Verifiable Bookmarklets
Generate, inspect and verify bookmarklets without executing them.
A bookmarklet is a normal browser bookmark that stores JavaScript instead of a web address. When you click it, the code runs on whatever page you are currently viewing, so you can automate small tasks on any site without installing an extension.
Source
Bookmarklet
Decoded JavaScript
Why verifiable bookmarklets
Bookmarklets are powerful: you can run JavaScript on almost any page by dragging a link to your bookmarks and clicking it. A verifiable bookmarklet keeps that workflow, while adding only a version, SHA-256 hash and optional source URL, so people can share one and prove that it came from the published source. Verification confirms the match, not the safety of the code.
Metadata
A verifiable bookmarklet is still a normal bookmarklet. It carries a small JavaScript comment immediately inside its wrapper, before the source runs:
/*bm:v1;sha=<sha256>;src=<url>*/bm:v1identifies the format.shaidentifies the exact generated payload.srcoptionally points to the published source.
How verification works
The generator normalizes the source, creates the bookmarklet payload and calculates its SHA-256 before inserting the metadata comment. The validator decodes the bookmarklet, rebuilds the payload and compares the hashes. It never executes the code.
A match proves the source corresponds to the bookmarklet. It does not prove that the code is safe or trustworthy.