What Is a Bookmarklet and Is It Safe?

A normal bookmark stores an address such as https://example.org/. A bookmarklet stores an address that begins with javascript: followed by a short program. When you click it, the browser does not navigate; it runs the program on the page currently open. That is the whole trick. Because it is only a bookmark, a bookmarklet needs no installation, no permissions, no store approval and no account, and it works in every desktop browser made in the last twenty years.

How a bookmarklet works

1. You drag a link from a page like our bookmarklet page onto your bookmarks bar. The browser saves its javascript: address as a bookmark.
2. Later, on any page, you click the bookmark. The browser runs the script in the context of that page, as if the page itself had included it.
3. The script does one job: reads your selection, changes the page, opens a small panel, copies something to the clipboard. When you reload the page, all of it is gone.

Because the script runs inside the page, it can see and change what the page shows, exactly like an extension would while you are on that page. Unlike an extension, it runs only when you click it and only on that page; it has no presence otherwise. This is why bookmarklets are the right tool for occasional tasks and why they survive on locked-down school and library computers where extensions are forbidden.

Installing a bookmarklet on each browser

Is a bookmarklet safe? How to read one

A bookmarklet is exactly as safe as its code, and unlike an extension the code is right there in the address. Before you install one from anywhere, read it. You do not need to be a programmer to apply three tests:

• Does it load anything from another server? Look for createElement('script') with a src, or fetch(, or XMLHttpRequest. A bookmarklet that pulls code from elsewhere can change its behaviour later without you knowing. Prefer bookmarklets that are self-contained.
• Does it send anything anywhere? Look for location.href=, window.open(, fetch( or an img with a remote src. Ours copies a link to your clipboard and opens nothing.
• Does it read more than it needs? A highlighter needs getSelection() and the page address. It has no business with document.cookie, form fields or localStorage.

The Awesome Highlighter bookmarklet passes all three: it is self-contained, sends nothing, and reads only your selection and the page address. Its full code is printed on the bookmarklet page above the drag link so you can check it.

What bookmarklets cannot do

• They cannot remember anything between visits unless they use the page's own storage, which is scoped to that site. They are not for building a library of highlights; an extension or annotation service is.
• Some sites block inline scripts with a strict content security policy, and on those pages a bookmarklet does nothing. Reader mode sometimes helps.
• On phones they are awkward to run, because there is no bookmarks bar to click while a page is open.
• Very long scripts make unwieldy bookmarks; good bookmarklets are small and do one thing.

A short history

The term was coined around 1998, and by the mid 2000s bookmarklets were how most "web 2.0" services let you save, share or annotate any page: bookmarking sites, read-later services, translators and highlighters all shipped one. The Awesome Highlighter launched in 2008 as a bookmarklet plus a Firefox add-on, and the bookmarklet was the more popular of the two because it worked everywhere. Extensions later took over for tools that needed memory or background access, but for one-click, no-permission tasks the bookmarklet never had a better replacement. Ours is on its third generation; see the site history.

A bookmarklet is one option among several in the web highlighter tools overview. If you need highlights that persist, compare highlighter extensions for Chrome, Firefox and Safari; if you want to understand the links the bookmarklet produces, read the text fragment explainer.