[AliWtf]

Good day. I was wondering if there was a way to reveal emails which are encoded in asterisks form, like that on a social media account recovery page.

[DramaKing]

Good day. I was wondering if there was a way to reveal emails which are encoded in asterisks form, like that on a social media account recovery page.

Sure, web developers just have an overlay to hide emails and phone numbers. I would guess that the data is fetched from the backend database by PHP and fed through a function to replace parts of the addresses or numbers. This would be done server-side with no injection points or endpoints to manipulate. There are much easier methods to hijack accounts.

[Dotexe]

If the system is properly set up the full email is never sent to the browser at all. It’s masked server-side before it even reaches the front end. So even if you inspect the element or check the network requests, you’ll only ever see the asterisks. There’s no way to reveal it unless there’s a flaw in how the data is handled or exposed through an API, which is rare on secure platforms.