities, JavaScript, CSS reverse text and [at]/[dot].
- Clickable mailto output for the entity and JavaScript methods.
- Optional link text like “Email us”.
- Email check that warns about invalid addresses.
- Copy and Download buttons.
- Private: runs in your browser.
Who Should Hide Email Addresses
- Small business owners with contact details in the footer.
- Bloggers and freelancers listing an address on About or Hire Me pages.
- Developers and agencies building contact sections for clients.
- Schools, clubs and nonprofits publishing staff or volunteer addresses.
- Authors and researchers with public profile pages.
Pro Tips and Mistakes to Avoid
Checklist of best practices
- Use the HTML entity method for most pages.
- Use JavaScript where spam is a bigger problem and JS always runs.
- Paste code into a Custom HTML block, not a text block.
- Test the link after publishing.
- Use a role address rather than a personal one.
Common mistakes and quick fixes
- Editor decodes the entities. Some visual editors convert entities back to plain text when saving. Use HTML or code view.
- JavaScript output missing. The block was loaded after the page finished. Use the entity method instead.
- Copying CSS text gives a reversed address. Expected behavior. Pick a link method if visitors need to copy it.
- Plain address left elsewhere. Check schema markup, footers and contact plugins for unprotected copies.
Publish Contacts Without the Spam
Enter your address above and copy the protected code. Build full mailto links with subject and body using the Mailto Link Generator, encode other text with the HTML Entity Encoder Decoder, and add WhatsApp contact with the WhatsApp Link Generator. Browse all free tools in the FHSEO Hub tools directory.