Why obfuscate an email address
A plain mailto: link in your page's static HTML is easy for automated scrapers to harvest and
add to spam lists. This builds a small snippet that assembles the email address from character codes at runtime
using JavaScript, so a scraper reading your raw page source never sees the address as plain text, while real
visitors with JavaScript enabled still see a normal, clickable email link.
Why character-code assembly specifically, rather than other tricks
Simpler obfuscation tricks (like writing the address as "name AT domain DOT com") require a human to mentally translate it back, hurting usability, while reversing or lightly scrambling the string is trivial for even basic scrapers to reverse. Assembling from numeric character codes at runtime keeps the visible result a perfectly normal, clickable link for real visitors while giving simple static-HTML scrapers nothing readable to extract.
What this protects against, and what it doesn't
This is a deterrent against simple scrapers, not a strong security measure - a scraper that executes JavaScript can still extract the address. It mainly stops the high-volume, low-effort harvesting that scans raw page markup for "@" patterns, which is still the overwhelming majority of address-harvesting bots in practice.
The trade-off worth knowing before using this
Because the link only appears once the script actually runs, visitors with JavaScript disabled (a very small minority, but not zero) won't see the link at all - if reaching that audience matters for a particular page, a contact form avoids this trade-off entirely while still protecting the address.