477

Most of the time when I see someone post their email address online, especially if it's a personal address, they use something like

me [at] example [dot] com

instead of the actual email address ([email protected]). Even top members of this community use similar styles in their profiles:

jt.superuser[AT]gmail[DOT]com

quixote dot su over yonder near that gmail place

The typical rationale is that this kind of obfuscation prevents the email address from being automatically recognized and harvested by spammers. In an age where spammers can beat all but the most diabolical captchas, is this really true? And given how effective modern spam filters are, does it really matter if your email address is harvested?

7
  • 10
    Google's word on this is that turning @ into at of any form makes it easier to find on Google. Even with a ten year old hotmail address, I can link nearly all of my spam to times I gave away my address (fake names, etc). I don't get much spam from my email being publicly findable.
    – tobylane
    Jan 21, 2011 at 10:53
  • Here's an alternative: iconico.com/emailProtector
    – paradroid
    Jan 21, 2011 at 11:44
  • @Saytha Looks like Ivo submitted it too. Probably better to vote up that one instead. Jan 21, 2011 at 18:10
  • 6
    Dupe: it was asked 1 year ago on SO. The interesting thing is that the accepted answer was the same of this post linking the same article Jan 22, 2011 at 0:22
  • It's not obfuscation, but I would say this is a good place to use disposable email addresses and rotate the addresses periodically (ie, automatically), with the idea that harvesters won't use the information as quickly as legitimate correspondents will.
    – Stephanie
    Jul 28, 2011 at 1:02

14 Answers 14

567

Some time ago I stumbled upon the post of someone who created a honeypot and waited for differently obsfucated email-addresses coming back:

Nine ways to obfuscate e-mail addresses compared

CSS Codedirection 0 MB spam

<span style="unicode-bidi:bidi-override; direction: rtl;">
moc.elpmaxe@zyx
</span>

CSS display:none 0 MB

xyz<span style="display:none">foo</span>@example.com

ROT13 Encryption 0 MB

[email protected]

Using ATs and DOTs 0.084 MB

xyz AT example DOT com

Building with Javascript 0.144 MB

var m = 'xyz';         // you can use any clever method of
m += '@';              // creating the string containing the email
m += 'example.com';    // and then add it to the DOM (eg, via
$('.email').append(m); // jquery)

Replacing '@' and '.' with Entities 1.6 MB

xyz&#64;example&#46;com

Splitting E-Mail with comments 7.1 MB

xyz<!-- eat this spam -->@<!-- yeah! -->example<!-- shoo -->com     

Urlencode 7.9 MB

xyz%40example.com

Plain Text 21 MB

[email protected]

This is the original statistical graph made by Silvan Mühlemann, all credit goes towards him:

The Stats as it was made by Silvan Mühlemann

So, to answer the question: Yes, (in a way) email obfuscation works.

24
  • 74
    Unfortunately, what this doesn't show is the number of real users who avoided sending email because the address was hard to retrieve in the various formats. I'm sure that number would be small, but it's unlikely to be zero
    – Gareth
    Jan 21, 2011 at 12:02
  • 21
    @Gareth: the real-email-addresss is plainly visible with methods 1, 2, 6, 7 and 8, with 2 and 5 they are (re)built by jscript and are again clearly visible and even work with "mailto:" (coz the jscript modifies the dom so it all looks good). you will notice that the most effective methods are the ones that result in "the user has to do nothing to read / interpret" the mailaddress. "visible" means "you can just copy N paste the email off your browser.
    – akira
    Jan 21, 2011 at 13:53
  • 14
    I'd like to see this study redone with methods that produce mailto: links rather than simple text email addresses. A spambot might react differently if it sees a mailto: with an obfuscated address in, whether the de-obfuscation is done by JS or human intervention - it's a strong hint there's a mail address there - but mailto: links are a lot more useful to readers.
    – ijw
    Jan 21, 2011 at 17:00
  • 62
    When I copied the rtl example on the linked page (Chrome 8, Mac), moc.etalllit@7raboofnavlis ended up on my clipboard. So, maybe this is not so practical for real-world use.
    – s4y
    Jan 21, 2011 at 18:14
  • 4
    It's a shame that the rtl idea is not compatible with simple copy/paste, it was a creative solution.
    – wildpeaks
    Jan 25, 2011 at 15:32
53

There was an interesting article by Cory Doctorow recently on this subject here which argued that email obfuscation doesn't serve much purpose, and a more optimal approach is intelligently managing the spam you get.

TL;DR version:

  • The objective of this entire exercise is not to reduce the amount of spam you get in your email, but the amount of spam you manually have to remove from your inbox.
  • Email obfuscation is a constant battle to come up with ever sophisticated bot-proof, human-readable encoding, and is a drain on the productivity of both the creator, and the correspondent.
  • "Almost any email address that you use for any length of time eventually becomes widely enough known that you should assume all the spammers have it."
  • "The convenience of stable, easily copy-pastable email addresses" wins over trying to hide from the spambots.
5
  • 14
    This is true iff you believe that spam's cost is entirely in the mental effort of processing it. If you believe that some of spam's cost is in bandwidth, or in maintaining spam filters, then preventing spam reaching your inbox in the first place is a worthy goal. Both of these elements have an ongoing cost (a parallel to the 'improving your obsfuscation' element in the discussion), it's just that services like Google are willing to provide it for the price of being able to read all your private correspondence.
    – ijw
    Jan 24, 2011 at 14:05
  • 4
    @ijw - The ongoing cost of a team of a few people at Google maintaining the spam filter system will always be less than making their hundreds of millions of customers do anything at all. Assuming that spam is kept to a reasonable amount, the bandwidth probably isn't much of an issue either. Jan 25, 2011 at 21:08
  • 14
    The tldr version is longer.
    – Synetech
    Feb 20, 2012 at 1:41
  • 8
    @Synetech: the poster probably meant that reading the linked article was the long version. Mar 29, 2012 at 14:04
  • If the obfuscation is complicated enough it will take spammers considerable resources to get the email address (because by Rice's theorem there is no way of predicting the output of a given program without running it). Let's say it takes 3 seconds on a decent computer to decrypt the email address. It would be fine for a humans. Not so for bots which are doing it on a huge scale. In short, it makes it very costly for bots to get the email addresses.
    – Kaveh
    Jul 22, 2013 at 20:07
29

So many people still use @ and . outright that there's little need for a spammer to come up with a way to defeat any sort of obfuscation; work not done is money/time not spent.

4
  • 13
    True, and spammers probably realize that people that obfuscate their email address don't want and won't fall for spam anyway, but on the flip side there are some harvesters that get paid per address for whom it would be trivial to identify some of the basic obfuscation patterns (having "gmail" on the page is a start) Jan 21, 2011 at 4:59
  • 5
    Exactly. Not to mention the performance hit on a parser to use such a pattern when processing that much data.
    – user1931
    Jan 21, 2011 at 5:06
  • 5
    I don't obfuscate my email, fwiw I haven't seen any difference w/ & w/o obfuscation. Even if it does go through, Gmail does a pretty good job of catching spam, and even if it doesn't I just hit that Report Spam button.
    – Sathyajith Bhat
    Jan 21, 2011 at 5:32
  • 8
    OTOH, if a spammer see an obfuscated mail address, he can be sure that this is a really used email address, else why obfuscating it?. Note that the spammer doesn't care if spamming is effective, but he cares how many of the recipient actually get the spam. He sells spam services, not products. Jan 21, 2011 at 7:40
28

Anything that is done by lots of people will be defeated, but if you hide your email address in a way that not many web sites do, then the spammers will not invest the money in finding it. (They are trying to make money so will only invest a lot when the returns are high.)

So don't use a method other people use, come up with your own, this is one I have just come up with: (Don't all copy it, or it will stop working)

Email remove all numbers and use the same domain as my web site is on [email protected]

