Perhaps the GP wants to make sure that the code keeps working, regardless of the server's availability, etc...?

dazbradbury -- Host a local copy of http://fontbomb.ilex.ca/js/main.js and you should be good to go :-)

There's also a security concern. OP could change the code to a malicious script without anyone noticing.

I get it, tks Greg. I originally did not hardcode the js function in the href bookmarklet attribute to ease development process. Since it's effectively a good concern, I will hardcode it.

EDIT: Updating the code to escape parentheses is pain. I will leave it like that for the moment. Like greg said, your best option for now is to copy http://fontbomb.ilex.ca/js/main.js . Sry!

You shouldn't try to fit your code in that bookmarklet...! Updatability issues aside (your original, server-loaded approach is absolutely valid), there definitely are limits to a bookmarklet's size, just as there are browser-specific limits to URL length... See: http://stackoverflow.com/questions/417142/what-is-the-maximu...

EDIT: _jb's right regarding the security concern though; the server-hosted code could be changed to something malicious after everyone has installed it

To solve the security issue, the bookmarklet could perform some sort of hash checking on the source and refuse to run if it's changed.

The question is, can a hash function and verification logic be made small enough for this to be viable?

Use MD5, very secure snickers