Cloudflare's Email Protection provides dubious value

19 Jan, 2026

I always assumed that their email protection relied on their Bot Detection, but no, it just encodes emails.

It replaces emails with a data-cfemail attribute that contains a trivial encoding of the email (see below)

def decode_cloudflare_email(encoded: str) -> str:
	"""Decode Cloudflare-protected email from data-cfemail attribute."""
	try:
		r = int(encoded[:2], 16)
		return "".join(chr(int(encoded[i:i+2], 16) ^ r) for i in range(2, len(encoded), 2))
      	except Exception:
        	return ""