HN
Hacker News • 59일 전
2026년 이메일 주소 보호: 실제 효과 있는 방법
IMP 8/10
핵심 요약
해커뉴스에 2026년 현재 스팸 봇으로부터 이메일 주소를 보호하는 가장 효과적인 난독화 기법이 공유되었습니다. HTML 엔티티나 주석을 활용한 기초적인 방어만으로도 95~98%의 수집 봇을 차단할 수 있으며, CSS Display none, JS 연결, HTML SVG 활용 방법은 100%의 차단율을 기록했습니다. 여러 기술을 혼합하여 사용하는 것이 완벽한 방어의 핵심이며, 시각적 숨김보다는 'display: none'을 사용해 접근성을 함께 지키는 것이 권장됩니다.
번역된 본문
이메일 난독화(Obfuscation): 2026년에 효과가 있는 방법은? (최종 업데이트: 2026년 1월 30일)
다음은 스패머들로부터 이메일 주소를 숨기는 가장 좋은 기술과, 해당 기술들이 뚫릴 확률에 대한 통계입니다. 이상적으로는 이메일 주소를 여러 세그먼트로 분할하고, 각 세그먼트를 서로 다른 기술로 보호하는 등 여러 기술을 조합하여 사용해야 합니다.
- 일반 텍스트 (Plain text) 이 기술들은 평문으로 적힌 이메일 주소(예: “email@example.com”)를 보호하는 방법들입니다.
1.1 보호하지 않음 318명의 스패머 중 0% 차단 (예시: aa@email.spencermortensen.com)
1.2 HTML 엔티티 (HTML Entities) 318명의 스패머 중 95% 차단 (예시: ab@... 와 같은 HTML 엔티티 코드) HTML 엔티티는 서버 측 라이브러리에 의해 자동으로 디코딩되는 경우가 많습니다. 즉, 가장 기본적인 수집기(harvester)도 특별한 노력 없이 이메일 주소를 가져올 수 있습니다. 이 기술은 쓸모없어 보이지만, 여전히 대부분의 수집기를 막아냅니다.
1.3 HTML 주석 (HTML Comments) 318명의 스패머 중 98% 차단 (예시: 이메일 중간에 와 같은 주석 삽입) 이 방법은 HTML 태그를 제대로 처리하지 못하는 가장 기본적인 수집기만 막아냅니다. 최소한의 보호만 제공하지만, (대부분의 수집기가 기본 수준이기 때문에) 여전히 대부분의 수집기를 막아내는 데 성공합니다.
1.4 HTML SVG 318명의 스패머 중 100% 차단 (예시:
1.5 CSS Display none 318명의 스패머 중 100% 차단 (예시: 이메일 중간에 허위 태그를 삽입하고 CSS로 숨김 처리) 대부분의 수집기는 스타일 규칙을 적용할 수 없으므로, 이것은 가장 확실한 최고의 기술 중 하나입니다. 수집기가 어떤 부분을 생략해야 할지 모르도록 허위 태그(decoy tags)를 다양하게 변경해야 합니다. 스크린 리더를 사용하는 사용자를 포함하여 모든 사람이 완벽하게 접근할 수 있습니다. 단, 텍스트를 숨기려면 반드시 'display: none'을 사용해야 합니다. 글꼴 크기를 줄이거나 텍스트를 화면 밖으로 재배치하는 등 시각적인 숨김 기술만 사용하면 접근성이 깨지게 됩니다.
1.6 JS 연결 (JS Concatenation) 318명의 스패머 중 100% 차단 (예시: 와 같이 자바스크립트 문자열 분할) 외부 종속성이 없어 편리하며, 대부분의 수집기를 차단합니다. (원문이 여기서 끊어졌으나, 자바스크립트를 통해 동적으로 이메일을 생성하는 방식임)
원문 보기 (영어)
Email obfuscation: What works in 2026? Last updated: January 30, 2026 Here are some of the best techniques for keeping email addresses hidden from spammers—along with the statistics on how likely they are to be broken. 1 Plain text These techniques protect an email address written out in plain text (e.g. “email@example.com”). Ideally, you should be using multiple techniques in combination, by splitting the email address into segments, where each segment is protected by a different technique. 1.1 No protection Blocked 0% of 318 spammers aa @email .spencer mortensen .com aa@email.spencermortensen.com 1.2 HTML Entities Blocked 95% of 318 spammers a b @ e m a i l . s p e n c e r m o r t e n s e n . c o m ab@email.spencermortensen.com HTML entities are often decoded automatically by server-side libraries, which means that even the most basic harvesters can get your email addresses without any special effort. This technique should be worthless—and, yet, it still stops most harvesters. 1.3 HTML Comments Blocked 98% of 318 spammers ac @email .spencermortensen <!-- .example --> .com ac@email.spencermortensen .com This will stop only the most basic harvesters that struggle with HTML tags. It offers minimal protection—and, yet, still manages to stop most harvesters (since most harvesters are basic). 1.4 HTML SVG Blocked 100% of 318 spammers < object class = "email" width = "130" height = "24" data = "email.svg" type = "image/svg+xml" ></ object > < svg viewBox = "0 0 130 24" xmlns = "http:// www.w3.org /2000 /svg" > < style > @ import url ( 'https:// fonts .googleapis .com /css2 ?family= Indie +Flower &display= swap' ); text { dominant-baseline : middle ; fill : #000 ; font-family : 'Indie Flower' ; font-size : 16px ; text-anchor : middle ; } </ style > < text x = "50%" y = "50%" > email @example .com </ text > </ svg > object . email { height : 2em ; margin : -1em 0 ; vertical-align : middle ; } Inspiration: rouninmedia.github.io This hides the email address in an unusual place where most harvesters won’t think to look. However, the email address is stored there in plain text. This technique is accessible to all users, including those who depend on a screen reader. But you must use an object element for this to work: an img element would give you an image that is non-interactive, and inline SVG would put the email address in the source code where harvesters would find it easily. The “width” and the “height” attributes help prevent layout shifts while the page is loading. Because the dimensions depend on the font, the SVG file has to explicitly specify a web font to prevent rendering issues. 1.5 CSS Display none Blocked 100% of 318 spammers < div class = "email" > ad @< span >email.</ span > spencermortensen. < span >example.