Email obfuscator: hide your email address from spam bots on a website
In short: Five copy-paste snippets for one address, optional link text and subject: split address with the mailto set on hover, focus or tap; link built by JavaScript with an [at] [dot] fallback; HTML-entity mailto; written-out text; CSS-reversed text. Each says what it stops and what it costs visitors. Limit: None of the methods stops a harvester that runs JavaScript and interacts with the page.
Type the address and copy one of five snippets into your page. The strongest that keeps a clickable link stores the address reversed in two parts and only builds the mailto when a visitor hovers or taps; simpler ones encode it as HTML entities or build it with JavaScript. None stops a harvester that runs your page in a real browser; a contact form is the only way the address never appears.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
The address to publish
Runs in your browser. The address isn’t sent anywhere.
Sample result
Five snippets for hello@northwind.example; the first three stay clickable.
- Snippets
- 5
- Clickable
- 3
- Dependencies
- None
What this means for you
Paste the first one into your page: simple harvesters reading the HTML won't find the address.
- Split and reversed address
- JavaScript-built link
- HTML entity mailto
- Honest about limits
- Spam bots
- mailto
- Website
By SimpleVerifier Team · Last updated · Runs in your browser; nothing you paste is sent to us
Also in: Português (Brasil) · Español
How do I check the addresses people send me?
- Export the addresses from your contact form, signup form or inbox as a CSV.
- Upload it at /verify. Every address gets a live mailbox check, and valid, risky and invalid download as separate files. The first 100 email checks are free with a Google sign-in, no card.
- Reply to or import the valid ones.
How do I hide an email address from bots on my website?
- Type the address to publish, and optionally the link text and a subject line.
- Pick a snippet. The first keeps a working mailto link and combines two techniques; the last two aren't links at all.
- Copy it into the page's HTML (in WordPress, a Custom HTML block; in Webflow or Squarespace, an embed or code block).
- Check the link on the live page on desktop and mobile.
Example
- You enter
- The address
hello@northwind.example, link textEmail usand subjectWebsite enquiry. - You get
- Five snippets: the address stored reversed in two parts with the mailto set on hover, focus or tap; a JavaScript-built link with
hello [at] northwind [dot] exampleas the no-script fallback; an entity-encoded mailto; the written-out text; and CSS-reversed text. The first three are clickable. - Limits
- Runs in your browser.
Does email obfuscation still work?
Against the crawlers that fetch HTML and search it for name@domain, yes; against a scraper that renders the page in a headless browser, no technique on this page holds. Independent tests that publish addresses and count the spam each one gets (see the sources) find big differences between techniques, and that splitting an address and protecting each part differently does better than any single one. That's what the first snippet does.
Cloudflare does a similar rewrite automatically on proxied sites (Email Address Obfuscation under Scrape Shield). If that's on, don't add a second layer by hand; check that the address still appears correctly.
What does each method cost visitors?
The three link methods keep a normal mailto link: a visitor clicks and their mail app opens, and screen readers announce a link. The JavaScript ones show name [at] domain [dot] com to the rare visitor without JavaScript. The written-out text has to be retyped. The CSS-reversed text displays correctly but copies backwards and may be read backwards by a screen reader, so it suits places where nobody copies it.
Where the address must not be scraped at all, a contact form, or a role address you can filter or replace such as hello@, beats any obfuscation.
Who uses this tool, and for what?
- Small businesses
- Put a contact address on the site footer without it ending up on spam lists in a week.
- Web designers
- Drop a ready snippet into a client's WordPress, Webflow or Squarespace page.
- Developers
- Copy a dependency-free snippet instead of adding a plugin.
What can’t this tool tell you?
- None of the methods stops a harvester that runs JavaScript and interacts with the page.
- The JavaScript snippets need script to be allowed on the page; some site builders strip script tags.
- Reversed CSS text copies backwards and isn't reliably read by screen readers.
- It hides an address you publish; it doesn't check the addresses people send you. That needs a mailbox check.
Common questions
- Will this stop all spam?
- No. It reduces scraping by simple harvesters. Spam from addresses that were leaked, guessed or bought elsewhere isn't affected.
- Does Google still see the address?
- Google renders JavaScript, so a JavaScript-built link is usually visible to it. Entity encoding is read by every HTML parser.
- Do I need a plain mailto link instead?
- For an unprotected link with subject and body, use the mailto link generator.
- Is the address sent anywhere?
- No. The snippets are built in your browser.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.