Turn a public email address into a snippet that is harder for bots to harvest. Pick a method, copy the markup, and see exactly what your visitors get before you ship it.
Everything below runs in your browser. The address you type is never sent to a server, never logged, and is gone the moment you close the tab.
Leave this blank to show the address itself. Custom text keeps the address out of the visible page entirely.
<a href="mailto:sales@example.com">sales@example.com</a>
This is the rendered result, not a picture of it. It behaves the same way on your page.
Decoding character references is a single call in every HTML parser, and most scraping libraries do it for you before you ever see the document. This stops naive harvesters that regex the raw bytes, and nothing beyond that.
Naive harvester check
The classic address-matching regex finds nothing in this snippet. That only means the crudest bots miss it — it says nothing about scrapers that execute JavaScript or decode entities, and most modern ones do both.
Entities are resolved while the HTML is parsed, so the accessibility tree, copy and paste, keyboard focus and the mailto link all behave exactly as if you had typed the address in plain text. If you only pick one method, pick this one.
Every row is a trade between how hard the address is to harvest and how easy it is for a real person to use. Ratings are relative to each other, not absolute guarantees.
| Method | Clickable link | Needs JavaScript | Scraper resistance | Accessibility |
|---|---|---|---|---|
| Yes | No | Low to medium | None — decoded before the accessibility tree is built | |
| Yes | Yes | Medium | Fine with a screen reader, empty without JavaScript | |
| No | No | Low | Read out backwards; breaks copy, paste and translation | |
| Yes | Yes | Medium | Fine with a screen reader, empty without JavaScript | |
| No | No | Low | Read correctly, but nobody can click it |
Click a method name to load it into the generator above.
Obfuscation is one layer of a contact architecture, not the whole thing. These three do more for your inbox than any of the snippets above, and none of them are a copy-paste job.
Hides the recipient address completely and gives you structured fields, routing, qualification and consent capture. The right answer for sales, demo and support paths. It can still be attacked, so add validation, rate limits and server-side checks.
Publish press@ rather than a person's inbox. It is not obfuscation, but it is the thing that lets you retire a burned address without changing anyone's job. Obfuscate the alias with one of the methods above.
Usually not worth it. It breaks copy and paste and creates accessibility problems, and alt text that spells out the address is read by scrapers too. This tool deliberately does not generate one.
Scrapers got better. Older ones looked for a literal name@domain.com; newer ones decode common substitutions and render JavaScript like a browser. Treat every method here as friction, not as a lock. The comparison below sets out what each method actually buys you.
An email obfuscator changes how an address appears in your page source so an automated bot has a harder time recognising it. A plain mailto:sales@example.com is a pattern any harvester finds in milliseconds. Encoding it, assembling it at runtime, or writing it as bracketed words means the raw document no longer contains that pattern — even though the visitor sees and uses the same address.
The sensible places to use it are public, high-traffic, non-transactional pages: press pages, about pages, partnership pages, author bios, investor pages, conference landing pages. The places not to use it are your conversion paths. Newsletter signups, demo requests and trial registrations need forms with validation, consent capture and routing, because you want the structured data, not just a hidden link.
None of this touches your outbound deliverability. Obfuscation protects inbound contact points; SPF, DKIM and DMARC protect your sending identity. If you are tidying up public addresses, it is a good moment to check the other side too — the SPF generator, DKIM generator and DMARC generator cover that half.
Mailneo watches your SPF, DKIM and DMARC records and tells you when something breaks, so the mail you send lands as reliably as the mail you receive. Start free — no credit card required.
Get Started Free