Intro
Your contact details. Visible to people. Hidden from machines. Now every piece of text on your page can be protected the same way.
Bots and scrapers scan the web continuously, harvesting email addresses, phone numbers and personal details for spam and data brokers. Obscure Contact keeps your information out of reach, without changing anything your visitors see. Place a token where your contact should appear. At load time, Obscure assembles and renders the real value in the browser. Automated scanners find nothing useful. Email addresses can be protected using a split-token system or encoded as a single Base64 string, the same technology used for phone numbers and WhatsApp links. Both options leave nothing readable in the source code.
Not all sensitive information is a contact. Sentence B64 encodes any text string, a name, an address, an IBAN, any detail you want visible to visitors but invisible to scrapers. Nothing you write in the field will ever appear in plain text in the source code.
✓ Protect up to two email addresses using a split-token system. Each address is divided at the @ symbol and reassembled at load time, never written in full in the source code.
Before ...@ - the part before the @ symbol.
@... After - the domain part after the @ symbol.
Token - a unique key you choose. Place it in your text where the email should appear.
Label - optional. If set, replaces the email address as the visible link text.
Customize the email message: Pre-fill subject and body to give context and guide the recipient when the link is clicked.
Subject - pre-filled subject line.
Content - pre-filled body text. Delivered as a single line, no line breaks supported.
ⓘ If Subject and Content are left empty, the link opens the email client with the address only.
ⓘ A client-side protection layer, effective against most automated scrapers, not a substitute for server-side security.
Email II
✓ A second protected email slot, independent from the first. Useful for sites that carry more than one address — a general contact and a dedicated one, for example info@ and support@. Same options, same token logic.
ⓘ Use letters, numbers, and hyphens only — e.g. myToken-1. No spaces or special characters.
ⓘ Converted tokens appear as clickable links, styled according to your theme's link color.
Email B64
NEW
✓ Protect an email address with the same Base64 encoding used for phone and WhatsApp. The full address is encoded at build time as a single string and decoded at load time, never split, never written in plain text in the source code. Email - the full address in standard format, e.g. info@mysite.com. Token - a unique key you choose. Place it in your text where the email should appear. Label - optional. If set, replaces the email address as the visible link text. Subject - pre-filled subject line. Content - pre-filled body text, single line only.
ⓘ If Subject and Content are left empty, the link opens the email client with the address only.
ⓘ Unlike the Split option, this mode encodes the entire address as a single unit, leaving no readable parts in the source code.
Phone B64
✓ Protect a phone number with the same token system. The number is never written in plain text in the source, it is encoded in Base64 at build time and injected at load time via the token you place in your content.
Phone - the number in any format you prefer.
Token - a unique key you choose. Place it in your text where the number should appear.
Label - optional. If set, replaces the number as the visible link text.
ⓘ You can also use the standard Elements Button component for a more recognisable style. Simply set the button label to your token — no link required.
WhatsApp B64
✓ Generate a protected WhatsApp link. The number is handled with the same token logic and opens directly in WhatsApp — on mobile as the app, on desktop as WhatsApp Web.
Number - international format required, e.g. +39 02 1234 5678.
Token - a unique key you choose. Place it in your text where the WhatsApp link should appear.
Label - optional. If set, replaces the number as the visible link text.
Text - optional pre-filled message that appears in WhatsApp when the link is tapped.
ⓘ You can also use the standard Elements Button component for a more recognisable style. Simply set the button label to your token — no link required.
ⓘ If Text field is left empty, the link opens WhatsApp with the number only.
ⓘ This component affects the Elements code and does not add anything visible to the layout. Simply drag it in and edit the options. Then export and preview in the browser.
Sentence B64
NEW
✓ Protect any text string using Base64 encoding. The content is encoded at build time as a single unit and decoded at load time — never written in plain text in the source code. Use it for any sensitive information that is not a contact: a name, a postal address, an IBAN, a reserved code, an internal reference, a VAT number, a license key, any detail you want visible to visitors but unreadable to scrapers and indexers.
Text - any string of text, including spaces, special characters and symbols. Token - a unique key you choose. Place it in your content where the decoded text should appear.
ⓘ Unlike contact fields, this option renders plain text only — no link is generated.
ⓘ Angle brackets < > are interpreted by the browser as HTML and should be avoided.
Why hide a phone number?
There are cases where you want a number visible on the page, but not indexed by search engines. A direct line for existing patients, a personal contact for clients, a WhatsApp channel you keep separate from your main number — these are all situations where you want real people to reach you, but prefer to stay out of Google's local results and automated directories.
Enabling Base64 encoding gives you exactly that: the number works perfectly for anyone visiting the page, but search engines and scrapers find nothing to index.
Is it really secure?
For most automated scanners — yes. Email addresses are split at the @ symbol and never written in full, even inside the JavaScript block. Phone and WhatsApp numbers are encoded at build time using Base64, and appear in the source as an unreadable string. Only a real browser, executing the page, decodes and renders them. A sophisticated bot that executes JavaScript may still read them, but that represents a very small fraction of automated traffic. This is a practical, client-side protection layer — not a substitute for server-side security.