Isolated Bookmarklet Test Fixture

Run JavaScript against a disposable local document instead of a real website or signed-in browser tab.

What the fixture restricts

The preview uses an iframe with scripts allowed but without same-origin, form, popup, top-navigation, or download permission. Its Content Security Policy blocks request APIs and external subresources. It is intended for code you wrote and understand—not hostile-code analysis. A script can still replace its own preview, and a successful test is not proof that code is safe.

Disposable preview

Good uses for this fixture

  • DOM selectors, styling, highlighting, counting, and text changes
  • Error handling and readable console or alert output
  • Checking whether code assumes elements that are not present
  • Comparing readable source with the generated bookmarklet

What it intentionally cannot test

  • Whether hidden or indirect behavior can evade static review
  • Another site's cookies, storage, account, or private page data
  • Popups, top-level navigation, downloads, or form submissions
  • Site-specific Content Security Policy and browser-extension behavior