Verifiable Bookmarklets
Generate, inspect and verify bookmarklets without executing them.
Bookmarklets are powerful: you can run JavaScript on almost any page by dragging a link to your bookmarks and clicking it. A verifiable bookmarklet keeps that workflow, while adding only a version, SHA-256 hash and optional source URL, so people can share one and prove that it came from the published source. Verification confirms the match, not the safety of the code.
Source
Bookmarklet
Decoded JavaScript
Metadata
A verifiable bookmarklet is still a normal bookmarklet. It carries a small JavaScript comment immediately inside its wrapper, before the source runs:
/*bm:v1;sha=<sha256>;src=<url>*/Three fields
bm:v1identifies the format.shaidentifies the exact generated payload.srcoptionally points to the published source.
How verification works
The generator normalizes the source, creates the bookmarklet payload and calculates its SHA-256 before inserting the metadata comment. The validator decodes the bookmarklet, rebuilds the payload and compares the hashes. It never executes the code.
A match proves the source corresponds to the bookmarklet. It does not prove that the code is safe or trustworthy.