4
  • 1
    Spammers depend on "spamware vendors" to take care of the technical details involved with extracting eMail addresses from web sites (and from other sources, such as word processor documents and spreadsheets, sometimes obtained via SpyWare). So, you'll be fine until a spamware vendor notices what you're doing (and can figure out how to counter it). +1 because this answer uses a logical argument that is generally correct. Aug 12, 2011 at 4:13
  • @Randolf, no "spamware vendors" will make the efort for less then a few 100 email address, so anythink that is "different" is lickly to work as a one of for most people's website Aug 12, 2011 at 15:02
  • I actually agree with you (and I see your comment as further support for mine) because the spamware vendors will view that as a feature that sets them ahead of their competition (namely, other spamware vendors) -- your estimation of less than a few hundred eMail addresses seems correct to me (+1 for your comment, except it's not working as a pink box appears so I'll try again later). Aug 12, 2011 at 16:38
  • 3
    > Anything that is done by lots of people will be defeated Agreed, but replace “defeated” with exploited. That’s why hackers have seldom bothered with writing malware for Apples or Linux. Whether or not they are “more secure than Windows” is irrelevant; those targets were simply not worth the time. At least, that used to be the case. These days, Apple has a much bigger user base, making for a more attractive target, and Linux is used on more business servers. It is the same with security measures. If cracking it gains you little, most won’t bother. If cracking it gains you the world, well…
    – Synetech
    Feb 20, 2012 at 1:50
18

Spammers are not the NSA. It is not important for them to crack your obfuscation. Any effort made to disguise your email address is probably sufficient to the task.

The more interesting question is, why not just use a disposable email account as a cutoff to filter responses on public forums? That way you don't care if the account gets spam, and after vetting legitimate responses you can contact your correspondents via your regular email account.

1
  • 1
    +1 for a solution that works well for short-term needs. Aug 12, 2011 at 4:15
11

Yes it is true in most cases because you need a pattern for email harvesting, the more complex the pattern the more expensive (time/money) it is for spammers to work at getting emails. Of course nothing stops manual harvesting, but that is very low. The thing that is usually done is non JS encoded, plain text emails are harvested (check any 1-2 year old website that is unchanged, and I bet you $20 bucks its plain text email and they get tons of spam).

At my company all the external facing emails are obfuscated using a series of server side & JS client side methods.

So an email never really looks like an email, and the pattern ALWAYS changes. You would be surprised how well this method works, sure some methods are compromised and easily broken, but more elaborate methods of email obfuscation usually make the harvesting pointless as the sheer amount of pattern detection would require a lot of invested resources.

Brute force of CAPTCHAS is different, where the hackers/spammers/harvesters TARGET a specific site. This does not really apply to small mom & pop websites who might use a myriad of obfuscation methods, or sites where users post different format emails in a variety of email obfuscation ways (omitting the .com or .net, etc).

Most harvesters are not Javascript aware, that is they do not process JS. Making those methods more costly for harvesters. There are some harvesters that do try to process JS, but like I said it is very costly when you are running millions of emails in a matter of minutes, you don't want to go down to 10s or 100s if you can do 1000s.

My method of doing an each time random method works very well, I have yet to get any spam on my account.

1
  • Neat idea using JS to obfuscate the email address, but in most cases (like in an email, on this site, etc) that's not really an option. However, I agree that it should be standard practice on sites that allow users to expose their email to other users. Jan 21, 2011 at 5:03
11

I have 2 obfuscation methods not mentioned. Neither affords the benefit of being a clickable link, or even cut-and-paste.

  • Use a graphic element instead of text.

  • Line the elements up vertically, with columns of other stuff to the left and/or right:

email     dummy@
me at:    example.com
3
  • 2
    Some spammers are using OCR to get around the graphic element, but as far as I know this is still quite rare so that should continue to work fine for you as long as blind users don't need to contact you. +1 for sharing some useful ideas. Aug 12, 2011 at 4:10
  • 1
    Well this is a great way to ruin your UX. Not just for blind people, for everyone. Aug 5, 2019 at 14:57
  • 1
    @FabianvonEllerts I don't deny it. That's a trade-off everyone must make for themselves. Aug 5, 2019 at 15:42
8

JS obfuscation does work up to a point with simple wget based harvesters, but I guess that JS enabled IE instances are also being employed, and they can read what the webuser would see.

When the address is harvested, or stolen via a security breach on one of your favourite sites as it eventually will, it'll be out there being replicated on spammers lists forever.

My own email address is so old it predates spam, and therefore visible all over the net, so I get thousands of attempts to deliver per week... bring it on! I have had time to develop a sophisticated system that effectively turns it into a spamtrap, with high scoring stuff auto reported to spamcop to aid the community.

