Email obfuscation: What works in 2026?

(spencermortensen.com)

49 points | by jaden 4 hours ago

7 comments

  • fmajid 1 minute ago
    I use SVG where I created a text object in Affinity Designer and converted it to curves so the SVG doesn't have text any more, just vectors for the glyphs of it. Seems to work pretty well at keeping spammers at bay.
  • dandersch 30 minutes ago
    Very interesting. It seems for his own email the author has opted for a combination of the CSS display none technique and a XOR cipher:

      <span class="hidden email"><b>999a8f84898f98</b>aa<b>878b8386c4</b>999a8f84898f988785989e8f84998f84c4898587</span>
  • bit1993 1 hour ago
    Good stuff, but I think the title should be Email address obfuscation. Thank you for sharing I guess, but spammers can now learn from this too (:
  • newscracker 1 hour ago
    > HTML entities are often decoded automatically by server-side libraries, which means that even the most basic harvesters can get your email addresses without any special effort. This technique should be worthless—and, yet, it still stops most harvesters.

    Anecdotal, but I’ve used HTML entities on a public static website for a long time using an href tag with mailto, and yet I’ve not seen any spam.

    I guess any spammer who uses some level of GenAI to process and extract email addresses would have a lot more success against all the methods listed in this article.

  • _ache_ 1 hour ago
    I'm sorry, but that is not how email address are spammed in bulk.

    The data-source are the enormous data breach that are more and more frequent. There is more intensive to collect more information on someone you already know something about than spamming an email you don't even know if it's a valid one.

    The spam can also be very more effective as it present itself with personal information about the spammed.

    • curiousObject 1 hour ago
      The OP put those addresses on that web page, and only on that web page. Some addresses received spam.

      Edit: that’s not to deny that big data leaks are a serious problem

  • gfody 1 hour ago
    I filter everything that does NOT include “+asdf” in the to: