maybe i am wrong – but i normaly use this:

in HTML:
<a href="#" class="cryptedmail" data-davor="stuttgart43" data-wohin="juweliere-kraemer" data-ende="de" ></a>

in css

.cryptedmail:after {
content: attr(data-davor) "@" attr(data-wohin) "." attr(data-ende);
}

There’s no doubt that bots can parse JavaScript and HTML encoded characters now… maybe not all of them, but probably a lot more now, especially with the importance of JavaScript crawlers and client-side code being almost fully parsed by Google’s own bots.

So what would be the best solution? Would an initial ajax call, only triggered once user interaction is detected (keyboard event, click event, scroll event, focus events, visibilitychange event) with crsf code / nonce to validate the request does come from the intended website… is it overkill?

I just feel spammers will always find a way to spam no matter how careful you are.

Nice idea!

Do you know if it actually works against bots?

Pssst – don’t tell. Spambot could be updated to recognise Entities! Up to now (for simplicity) they only scan for the @-sign.

Since it decodes the string in the comment, for display I use the UTF-8 code 64 for the @ and the code 46 for the dot and put blanks in between so that the email looks like above but a regex parser would fail to recognize it.

  function OpenMail()
  {
     var name = "email";
     var at = "@";
     var domain = "address";
     var dot = ".";
     var tld = "com";
     var address = name + at + domain + dot + tld;
     location.href = "mailto:" + address;
  }

email @ address . com

ok, I did this:

<script defer>
document.querySelectorAll('.e-mail').forEach(e => {
e.addEventListener("click", event => {
// prevent href=#
event.preventDefault();
// get the (reversed) email address of the calling anchor
z=event.currentTarget;
y=getComputedStyle(z,'::after');
x=y.getPropertyValue('content');
// reverse string rtl
v=x.split("").reverse().join("");
// remove all ""
v=v.replace(/['"]+/g, '');
// start default e-mail client (also test on mobile!)
window.location.href="mailto://"+v;
})
});
</script>

How can I make that clickable to start default mail client, ideally w/o javascript?

<a class=e-mail data-user="resu" data-website="moc.niamod" href="mailto://"></a>

The shadow DOM code:

    if (this.innerHTML.trim().length === 0) {
      let mailDisplayElt: Element | ShadowRoot = this;
      if (!!this.attachShadow) {
        mailDisplayElt = this.attachShadow({ mode: 'closed' });
      }
      mailDisplayElt.innerHTML = getMailDisplay(base64EmailAddress);
    }

Thank you for the article! The article and the comments have a bunch of good ideas.