</ span > com </ div > div . email > span : nth-child ( 2 ) { display : none ; } ad@ email. spencermortensen. example. com Most harvesters are unable to apply style rules, so this is one of the absolute best techniques. Be sure to vary the decoy tags so the harvester won’t know which parts to omit. This is fully accessible to everyone, including those who depend on a screen reader. But you must use “display: none” to hide the text: if you use any visual-only technique (such as shrinking the font size, or repositioning the text off screen), then you’ll break accessibility. 1.6 JS Concatenation Blocked 100% of 318 spammers < script >document.write( 'a' +'i' +'@' +'e' +'m' +'a' +'i' +'l' +'.' +'s' +'p' +'e' +'n' +'c' +'e' +'r' +'m' +'o' +'r' +'t' +'e' +'n' +'s' +'e' +'n' +'.' +'c' +'o' +'m' ); </ script > This is convenient because it has no external dependencies, and yet still manages to block most harvesters. However, the full email address appears directly in the HTML source code, so this technique cannot be considered safe. 1.7 JS Rot18 Blocked 100% of 318 spammers < span class = "email" > nw @rznvy .fcraprezbegrafra .pbz </ span > < head > < script src = " text-rot18.js " defer > </ script > </ head > nw@rznvy.fcraprezbegrafra.pbz This technique can be undone by basic harvesters that don’t interpret JavaScript. At the very least, you should rotate your letters by something other than 13, and rotate your numbers by something other than 5. 1.8 JS Conversion Blocked 100% of 318 spammers < span id = "text-conversion" > zibby example com </ span > < head > < script src = " text-conversion.js " defer > </ script > </ head > zibby example com In this technique, the HTML source code contains gibberish, and you write a custom function that converts the gibberish into a working email address. Most harvesters can only access the HTML source code—and the source code contains nothing of value. The only practical way to restore the email address is to run your custom conversion function in a web client with DOM and JavaScript support. This is not possible for most harvesters. You can write a custom function for each email address, or you can write a single function and apply it to all of the email addresses on the page. Despite being frighteningly simple, this is expected to be one of the very best techniques. 1.9 JS AES encryption Blocked 100% of 318 spammers < span class = "email" > K r e u z 2 x a 6 x B 8 F p j a a 0 l F g A C N L O 6 n _ A u u 1 C G j c G 8 z _ E c </ span > < head > < script src = " text-aes.js " defer > </ script > </ head > Kreuz2xa6xB8Fpjaa0lFgACNLO6n_Auu1CGjcG8z_Ec This technique uses AES 256 to encrypt the email address. (AES is the only publicly-available cipher approved by the NSA for top secret information.) The email address cannot be recovered without the JavaScript file—which most harvesters cannot access or run. This implementation uses the browser’s own built-in cryptography library, so it will not run outside of the browser, even in JavaScript-capable environments. The cryptography library, SubtleCrypto , is only available in secure contexts (such as over https or on localhost)—which could be a blocker if you’re using http. You must upgrade to https before you can use this technique! 1.10 JS User interaction Blocked 100% of 318 spammers < span id = "text-interaction" > whose baby example com </ span > < head > < script src = " text-interaction.js " defer > </ script > </ head > whose baby example com This technique keeps the email address hidden until the user interacts with the page; only then is the email address revealed. This raises the bar for harvesters: they not only need to run a full web client, they also need to interact with it. This technique can be used to trigger other techniques. 1.11 HTML Symbol substitution Blocked 97% of 318 spammers ag AT email DOT spencermortensen DOT com ag AT email DOT spencermortensen DOT com This technique is well known, and easily reversible, so it cannot be considered safe. Breaks usability. This forces the user to undo every substitution before they can send their email. 1.12 HTML Instructions Blocked 100% of 318 spammers au.fluff@email.spencermortensen.com (remove the “.fluff” before writing to me) au.fluff@email.spencermortensen.com (remove the “.fluff” before writing to me) In general, only a human or an AI can break this. It’s mainly useful for when you need to publish your email address on an untrusted site. This is at minimum inconvenient for your users, and may prevent them from reaching you at all. Breaks usability. The user has to understand and follow the instructions perfectly, or they will be unable to reach you. 1.13 HTML Image Blocked 100% of 318 spammers < img src = " email.jpg " width = "216" height = "18" alt = "email address" > This is inconvenient or inaccessible for every one of your users. Breaks usability. Sighted users are forced to type out the full email address by hand. The