Spam will be defeated one day, and I seen encouraging signs that it is in decline.

7

I put my email address in the clear on the web everywhere, and contrary to popular belief this doesn't seem to have any effect on the amount of spam that I receive. It's been stable at an average of 3 per day for a long time. So I'd say that obfuscation is useless.

I do notice that very short usernames (e.g. [email protected]) result in more spam. Apparently the email addresses used by spammers are simply generated by trying all possible short letter combinations, and by using name lists.

1
  • There's a lot of guessing, dictionary attacks, and various other techniques being used by spammers. Also, common addresses like info@ and sales@ are just assumed to pretty much always be valid (and often are for many domains). There's also a time delay wherein spam increases for an address the longer the spammers know about it because they sell lists to each other. I operate a number of spam traps and have noticed that the spam generally increases over time despite blocking based on a combination of DNS-based blacklists and filters. Aug 12, 2011 at 4:06
6

One thing that worked very good for me is using ASP.NET to create a "LinkButton". This linkbutton then has a Response.Redirect("mailto:MailAddress"); as the "onClick" action. This will result in the LinkButton having a javascript:DoPostBack(...) as the URL. In the end it makes a server request which returns a "redirect to the mail address". The farm bots never got this email.

5
  • 3
    probably no user had a chance to complain about unability to send any feedback too :) Jan 21, 2011 at 16:09
  • 1
    this will only work if a lot of other people don't start doing it. Jan 21, 2011 at 16:55
  • @Worm: This worked with every browser I've tested it. If you redirect to a mailto, it'll work. @Ian: Yeah, I hope it stays that way, or bots will start listening for redirects on JS postbacks. If you put a ScriptManager there it will go a lot more... "obfuscate" though. It will first make a JS AJAX postback with then returns a command to go to the mailto.
    – sinni800
    Jan 21, 2011 at 22:35
  • 1
    I'd like to see generated code for it, as i have no idea about ASP.NET stuff Jan 22, 2011 at 0:33
  • 1
    metalgearsonic.de/default.aspx Here you go, WormRegards. Server Side AND client code readable here.
    – sinni800
    Jan 22, 2011 at 13:40
4

I don't think it helps a whole lot using standard [AT] and [DOT], but using either words that mean things or can be realized to mean at and dot...or even _A((T>> or anything else that is reasonably random...just my thoughts on the matter.

4

If you try to search for email-adresses with google, you will find out, that it is really hard, and google for some reason has not much of them in the form "[email protected]" - maybe a self restriciton?

If I search for "maier[at]berlin.de", I find more hits, than if I search for "[email protected]", and the @ seems to work as a joker sign. The hits aren't really mailadresses.

And on the other side, you want your customers (if you have such, and contact them in the web) use a comfortable mailto-link, without fiddling around and removing fancy pants.

So if you still don't trust google, bing, bong and zong (maybe they sell mailadresses seperately?), you can compose your email adress with a little bit of Javascript:

"mailto" + ":" + "wagner" + "." + "stefan" + "@" + "paris" + "." + "de" 

I guess most webcrawlers don't interpret Javascript, and will have a hard time, finding your adress in a big, automated and cheap process.

3

From my experience with the Sblam! anti-spam service there's a lot of technically incompetent spammers, who nevertheless keep trying, probably because there's a lot of unprotected emails to harvest (and unprotected sites to spam), so even simple obfuscation might stop some harvesters.

OTOH updating regular expression in a harvester to look for (@| AT ) is not rocket science and probably many spammers have done it already.


Puzzles that annoy humans are not worth it. I've devised a standards-compliant obfuscation that encodes mails with entities, urlencoding and adds unusual constructs to the URL and HTML (source code):

http://hcard.geekhood.net/encode/[email protected]

This gives a link that is readable and fully functional for real users, but can be harvested only by spammers who take effort to parse HTML and URL correctly (it might avoid some spam, or at least it promotes web standards among harvester writers! ;)

2
2

Since email lists are sold, one company can figure out the easy one and then others can use it. In that way it is similar to any DRM.

1
  • 2
    What do you mean by "one company can figure out the easy one"? Feb 3, 2012 at 9:41

Not the answer you're looking for? Browse other questions tagged .