EmailKing

How to Find Email Addresses on a Website: 8 Places They Hide

EmailKing Team · Last updated:

Most businesses want to be contacted — they just don't make it easy. The address is there, but it's split across a footer, wrapped in a script, or scrambled so spam bots can't read it. If you've ever opened a "Contact" page and found only a form, this guide is for you.

Below are the eight places emails actually live on a typical company website, in the order worth checking, plus how to handle the tricky ones.

1. The footer

Check the footer before the contact page. Small companies very often put hello@ or info@ next to the address and phone number at the bottom of every page. Scroll to the bottom and read the footer before anything else.

2. The contact, about and team pages

The obvious ones, but check all three:

  • /contact or /contact-us — general inboxes and sometimes department addresses (sales@, support@, press@).
  • /about or /company — founders sometimes list a personal address in their bio.
  • /team — agencies and consultancies often list every person with a mailto link.

If the site has a sitemap (/sitemap.xml), search it for "contact" or "about" — some sites bury these pages under odd URLs like /en/company/get-in-touch.

3. mailto: links hidden behind buttons

A button that says "Email us" or an envelope icon usually wraps a mailto: link. The address doesn't appear as visible text, so reading the page won't show it. Hover the button and look at your browser's status bar, or right-click → "Copy email address".

4. Obfuscated text: "name [at] company [dot] com"

To dodge scrapers, many sites write addresses like:

  • jane [at] acme [dot] com
  • jane(at)acme.com
  • jane AT acme DOT com
  • jane＠acme.com (a full-width @ character that looks normal but isn't)

These are easy for a human to reconstruct. Just remember that full-width characters must be replaced with a normal @ or the address will fail when you send.

5. Cloudflare "email protection"

If a site is behind Cloudflare, you may see [email protected] where the address should be. Cloudflare replaces the address with an encoded string (in a data-cfemail attribute) and decodes it with JavaScript in visitors' browsers. With JavaScript disabled, or when you fetch the raw HTML, you only see the placeholder. The real address is still in the page — it's just encoded.

6. Inside scripts, styles and HTML comments

Modern sites built with React, Next.js and similar frameworks often ship contact details inside JavaScript bundles or JSON blobs instead of the visible HTML. Developers also leave addresses in HTML comments. "View source" and a search for @ will surface them surprisingly often.

7. Structured data and meta tags

Look for schema.org markup (JSON-LD) in the page source — Organization and LocalBusiness blocks frequently include an email field, because businesses add them for Google.

8. Legal pages

Privacy policies and imprint pages (especially in Germany and Austria, where an Impressum is legally required) almost always contain a working contact email — often the most reliable one on the site.

Doing this for 1 site vs. 1,000 sites

For a single company, the manual checklist above takes five minutes. For a lead list of hundreds of companies, it doesn't scale — that's the job EmailKing was built for.

Paste a URL (or a list of URLs) and EmailKing:

  • reads the page, including mailto: links, meta tags, scripts, styles and comments;
  • decodes obfuscated formats — [at]/(at), full-width ＠, URL-encoded and Base64 strings, and Cloudflare-protected addresses;
  • if the page you gave has no emails, falls back to the site's contact, about and team pages;
  • checks each address's syntax and whether its domain has mail (MX) records, and flags throwaway domains.

It doesn't crawl an entire website page by page, and it doesn't ping mailboxes — it's built to find the contact addresses a company publishes, quickly.

A note on doing this responsibly

Publicly listed business addresses are published so people can get in touch — but how you use them is regulated. In the US, CAN-SPAM requires honest subject lines, a physical address and a working opt-out. In the EU and UK, GDPR and PECR apply, and some countries (Germany, South Korea) require prior consent for most marketing email. See our cold email legal guide before you send anything.

Frequently Asked Questions

Why does a site show "[email protected]" instead of an address?

The site uses Cloudflare's email obfuscation. The address is encoded in the page and decoded by JavaScript in your browser. Tools that decode it (EmailKing does) can read the real address from the page source.

The contact page only has a form. Is there really no email?

Often there still is — check the footer, the privacy policy, the page source (search for @), and any schema.org markup. If none of those have one, the company genuinely routes everything through the form, and the form is the right way to reach them.

Is it legal to collect emails from websites?

Collecting publicly listed business contact details is generally allowed, but sending marketing email to them is regulated differently in each country. Respect robots.txt and site terms, only contact people where your message is relevant to their role, and always honor opt-outs. This isn't legal advice — check the rules for the countries you target.

Should I email info@ addresses or look for a person?

It depends on the company size. At a 5-person company, info@ usually reaches the founder. At a 500-person company it reaches a queue. See how to find anyone's email for finding the right person.

Next Steps

Next step

Try one URL free — no signupFree email tools

More from the blog