b2KIT

Bookmarklet Generator

Paste JavaScript code and generate a bookmarklet link to drag to your browser bookmarks bar.

Tested tool guide Tested browser tools Checked August 16, 2026

What Bookmarklet Generator does and how it behaves

Bookmarklet Generator packages pasted JavaScript as the target of a draggable browser bookmark. The resulting bookmark runs against whichever page is active when it is selected, allowing a short script to inspect or modify that page. Conversion happens entirely in the browser, which matters when the snippet contains private project details. The main surprise is context: the bookmarklet is not a separate utility page, and the active site's security policy or browser restrictions can prevent it from running.

How the result is produced

1

JavaScript URL creation

The generator turns the pasted source into a javascript: URL and presents that URL as a draggable bookmark link. Saving the link creates a browser bookmark whose target is code instead of a conventional web address. Selecting the bookmark asks the browser to evaluate that code in the context of the currently displayed page.

2

Active-page execution

Inside a bookmarklet, globals such as window, document, location, and selection APIs refer to the active tab. If a JavaScript URL completes with a string value, the browser can treat that string as replacement document content. Bookmarklet code commonly prevents this by ensuring that its final result is not a string, such as by ending with void 0.

Good uses

  • Turn a repeated DevTools console snippet that modifies the current page into a one-click bookmark.
  • Create a bookmark that collects selected text, the page title, or the current URL for a personal workflow.
  • Package a small diagnostic that highlights matching elements, reports document properties, or toggles a page state during testing.

Limits and checks

  • Test the saved bookmark on an ordinary web page. Browser settings, managed policies, internal browser pages, and a site's Content Security Policy may reject JavaScript URLs.
  • Code runs with the active page's origin and privileges. A bookmarklet does not bypass same-origin checks, CORS rules, sandboxed frames, or permissions enforced by the browser.
  • Watch the final JavaScript completion value. If it is a string, activating the bookmarklet can replace the visible document with that string instead of only performing the intended action.

Common questions

Will the generated bookmarklet work on every page?

No. Browsers commonly prohibit JavaScript bookmark execution on internal pages, extension pages, and other privileged surfaces. A website's Content Security Policy can also block execution. Test the bookmarklet on the kinds of pages where it will actually be used, including pages with frames or restrictive security headers.

Does a bookmarklet bypass cross-origin restrictions?

No. The code executes in the security context of the active page and remains subject to the browser's same-origin policy, CORS handling, frame sandboxing, and page permissions. It can use data and interfaces available to that page, but generating a bookmarklet does not grant additional access to cross-origin documents, responses, or privileged browser features.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools