Will this stop spam bots on my Windows-published site?

No guarantee. Entity obfuscation can deter a very basic scraper that only matches literal address text, but modern crawlers parse HTML, decode numeric references, inspect the rendered DOM, and follow mailto links just like any browser would.

Why did Notepad or my CMS change a back to a?

Rich-text editors and some CMS Visual tabs decode entities on paste, which removes the protection before the page is published. Paste into Notepad, Visual Studio Code, or the CMS HTML source view instead, then save and view source to confirm the entities are still present.

Does this work with internationalized email domains in Edge?

Yes. The domain is lowercased and passed through the browser URL host parser, and internationalized domains are serialized to their ASCII-compatible form so the output reproduces the same way across Edge, Chrome, and Firefox on Windows.

Why was my unusual but valid mailbox rejected?

The tool intentionally supports a practical unquoted address subset rather than every complex legacy syntax. Quoted local parts, comments, domain literals, IPv4 hosts, and single-label domains are not accepted because the page targets ordinary public website addresses.

Does the generator send my address to a server?

No. Validation and entity encoding happen in the browser on your local Windows machine. Closing the tab clears the input and the result, so nothing is uploaded and nothing is stored remotely.

Email Obfuscator on Windows: A Desktop Browser Workflow

Email obfuscator on Windows means running a browser-based generator such as Email Address Obfuscator in Edge or Chrome, copying the resulting mailto anchor into an HTML file edited with Notepad or Visual Studio Code, and verifying that your content management system did not silently rewrite the numeric character references back into literal address text. The generated anchor encodes every code point of the visible address and the mailto target as a decimal numeric HTML character reference, so the letter a becomes a in the source. A browser decodes those references during rendering while a scraper that only matches plain text patterns may skip past. Processing happens entirely in the browser tab on the local Windows machine, so the address does not travel to a server. The whole workflow can be completed without installing software, signing up for an account, or touching a registry entry, because the tool is a static page that performs validation and entity encoding in client-side JavaScript.

Why a Browser-Based Generator Fits a Windows Workflow

Windows users typically work in either Microsoft Edge or Google Chrome for everyday browsing, and the static generator page runs in both without any plug-in, extension, or download. The address, the validation outcome, and the encoded anchor all live in the same browser tab; closing the tab clears the input. This matches the expectations of a Windows user who wants a one-off snippet without installing a small utility that would sit in the Start menu and update itself. The page also accepts internationalized domains and serializes them to their ASCII-compatible form per the browser URL host parser, which keeps the generated output reproducible between Edge and Chrome. For anyone searching specifically for an email obfuscator on Windows, the practical answer is therefore a browser page rather than a downloaded executable, and it sidesteps the prompts, signing tools, and SmartScreen warnings that a new .exe would trigger.

How to Obfuscate an Email Address on Windows

Open Microsoft Edge or Google Chrome on Windows and load the Email Address Obfuscator page.
Enter the public contact address in the practical unquoted form: a nonempty local part, one @ character, and a domain with multiple labels.
Click the generate action and wait for the complete anchor, including both the opening tag and the closing tag, to appear in the result area.
Click the copy control and confirm that the clipboard contains the full anchor element rather than only the visible text.
Open Notepad or Visual Studio Code and create or open the HTML template where the address should appear; ensure the file is saved with UTF-8 encoding without a byte order mark so that numeric references round-trip cleanly.
Paste the copied anchor into the template at the exact location where the address should render, then save the .html file.
Double-click the saved file to open it in your default Windows browser, click the link once to confirm the configured mail client receives the intended address, and use Ctrl+U to view source and confirm every code point is still a numeric reference.

Pasting Into Your CMS or Static Template on Windows

The most common reason entity obfuscation silently breaks on a Windows workflow is the editor that receives the snippet. WordPress, the WYSIWYG tabs in Drupal and Joomla, Outlook message composition, and even a basic rich-text email signature field will decode a back into the literal letter a the moment you paste into them, which removes the protection before the page is ever published. Always switch the CMS to its HTML source, Code view, or Plain Text Composer before pasting. Notepad and Visual Studio Code both treat pasted content as plain text and preserve the ampersands, so they are reliable intermediate editors. Save HTML files as UTF-8 without a BOM in Notepad by choosing Save As, setting Encoding to UTF-8, and avoiding the UTF-8 with BOM option, because a BOM can occasionally confuse older ASP.NET templates running on Windows servers. If the CMS converts a into a doubled escape such as &#97; on save, visit the live page and view source to confirm what actually shipped.

Verifying the Output in Edge, Chrome, and Firefox

Verification is what separates a working Windows workflow from wishful thinking. After publishing, open the live page in Edge and press Ctrl+U to view source; search the source for the @ character and confirm you do not see a literal address, only the decimal reference @ or the full sequence of decimal references inside the mailto target. Click the link once to launch the configured Windows mail client, whether that is Outlook, Thunderbird, or Windows Mail, and confirm the address that arrives in the To field matches the one you typed. Repeat the same check in Chrome and Firefox if cross-browser support matters. If you see a small fragment of entity text such as a rendered as visible characters instead of the letter a, your template is double-escaping the ampersand, and the snippet needs another pass through the editor. For the formal definition of decimal and hexadecimal numeric character references, the WHATWG HTML Living Standard documents the parsing rules at html.spec.whatwg.org character references.

Limits of Entity Obfuscation and Safer Alternatives

Numeric-entity obfuscation is a readability trick for very simple plaintext scrapers, not a security control. Modern crawlers parse HTML, decode decimal references, walk the DOM, and follow mailto links just as a browser would, so a publicly rendered address remains discoverable to any competent visitor or bot. Mailto links also expose the address when a visitor clicks, copies the link target, or inspects the rendered DOM with developer tools. For these reasons the tool states its limitation next to the result and should never be the only defense on a Windows-hosted contact page. Practical alternatives include a server-side contact form with field validation and rate limiting, a disposable role address such as contact@ or info@ that can be rotated without changing the visible link, and mailbox provider controls that filter obvious junk. Entity obfuscation still has a place as one lightweight layer when the address must remain clickable, but it should be paired with at least one of these stronger measures. For a side-by-side reference of the rules, see the related Email Obfuscator Cheat Sheet: Output Rules and CMS Risks.

Output Rules and CMS Risk Patterns at a Glance

Input or Output Aspect	How the Tool Behaves on Windows
Accepted address shape	One @, nonempty local part, multi-label domain, no whitespace or control characters
Local part handling	Original case preserved; supported punctuation kept; leading, trailing, or consecutive dots rejected
Domain handling	Lowercased and normalized to an ASCII-compatible form for internationalized domains
Output format	Decimal numeric HTML character references for every code point in both visible text and the mailto target
Rejected inputs	IPv4 literals, single-label hosts, quoted local parts, comments, and domain literals
Common Windows CMS risk	Rich-text fields such as WordPress Visual or Outlook compose decode a back to a on paste

Choosing When Entity Obfuscation Is the Right Tool

The right time to pick entity obfuscation on Windows is when you need a clickable contact link, accept that any competent crawler can still decode the address, and want one extra layer beyond a plain mailto. The wrong time is when the address is meant to stay hidden from the public, when the inbox behind it is a personal alias rather than a disposable role address, or when the threat model includes targeted scraping rather than naive bulk harvesting. In those cases, a server-side contact form that validates, rate-limits, and stores messages out of band gives far more practical protection. Entity obfuscation can still ride on top of that contact form by encoding the fallback address, but the form should be the primary path. The tool's own copy is explicit about the limit, so trust that copy and plan the rest of your contact strategy accordingly, rather than treating the snippet as access control.