I've been thinking of releasing a few projects, and most authors in the community leave their email address right in the code, often as is or using commonly used schemes like "meATNOSPAMgmail.com", which sort of gets my paranoia flag up...

When releasing source code publicly, does it often lead to your email address being parsed by spam bots, and if so how do you obfuscate it ?

  • 2
    Possible candidate to not constructive question: blog.stackoverflow.com/2010/09/good-subjective-bad-subjective
    – Maniero
    Oct 6, 2010 at 17:16
  • 2
    I disagree with this being marked as 'not constructive'. This is very much a non-code related concern for programmers just getting into open source. We have different concerns from the SU crowd in this regard, since our email will effectively be our "official method of personal contact", so we don't want to just abandon the account when it gets spammy. I could make an argument that it matches points 1, 3, 4, 5 and 6 of your link.
    – jkerian
    Oct 6, 2010 at 19:34

6 Answers 6


I didn't worry about it for about a year of open source development. By the time I realized that I should be concerned, the address is out in the wild. With that said though, I haven't had too much spam coming in on that account, perhaps a spam message or three gets through gmail's filter per month.

If you're concerned about this sort of thing, perhaps make a separate email address for your opensource contact, and then just forward everything. If you're using gmail, I'd advise using their "plus addressing".

  • '+'1: Great tip
    – jholl
    Oct 6, 2010 at 18:35
  • 1
    This obviously only works if spammers do not remove the content between '+' and '@'. Oct 8, 2010 at 13:24
  • @Matthieu: Once again... in principle I agree that could be a problem. In practice... why would a spammer bother?
    – jkerian
    Oct 11, 2010 at 3:14
  • the spammer would probably not, the website disclosing your email would be better off doing so :) Oct 11, 2010 at 19:15

I avoid the problem by leaving a website URL instead of an email address in the code, and then someone can contact me through my site without me needing to leave an email address sitting around where any random spambot could harvest it.


Real world experience: I contributed some code to VNC many years ago (like 1998 or something) and my unobfuscated email address ended up in the standard readme.txt that was distributed and installed with every copy of VNC. Back then (and in the following years) there were certainly some spam worms that looked through all files on the user's computer for email addresses. My address was one of those, as well as all the others listed in that file. I get a lot of spam. At one point, some 20% of the total spam I got was "from" a forged address in that same readme.txt file.

So the answer is yes, releasing your email address in public software results in more spam. However, many kinds of other things also result in more spam too, so I don't think it's actually worth worrying about. I still use the same email address I've used since 1996, and rely on multiple layers of spam filters to filter out the crap.


Whenever possible, I avoid publishing my email address.

I use three strategies:

  1. As a previous answer stated, I give a web site.
  2. I use an image of my email address.
  3. I have my own domain so I can use lots and lots of email addresses. For each site foo.com, I use the email address [email protected].

All three of these strategies can be seen at the top of my resume.

A domain only costs about $8/year from GoDaddy.com. I then use Google Apps, free version (http://google.com/a), to forward email from all of the different email addresses to me (there is a setting to do this). If I have an address "go bad", that is, it starts to get lots of spam, I just write a filter for that address that throws out everything sent to it.


I honestly don't since the spam button in my email client is so easy to press. Having lord.quackstar at gmail dot com just annoys people, and bots can probably parse that already.

Spam comes and goes. Once you've ignored enough of their messages they usually stop.


Obfuscating your email address is great if you are 100% all the time and the spam bots haven't figured out how to parse your particular method yet. If you mess up once, or the spam bots figure out how to parse it then you can't put the genii back in the bottle.

So live life on the edge, post your email address with little regard for the spam that is sure to follow: [email protected]

Chances are they all have your email address anyway, and if they don't they are bound to start guessing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.