Email Privacy

Email Privacy Checker — Find Exposed Email Addresses

Every email address written as plain text on a public webpage is vulnerable to spam harvesting. Automated bots crawl websites continuously, scanning HTML source code for patterns that match email addresses. Any address found gets added to spam databases and targeted with unsolicited messages, phishing attacks, and scam attempts.

This free Email Privacy tool scans any webpage URL and identifies all plain-text email addresses exposed in the HTML source. Enter your domain or any page URL to see which addresses are visible to bots and need to be protected.

Once you know which addresses are exposed, you can replace them with protected alternatives that display correctly to human visitors but cannot be harvested by automated scrapers.

How Spam Bots Harvest Email Addresses

Spam bots are automated programs that crawl the web just like search engine spiders. They download page HTML and use regular expressions to find strings matching standard email format ([email protected]). Any email found in plain HTML — whether in body text, footer, contact pages, or mailto links — is immediately collected.

The harvested addresses are sold to spammers, used for phishing campaigns, or targeted by credential-stuffing attacks. A single exposed company email address on a contact page can result in hundreds of spam messages per day.

How to Protect Email Addresses on Your Website

Use a contact form. The most effective protection. Replace email addresses entirely with a contact form so no address appears in the HTML at all.

JavaScript obfuscation. Write the email address using JavaScript that assembles it at runtime. Bots that do not execute JavaScript cannot harvest it.

HTML entity encoding. Encode the @ symbol and characters as HTML entities (e.g., @ for @). Browsers display it normally but simple regex crawlers miss it.

Image-based display. Display the email as an image. Not accessible and not recommended for usability, but prevents text harvesting.

Replace @ with [at]. Writing user[at]domain.com is readable to humans and blocks simple regex harvesters, though not sophisticated ones.

Related Tools

• View Page Source – See the full HTML source of any page.
• Blacklist Lookup – Check if your domain is on spam blacklists.
• Links Count Checker – Count all links on a page.

Frequently Asked Questions