Spam harvesters scrape web pages for anything that looks like an email address. Encoding each character as an HTML entity — randomly mixing decimal (@) and hexadecimal (@) forms — produces markup that browsers render as the normal address while a plain text scan sees only entity codes. Optionally wrap it in a mailto: link so the address stays clickable.
The JavaScript mode goes further: it builds the mailto: link by concatenating character-code fragments at page load, so the address never appears literally in the HTML source at all. Paste the generated snippet straight into your page. Everything runs locally in your browser — the address is never sent anywhere.