Very nice. Now I have seen versions that DO work with IE by simply having the js code posted on a website, since IE cant handle it as a bookmarklet.

Can you make yours work like this too, since I have yet to find one that hides the password like yours.

Then of course people could put it on their own website instead of going out to a site they dont control.

Thanks !

This is an example that would work with IE

javascript:s=document.body.appendChild(document.createElement('script'));s.id='fs';s.language='javascript';void(s.src='http://labs.zarate.org/passwd/passwd.js')

But, question is, how do I edit this to work with yours, and also host the js on my server. How do we convert ascii to the %56%43 blah blah

Here it is so you can read the whole thing.

javascript:s=document.body.
appendChild(document.createElement
('script'));s.id='fs';s.language=
'javascript';void(s.src=
'http://labs.zarate.org/
passwd/passwd.js')

Sadly, IE's general suckiness prevents this code from working. I assume it has some prorietary way of inserting and deleting new HTML elements or something. Personally I can't stand to work with IE anymore, it's just not worth the headaches.

However, I've uploaded the javascript code in a more readable form, so that others can try and get it to work in IE. There's also a function to convert problem characters to %25, %27, etc.

Take a look over here for the code.
(sorry it's not really commented, but at least the parts that you might need to change are all formatted nicely)

Why do some sites appear to have converted so many of the characters of the bookmarklet, when your converter does not convert nearly so many...

for example, your converter when converting this:

javassccript:s=document.body.appendChild(document.createElement('script'));s.id='fs';s.language='javascript';void(s.src='http://labs.zarate.org/passwd/passwd.js')

yields:

javascript:s=document.body.appendChild(document.createElement(%27script%27));s.id=%27fs%27;s.language=%27javascript%27;void(s.src=%27http://labs.zarate.org/passwd/passwd.js%27)

Yet when I view the source of the page where the bookmarklet above came from I see this...



Bookmarklet for Internet Explorer: javascript:%73%3D%64%6F%63%75%6D%65%6E%74%2E%62%6F%64%79%2E%61%70%70%65%6E%64%43%68%69%6C%64%28%64%6F%63%75%6D%65%6E%74%2E%63%72%65%61%74%65%45%6C%65%6D%65%6E%74%28%27%73%63%72%69%70%74%27%29%29%3B%73%2E%69%64%3D%27%66%73%27%3B%73%2E%6C%61%6E%67%75%61%67%65%3D%27%6A%61%76%61%73%63%72%69%70%74%27%3B%76%6F%69%64%28%73%2E%73%72%63%3D%27%68%74%74%70%3A%2F%2F%6C%61%62%73%2E%7A%61%72%61%74%65%2E%6F%72%67%2F%70%61%73%73%77%64%2F%70%61%73%73%77%64%2E%6A%73%27%29



So confused.., Is your converter's conversion sufficient ? I will try it out and see. Thanks

Many people use javascript's escape() function to make bookmarklets url-safe, but this escapes every character (tripling the size of the script in the process). All you really need to do is escape characters that screw up URLS (and it also needs to be able to be pasted into HTML links, which is why I escape the quotes as well).

I think the optimal solution would be to escape all non-base64 characters, but for now my solution has worked well for me...

That's great Tim. Tim is there a chance that you can come up with a plain HTML page that I can save on my blog somewhere so I can access it from anywhere and don't have to rely on my bookmarklets?

Also can that HTML be compatible with IE by any chance?

Do keep up the good work. Well done.

Thanks Tim.

So now that I have converted the javacript, how do I make it a bookmark ?

Thanks again, awesome code.

best regards,

Eric

bookmarks are simply javascript code (must all be one line), with "javascript:" in front of it. For some reason it's a good idea to call void(); after your code is done, otherwise firefox sometimes looks as if it hasn't fully loaded the page.

Tejas - this is pretty simple, I can put one up when I've got a bit more time...

Thanks Tim

I want to use the following pointing to a local JAVASCRIPT.js file, is there a particular syntax for referencing a local source file ? for some reason it wont work, plus here is a link to an excellent Converter I used in addition to yours to fully convert a string, pick your own delimiter, i.e. % and then make sure it is %code % code instead of code %

http://www.vortex.prodigynet.co.uk/misc/ascii_conv.html

This works and points to an external file via URL:

javascript:s=document.body.appendChild
(document.createElement('script'));
s.id='fs';s.language='javascript';
void(s.src='http://labs.zarate.org/passwd/passwd.js')

this does NOT work, and points to a LOCAL javascript Source file. Is my syntax for pointing to a local file not correct ?

javascript:s=document.body.appendChild
(document.createElement('script'));
s.id='fs';s.language='javascript';
void(s.src=’c:\dl\stuff\javascript\passwd.js')

Of course in both cases they are each a single line only. Multiple lines here only to make it more readable.

Thanks !!

The URL method for pointing to local files is actually
file:///c:/dl/script.js
(note there are three slashes after "file:")

There seem to be some security issues though, which are there to prevent any old site from reading your local files. You may be able to get around this, but it might not be very safe ;)

Alright, Link for a page that works with IE is now added in the original post. Save it to your computer, add a bookmark, and you'll never notice that you use a terrible browser ;)

(you might want to get the .txt source version, because it doesn't have auto-inserted ad code...)

You wouldn't happen to have a version that only uses the domain name, would you?

It is actually more secure if site's db gets hacked since it won't provide as many data points to use in hacking out the master password.

Using only the domain name is actually quite hard, because you need to store all known domain suffixes, of which there are hundreds (and there's no central record of them to my knowledge).

However, Chris Zarate has attempted just that. It doesn't work on all domains, but it should be fine for the majority of sites.