Bookmarklet Code Builder

A bookmarklet is a browser bookmark that contains JavaScript code instead of a regular URL. When you click it, the JavaScript executes on the current page, allowing you to automate tasks, modify page content, extract data, or enhance your browsing experience — all without installing a browser extension. The name comes from combining "bookmark" and "applet."

Desktop: Simply drag the generated blue "Drag to Bookmarks Bar" button to your browser's bookmarks bar (the bar below the address bar). If you don't see the bookmarks bar, press Ctrl+Shift+B (Windows) or Cmd+Shift+B (Mac) to show it. Then navigate to any webpage and click the bookmarklet to run it.

Mobile: Copy the generated bookmarklet code. Then manually create a new bookmark in your mobile browser, paste the entire javascript:... code into the URL field, and save it. Open any page, tap the bookmark to execute.

A bookmarklet uses the javascript: URI scheme. When a browser encounters a bookmark with a javascript: URL, it executes the JavaScript code in the context of the currently loaded page. This gives the bookmarklet full access to the page's DOM, variables, and APIs — which is why it can modify content, read data, and interact with the page just like a script that was natively included. Our builder wraps your code in an IIFE (Immediately Invoked Function Expression) to prevent variable leaks and uses encodeURIComponent() to ensure all special characters are properly encoded for URL compatibility.

URL encoding (using encodeURIComponent) converts special characters like spaces, quotes, ampersands, and other symbols into their percent-encoded equivalents (e.g., space becomes %20). This is essential because bookmark URLs must conform to URI standards. Without encoding, characters like #, &, ?, and unescaped spaces could break the bookmark or be misinterpreted by the browser. Proper encoding ensures your bookmarklet works reliably across all browsers and platforms.

Bookmarklets you create yourself are safe. However, never install bookmarklets from untrusted sources. A bookmarklet runs with the same privileges as the page it's on, meaning it can access cookies, form data, localStorage, and make network requests. A malicious bookmarklet could steal sensitive information, redirect you to phishing sites, or modify page content deceptively. Always review the source code of any bookmarklet before installing it. Our builder helps by letting you see and understand exactly what code goes into your bookmarklet.

The most common reason is Content Security Policy (CSP). Many modern websites set CSP headers that block inline JavaScript execution, including bookmarklets. For example, sites like GitHub, Twitter, and many banking sites have strict CSP rules. Other reasons include:
• The page uses frame or iframe sandboxing
• The bookmarklet has syntax errors
• The code references APIs blocked by the page
• The page has overridden native DOM methods
There's no universal workaround for CSP restrictions, though some users employ browser extensions to strip CSP headers.

Yes, you can dynamically load external libraries by creating a <script> tag and appending it to the DOM. For example:
var s=document.createElement('script');s.src='https://cdn.jsdelivr.net/npm/lodash@4/lodash.min.js';s.onload=function(){/* your code */};document.head.appendChild(s);

However, this adds latency, may fail on pages with restrictive CSP, and the library may conflict with existing page scripts. For most bookmarklets, it's better to keep the code self-contained and lightweight.

Bookmarklets are lightweight, run only when clicked, require no installation (just a bookmark), and have no background processes. They're limited to the page context and can be blocked by CSP.

Browser extensions have far more capabilities: they can run background scripts, access browser APIs, modify network requests, persist data across sessions, and work across all tabs. However, they require installation, updates, permissions, and must go through extension store review processes. Bookmarklets are perfect for quick, personal automation tasks.

Yes, but with some extra steps. Mobile browsers (Safari on iOS, Chrome on Android) don't support drag-and-drop to the bookmarks bar. Instead, you need to manually create a bookmark and paste the bookmarklet code as the URL. On iOS Safari, you can bookmark any page, then edit the bookmark and replace the URL with your bookmarklet code. On Chrome for Android, the process is similar through the bookmarks manager. Once saved, tap the bookmark to execute the script on the current page.

Right-click the bookmarklet in your bookmarks bar and select "Edit" (or open your browser's Bookmark Manager). You'll see the full javascript:... URL in the URL field. You can copy it back into this tool (the builder automatically strips the javascript: prefix and decodes it for editing), make your changes, and regenerate. To delete, simply right-click and choose "Delete" or remove it from the Bookmark Manager.

Different browsers have different URL length limits. Chrome supports URLs up to approximately 2MB, Firefox has no strict limit, Safari handles up to ~80,000 characters, and older versions of Internet Explorer limited URLs to about 2,083 characters. For practical purposes, keep your bookmarklet under 5,000 characters for broad compatibility. Our builder shows a character count so you can monitor the size. If your code is getting long, consider minifying it or using shorter variable names.

Issue: Bookmarklet does nothing when clicked.
Fix: Check browser console (F12) for errors. Ensure CSP isn't blocking it. Verify the code syntax.

Issue: Bookmarklet navigates to a blank page showing "undefined".
Fix: Your code returns a value. Our IIFE wrapper with void(0); prevents this, but if unwrapped, add void(0); at the end of your code.

Issue: Special characters or emojis break the bookmarklet.
Fix: Ensure URL encoding is enabled. Non-ASCII characters must be percent-encoded.

Issue: Bookmarklet works on one site but not another.
Fix: The site likely has CSP restrictions. Check if the site uses Content-Security-Policy headers that block inline scripts.