Bookmarklet vs browser extension: which should you use?
Use a bookmarklet unless you need something an extension can only do. A bookmarklet is one line of JavaScript stored in a bookmark: it needs no permissions, runs only when you click it, works in every browser, and cannot be sold or updated behind your back. Extensions buy convenience with access.
Both put a button in your browser that does something to the page you are on. The difference is what happens when you are not pressing it.
An extension is installed software. It sits in the browser, can be granted permission to read and modify every page you visit, and updates itself silently. A bookmarklet is a bookmark whose address happens to be a line of JavaScript. It has no presence, no background process and no permissions. It exists as text until you click it.
| Bookmarklet | Extension | |
|---|---|---|
| Permissions needed | None | Usually read and change data on all sites |
| Runs when you are not using it | Never | Yes, if granted broad host access |
| Install time | About 10 seconds | Two clicks plus a permission prompt |
| Works in | Every browser, desktop and mobile | One browser family per package |
| Syncs across your devices | Yes, with your bookmarks | Only within one browser account |
| Can be updated without telling you | No. The code is fixed until you edit it. | Yes, automatically |
| Can be sold to a new owner | No | Yes, and this is a real adware pipeline |
| Keyboard shortcut and toolbar icon | No dedicated icon | Yes |
| Can act before the page loads | No | Yes |
| Blocked by strict site policies | Occasionally | Rarely |
| Works on a locked-down work laptop | Usually yes | Often blocked by policy |
The permissions argument, plainly
The Chrome prompt "read and change all your data on all websites" is not marketing caution. It means the extension can see everything rendered in your tabs: your webmail, your bank statement, the internal wiki at work. Most extensions asking for it are honest and simply need it to do their job. The problem is that the permission survives the publisher.
The known failure mode is not a malicious launch, it is a quiet handover. A useful free extension builds an audience for two years, gets bought, and one silent auto-update later it is injecting affiliate links or logging URLs. You approved the permission once, in 2024, and never saw the change.
A bookmarklet cannot do that. The code is stored in your own bookmark, in plain text, and it only executes on the page you are looking at when you click it. If you want to know what it does, you can read it in ten seconds.
A real bookmarklet
Here is the entire PrintxPDF bookmarklet. It takes the address of the page you are on, URL-encodes it, and opens the cleaner with that page loaded.
javascript:(function(){
window.open(
'https://printxpdf.com/print?url=' + encodeURIComponent(location.href)
);
})()That is all of it. No network calls of its own, no storage, no listeners left behind. When you paste it into a bookmark it must be on one line, which is how the ready-made button supplies it.
How to install a bookmarklet
- Show your bookmarks barCtrl+Shift+B on Windows and Linux, Cmd+Shift+B on macOS. In Safari it is View then Show Favourites Bar.
- Drag the ready-made buttonGo to the extensions page and drag the ⚡ button onto the bar. That is the whole install on desktop.
- Or create it by handRight-click the bookmarks bar, choose Add page, put anything in the Name field, and paste the one-line JavaScript into the URL field. Chrome accepts
javascript:here even though it strips it from the address bar. - In FirefoxRight-click the bar, choose Add Bookmark, and paste the code into the URL field. Firefox may warn about a JavaScript bookmark; that warning is expected.
- On iPhone or iPadYou cannot drag. Bookmark any page, then edit that bookmark and replace its address with the code. Open Bookmarks on any page and tap it to run. Easier still: create it on your Mac and let iCloud sync it across.
- Test itOpen a normal article and click it. A new tab should open with the cleaner loaded and the article already fetched.
Prefer no button at all? Convert a saved HTML file to PDF directly in the browser.
HTML to PDF →When an extension is genuinely the right answer
- You need it to act before the page renders, as ad blockers and script blockers must.
- You need a keyboard shortcut or a toolbar icon with a state, such as a counter or a toggle.
- You need it to run on every page automatically without a click.
- You need persistent storage, sync of its own settings, or a background process.
- The site uses a strict Content-Security-Policy that stops bookmarklets from running. This is uncommon, and the workaround is to open the tool directly and paste the URL.
Reformatting a page for printing needs none of those, which is why a bookmarklet is the honest recommendation here. To be explicit: the extension listings on this site are a design demo. Nothing is published in the Chrome Web Store, on addons.mozilla.org or in the App Store, and the install buttons do nothing. The bookmarklet is the working option today.
A third option people forget
You do not need a button at all. Pasting a URL into the web page printer takes about five seconds and installs nothing, which is the right choice on a borrowed or managed machine. Site owners who want their readers to have a print button can use the website button instead, so no visitor has to install anything. The browser-specific routes are in Chrome, Firefox and Safari.
Frequently asked questions
What is a bookmarklet?
A bookmark whose address is a small piece of JavaScript instead of a web address. Clicking it runs that code on the page you are currently viewing. It needs no installation, no permissions and no background process, and it works in every browser.
Are bookmarklets safe?
A bookmarklet is exactly as safe as the code inside it, and you can read that code in your bookmark manager at any time. Unlike an extension it cannot update itself, run in the background, or gain access you did not click for.
Do bookmarklets work on iPhone?
Yes, though installing one is fiddly. Bookmark any page, edit the bookmark, and replace its address with the JavaScript. Easier: create it in Safari on a Mac and let iCloud sync it to the phone, then run it from the Bookmarks list.
Why does my bookmarklet do nothing on some sites?
A small number of sites send a strict Content-Security-Policy header that blocks injected scripts. There is no fix from your side. Open the tool directly in a new tab and paste the page URL into it instead.
Should I uninstall extensions I already have?
Audit rather than purge. Open chrome://extensions or about:addons, remove anything you do not recognise or no longer use, and set the rest to on-click site access. Broad standing permissions on forgotten extensions are the real risk.