What Is a Bookmarklet and Is It Safe?

A normal bookmark stores an address such as https://example.org/. A bookmarklet stores an address that begins with javascript: followed by a short program. When you click it, the browser does not navigate; it runs the program on the page currently open. That is the whole trick. Because it is only a bookmark, a bookmarklet needs no installation, no permissions, no store approval and no account, and it works in every desktop browser made in the last twenty years.

How a bookmarklet works

1. You drag a link from a page like our bookmarklet page onto your bookmarks bar. The browser saves its javascript: address as a bookmark.
2. Later, on any page, you click the bookmark. The browser runs the script in the context of that page, as if the page itself had included it.
3. The script does one job: reads your selection, changes the page, opens a small panel, copies something to the clipboard. When you reload the page, all of it is gone.

Because the script runs inside the page, it can see and change what the page shows, exactly like an extension would while you are on that page. Unlike an extension, it runs only when you click it and only on that page; it has no presence otherwise. This is why bookmarklets are the right tool for occasional tasks and why they survive on locked-down school and library computers where extensions are forbidden.

Installing a bookmarklet on each browser

Is a bookmarklet safe? How to read one

A bookmarklet is exactly as safe as its code, and unlike an extension the code is right there in the address. Before you install one from anywhere, read it. You do not need to be a programmer to apply three tests:

• Does it load anything from another server? Look for createElement('script') with a src, or fetch(, or XMLHttpRequest. A bookmarklet that pulls code from elsewhere can change its behaviour later without you knowing. Prefer bookmarklets that are self-contained.
• Does it send anything anywhere? Look for location.href=, window.open(, fetch( or an img with a remote src. Ours copies a link to your clipboard and opens nothing.
• Does it read more than it needs? A highlighter needs getSelection() and the page address. It has no business with document.cookie, form fields or localStorage.

The Awesome Highlighter bookmarklet passes all three: it is self-contained, sends nothing, and reads only your selection and the page address. Its full code is printed on the bookmarklet page above the drag link so you can check it.

Worked example: a bookmarklet you can read in one minute

Here is a complete bookmarklet. It takes your selection and shows it beside the page address, ready to copy into your notes:

Read it left to right. javascript: tells the browser this is a script, not an address. (function(){ })() wraps the code so its variables do not leak into the page. getSelection() reads the text you have selected and String() turns it into plain text. location.href is the address of the page. prompt( opens a small box with the result already selected so you can copy it. Now apply the three tests: nothing is loaded from another server, nothing is sent anywhere, and nothing beyond the selection and the address is read. It passes.

To use it, create a bookmark and paste the code as its address, as the table above describes. Select a sentence on any page, click the bookmark, and copy the result into your notes. Over a term this gives you a plain list of quoted passages with their addresses, which is the raw material for a plain-text record of highlights you keep yourself. It works best after selecting the exact words with the keyboard before you click, since the bookmarklet copies precisely what is selected and nothing more.

What bookmarklets cannot do

• They cannot remember anything between visits unless they use the page's own storage, which is scoped to that site. They are not for building a library of highlights; an extension or annotation service is.
• Some sites block inline scripts with a strict content security policy, and on those pages a bookmarklet does nothing. Reader mode sometimes helps.
• On phones they are awkward to run, because there is no bookmarks bar to click while a page is open.
• Very long scripts make unwieldy bookmarks; good bookmarklets are small and do one thing.

Bookmarklet, extension or user script: which small tool fits

For highlighting the split is simple. If the highlight is for someone else, or for a single reading session, the bookmarklet is enough. If you need the marks back tomorrow, you need one of the other two, and the safety checks above apply to all three: read what runs, ask what it loads, and ask where it sends.

A short history

The term was coined around 1998, and by the mid 2000s bookmarklets were how most "web 2.0" services let you save, share or annotate any page: bookmarking sites, read-later services, translators and highlighters all shipped one. The Awesome Highlighter launched in 2008 as a bookmarklet plus a Firefox add-on, and the bookmarklet was the more popular of the two because it worked everywhere. Extensions later took over for tools that needed memory or background access, but for one-click, no-permission tasks the bookmarklet never had a better replacement. Ours is on its third generation; see the site history.

A bookmarklet is one option among several in the web highlighter tools overview. If you need highlights that persist, compare highlighter extensions for Chrome, Firefox and Safari; if you want to understand the links the bookmarklet produces, read the text fragment explainer.