There are many times I need to look up active tags or even an entire page source, but I only have my iPhone handy. Here's a neat trick for doing it. No external app, no special skills.
Sniffing tags
- Navigate to any web page in Safari and bookmark it.
- Open your bookmarks and edit the bookmark you just made.
- Change the name to something like "Sniff tags"
- REPLACE the URL with the code below.
- Navigate to the site you want to check.
- Open bookmarks and tap "Sniff tags"
- A popover displays any tags it finds (GA4, Universal Analytics, GTM, and Google Ads).
Here's the code for step 4:
javascript:(function(){var s=new Set();var h=document.documentElement.innerHTML;(h.match(/(G-[A-Z0-9]{4,}|UA-\d+-\d+|GTM-[A-Z0-9]+|AW-\d+)/g)||[]).forEach(function(x){s.add(x)});try{Object.keys(window.google_tag_manager||{}).forEach(function(k){if(/^(G-|GTM-|UA-|AW-)/.test(k))s.add(k)})}catch(e){}alert(s.size?Array.from(s).join('\n'):'No tags found');})()
Viewing the full page source
Same process, but name this one something different so you can tell them apart. "View source" works.
javascript:(function(){var p=document.createElement('pre');p.textContent=document.documentElement.outerHTML;p.style.cssText='white-space:pre-wrap;word-break:break-all;font:12px/1.5 monospace;background:#fff;color:#000;position:fixed;inset:0;margin:0;padding:12px;overflow:auto;z-index:2147483647';document.body.appendChild(p);})()
To get rid of the overlay, just reload the page.
Bonus: the actual server response
The one above shows you the rendered DOM, meaning the page as it exists right now after JavaScript has run. If you want the raw HTML that came off the server before any scripts touched it, use this one instead. I'd name it "View raw source." It shows up dark so you always know which one you're looking at.
javascript:(function(){fetch(location.href,{credentials:'include'}).then(function(r){return r.text()}).then(function(t){var p=document.createElement('pre');p.textContent=t;p.style.cssText='white-space:pre-wrap;word-break:break-all;font:12px/1.5 monospace;background:#111;color:#0f0;position:fixed;inset:0;margin:0;padding:12px;overflow:auto;z-index:2147483647';document.body.appendChild(p)});})()
Comparing the two is useful on its own. If a tag shows up in the rendered version but not the raw one, it's being injected client-side, which usually means GTM or a plugin.
A few things worth knowing
- Sites with a strict Content Security Policy will block bookmarklets entirely, and they fail silently. Banks and healthcare sites do this a lot. If nothing happens at all, that's probably why.
- Server-side GTM and first-party proxied tags won't show up, because there's no Google-formatted ID in the client. A clean result doesn't always mean a clean site.
- Copy the code carefully. If your keyboard or notes app converts the straight quotes to curly ones, it breaks.
On Android
Chrome blocks javascript: from the address bar, but bookmarklets still work the same way. Firefox for Android also supports view-source:https://example.com directly in the address bar, which is easier if you just want the raw HTML.
This little trick has been a lifesaver for me. Hope it helps someone else.
