Email Obfuscator — Hide Email From Scraper Bots

Real-world use cases

• Put a contact email on a public landing page

  You want visitors to email you from a marketing page but you do not want that address sitting in plain text for every harvester to grab. Paste your address, pick the ROT13 plus JS link, and drop the snippet into the page. Real visitors click a normal mailto; the source code a bot scrapes shows only a scrambled string with no @ pattern to match.

• Show an email in a forum post or comment

  Forums and comment sections strip scripts and often strip HTML too, so a clever link is out. The readable text option — john (at) acme (dot) co — survives plain-text contexts, stays obvious to a human reader, and gives a bulk scraper nothing in mailto shape to regex against. Copy the text form and paste it where rich markup is banned.

• Harden a developer or open-source maintainer profile

  Maintainer pages, README files and docs sites get crawled constantly, and a maintainer email in a README is a magnet for spam and phishing. Use the HTML entity form in the docs HTML so the literal address never appears in the source, while readers still see and click a working link. Pair it with the JS-built link in templates you control.

• Audit how exposed an existing email already is

  Before you publish, preview each method side by side to see exactly what a scraper would read versus what a human sees. The live preview renders the obfuscated markup so you can confirm the address is still clickable and correct, then copy the version that matches where you are pasting — HTML page, plain text, or script-allowed template.

Common pitfalls

• Leaving a plain mailto link somewhere else on the same page. Obfuscating the address in one spot does nothing if the footer or a structured-data block still carries me@example.com in plain text. Scrub every copy, including JSON-LD and meta tags, or the scraper finds the easy one.

• Relying on HTML entity encoding alone against serious harvesters. Entities defeat naive regex bots but any scraper that decodes entities before matching reads right through them. For anything that matters, layer entity encoding with a runtime JS-built link so the address is never assembled in the static source.

• Pasting the script snippet into a context that strips scripts. Many CMS comment fields, forums and email clients remove inline script, leaving visitors with a broken link. Check whether the destination allows script before using the ROT13 plus JS form; if it does not, fall back to the readable text or entity version.

Privacy