Full mailto: Link Generator (CC/BCC)

Building mailto links the right way

The mailto: URI scheme is standardised by RFC 6068 and is supported by every browser, every operating system and every native mail client. A click on a mailto link opens the user's default mail application with the recipient, subject and body pre-filled — no API key, no SMTP server, no JavaScript framework required. It is still the cheapest "contact us" button you can ship and the only one that survives when the user is offline. The catch is that the syntax must be encoded correctly, otherwise Outlook will swallow the body, Gmail will truncate the subject, and iOS Mail will drop everything after the first space.

Syntax and parameters

The minimal form is mailto:[email protected]. Optional fields are appended as a query string after the address:

mailto:[email protected]?subject=Hello&[email protected]&[email protected]&body=Hi%20there

• subject, body, cc, bcc are the four parameters universally honoured.
• Multiple recipients are comma-separated: mailto:[email protected],[email protected].
• Spaces become %20, line breaks become %0D%0A, ampersands inside the body become %26.
• Embed in HTML with <a href="mailto:...">; trigger via JavaScript with window.location.href = 'mailto:...'.

Client behaviour and platform quirks

On mobile, the OS opens the default mail app — iOS Mail, Gmail for Android, or whichever app the user set as default. On desktop, the link is handed off to the OS protocol handler, which routes to Outlook, Apple Mail or a webmail handler. Chrome and Firefox can register Gmail, Yahoo or Outlook Web as the mailto handler via navigator.registerProtocolHandler('mailto', ...). The body length limit is fuzzy: the RFC sets no maximum but practical client and OS limits land near 2,000 characters, with some Windows clients cutting at 256. There is no way to attach a file — file: URIs are forbidden by the spec — and the body is always plain text, never HTML.

Spam, privacy and obfuscation

A raw mailto: in HTML is harvested in seconds by spam bots. Defences include: rendering the address with JavaScript at runtime, ROT13 or base64-encoding the address and decoding on click, replacing the link with a contact form, or relying on Cloudflare Email Obfuscation which transparently rewrites mailto links into encrypted JavaScript stubs. The Bcc field is also a privacy tool: recipients in Bcc never see each other's addresses, which is what you want for newsletters or one-to-many announcements. Avoid the rookie mistake of putting a mailing list in to or cc.

FAQ

Can I attach a file with mailto? No. The spec forbids referencing local files for security reasons, and no mail client implements an attach parameter. The user has to drag the file in manually after the compose window opens.

Can I send HTML in the body? No. The body parameter is plain text. HTML tags appear literally in the message. Use a real transactional email service (Resend, SendGrid, Postmark) if you need rich content.

Do Bcc recipients see each other? No — that is the whole point. Bcc recipients are hidden from both the To/Cc list and from other Bcc recipients. Cc, on the other hand, is fully visible.

How long can the body be? The RFC sets no limit, but in practice keep it under 1,500 characters. Outlook, the strictest client, truncates around 2,000 and some older Windows Mail builds at 512.