What APIs appear
The static rules identify recognizable network, storage, form, HTML-writing, navigation, clipboard, encoding, download, and DOM-editing patterns.
Bookmarklet Inspector
Decode and review a bookmarklet without running it. See the readable source and the browser capabilities that deserve manual inspection.
Paste code to inspect
Accepts readable JavaScript or an encoded URL beginning with javascript:. Analysis happens locally and the code is never executed.
Static pattern checks only; this is not a safety certification.
What the inspector can tell you
Why each one matters
Each result explains the capability in context. A network call is not automatically malicious, but its destination and payload require review.
What to check next
Results include a focused manual question so you can trace the data, destination, selector, or decoded payload in the visible source.
What it cannot prove
Static pattern matching cannot certify code as safe. Behavior may be split across variables, hidden in custom encodings, triggered only on certain pages, or depend on a server response. A finding is a prompt for review; the absence of a finding is not approval.
A better review sequence
- Decode and read the complete source.
- Trace page data into URLs, requests, storage, and new windows.
- Replace opaque or minified-only code with readable source.
- Test in the isolated local fixture, not on a signed-in page.
- Run it on a real page only when every behavior is understood.