Skip to content
Lizely

Email Address Obfuscator

Convert a validated email address into an entity-only mailto anchor that deters basic plaintext scrapers while remaining clickable in ordinary browsers.

Privacy: your files never leave your device. All processing happens locally in your browser.

How to use

  1. 1.Enter the public email address and generate the numeric-entity HTML anchor locally.
  2. 2.Copy the complete anchor into an HTML source template rather than a rich-text editor that may rewrite entities.
  3. 3.Open the delivered page, inspect its source and test the mailto link; use a protected contact form when real abuse resistance matters.

About Email Address Obfuscator

Email Address Obfuscator turns an email address into an HTML anchor whose visible text and mailto target use decimal numeric character references. A browser decodes those references when rendering the page, while a very basic scraper that searches source text only for ordinary address patterns may miss it. Processing stays in the browser.

The generated source contains no literal address characters. Each Unicode code point becomes a form such as a for lowercase a, and the href encodes the complete mailto prefix plus address. Paste the resulting anchor into an HTML source context, not into a rich-text field that may render or rewrite the entities immediately.

This technique is obfuscation, not security. Modern crawlers can parse HTML, decode numeric entities, inspect the DOM or follow mailto links. A publicly rendered address remains discoverable to visitors and capable bots. The tool makes no promise that it will reduce spam and should never be treated as access control or privacy protection.

Input validation accepts a practical unquoted email form. It requires one @ character, a nonempty local part, a domain with multiple labels and no whitespace or control characters. Leading, trailing or consecutive dots in the local part are rejected. The local part keeps its original case and supported punctuation.

The domain is lowercased and passed through the browser URL host parser. Internationalized domains are serialized to their ASCII-compatible form so the output can be reproduced across browsers. IPv4 literals and single-label hosts are rejected because this page is intended for ordinary public website addresses, not every mailbox syntax allowed by specialized systems.

The validator is deliberately narrower than the full email standards. Quoted local parts, comments, domain literals and unusual legacy forms are not accepted. A narrow contract avoids presenting a permissive but misleading validator and fits the common contact-address use case. It does not test whether the mailbox exists or can receive messages.

The output uses decimal entities rather than JavaScript assembly. JavaScript-dependent address injection can fail when scripts are disabled, conflict with content security policy and add more moving pieces. Numeric references keep the result as ordinary HTML, but that simplicity also makes decoding straightforward for competent crawlers.

Mailto links can expose addresses when visitors click, copy the link or inspect the rendered DOM. They can also launch a configured email application. Do not embed secret addresses, credentials or private aliases. For meaningful abuse resistance, use a server-side contact form with validation, rate limiting and appropriate spam controls.

Tests cover exact entity output for the complete anchor, plus-addressing, domain case normalization, an internationalized domain, missing or repeated @ signs, invalid dots, single-label domains, IP addresses and whitespace. Exact expected source is asserted so a partial encoding regression cannot look successful.

To use the tool, enter the public contact address, generate the anchor and copy the code into a controlled HTML template. View the delivered page, confirm the text is correct and click it once to verify the mail client receives the intended address. Inspect page source to confirm your CMS did not decode or double-escape the entities.

If a content-management system converts a back to a before publishing, the obfuscation is gone. If it changes the ampersands to a, visitors may see entity text instead of the address. Always validate the real public output rather than relying on the copied snippet alone.

Choose this tool only when lightweight source obscurity is acceptable. A contact form, disposable role address, filtering rules and mailbox provider controls offer more practical defenses. The page states the limitation next to the result because an email obfuscator should not create false confidence.

Methodology & sources

The address is trimmed, validated as one practical unquoted local part plus a normalized public domain, then every code point in both visible address and mailto target is emitted as a decimal numeric HTML character reference inside one anchor element.

Frequently asked questions

Related tools

SEO & Webmaster guides

View all