Use the free Email Obfuscator below: your data never leaves your browser — all work happens on your device, and nothing is uploaded to any server.
Why email addresses get stolen
An email address published on a web page is an invitation to spam. Automated programs called scrapers crawl the web collecting every address they can find, and those addresses are then sold, traded and flooded with junk. A single unprotected address on a popular page can attract thousands of spam messages. That is why experienced web publishers never publish a plain address, and why obfuscation, hiding the address from simple scrapers while keeping it usable for humans, is standard practice.
Scrapers work by pattern matching. They look for text shaped like name@example.com. Anything that breaks that shape, without breaking it for a human visitor, defeats the simplest scrapers. Obfuscation is not encryption and will not stop a determined attacker, but it stops the vast majority of automated harvesting, which is where most spam addresses come from.
How this obfuscator works
Type an email address and choose a method. Decimal entities replace every character with its numeric HTML code, so “a” becomes a. Hex entities do the same in hexadecimal, so “a” becomes a. A browser renders both forms as the original address, so a visitor sees a normal address and can click it, while a scraper reading the raw page source sees only numbers. The tool also generates a ready-to-paste mailto link using the encoded address, so you can drop it straight into your page.
The third method is the human-readable form, which replaces “@” with ” [at] ” and “.” with ” [dot] “, turning name@example.com into “name [at] example [dot] com”. A human reads that easily, but a pattern-matching scraper does not recognise it as an address. This form cannot be clicked as a link, so it suits plain-text contexts like forum posts and documents rather than web pages.
Which method to choose
For a web page, use decimal or hex entities with the mailto link. Visitors get a normal clickable address, and simple scrapers see only codes. Between decimal and hex there is little practical difference; some publishers alternate or mix them, but a single consistent method is fine. For a forum post, a social media bio or a printed document, use the human-readable form, since entities only work inside HTML and would display as codes in plain text.
For the strongest everyday protection, combine methods with a contact form. A form means your address never appears on the page at all, which defeats even smart scrapers. Obfuscation is the right choice when you want visitors to see and use your address directly, and a form is the right choice when you do not need them to see it. Many sites use both: an obfuscated address for humans and a form for everyone else.
What obfuscation does not do
Obfuscation is not security. A scraper that renders pages like a browser will decode entities automatically and harvest the address anyway. A human attacker can read the human-readable form just as easily as you can. Obfuscation raises the cost of harvesting; it does not make harvesting impossible. If an address must never be found, do not publish it in any form, and use a contact form instead.
Obfuscation can also hurt accessibility if overdone. Screen readers handle entities well, since they decode them like browsers do, but the human-readable form can confuse a screen reader, which may read “at” and “dot” in ways that obscure the address. For the most accessible result, use entities with a proper mailto link, which behaves like any normal link for assistive technology.
Common mistakes
The most common mistake is obfuscating only part of the address, for example encoding the “@” but leaving the rest plain. A scraper can still recognise the surrounding pattern. Encode the whole address, every character, which is what this tool does. Another mistake is pasting the encoded address into a plain-text email or document, where it displays as codes and no human can use it. Entities belong in HTML only.
A third mistake is publishing the same address in both plain and obfuscated forms on the same site, for example plain in a footer and encoded in a contact page. A scraper only needs one plain copy. If you obfuscate, obfuscate everywhere that address appears, and check old pages and archives for plain copies you may have forgotten.
Tips for less spam
Use a separate public address for your website, different from your private address, so that any spam that does get through goes to an inbox you can filter or abandon. Check the address with this tool before publishing, and test the mailto link by clicking it yourself to confirm it opens a new message to the right address. If a page already published a plain address, changing it now still helps, since scrapers revisit pages and update their lists.
Finally, remember that obfuscation is one layer among several. Spam filters, disposable addresses for sign-ups, and contact forms all help too. Used together, they reduce spam to a manageable trickle. And because this tool runs entirely in your browser, the address you obfuscate is never sent to any server or stored anywhere.
Related tools
- Ofuscador de Correos Electrónicos (Spanish version)
- Unicode Escape Decoder
- Text Statistics Calculator