yt-dlp
yt-dlp/yt-dlpReviewed by AI
Radar found strong risk signals in this project. It stays visible so you can read the evidence, but it is left out of rankings and recommendations.
What it does
yt-dlp is a command-line program that saves videos and audio from YouTube and thousands of other websites to your computer. It can pick the quality, download whole playlists, subtitles and thumbnails, and turn videos into audio files such as MP3. There is no window with buttons: you type commands in a terminal. Windows, Mac and Linux each get a ready single-file program. For the best quality you also need ffmpeg, and full YouTube support needs a JavaScript runtime such as Deno.
How easy it is to install
C · install 1 or 2 tools · Windows
- Windows C
- macOS C
- Linux C
On Windows there is a ready single file (yt-dlp.exe), but it has no graphical window, you use it by typing commands, and the README strongly recommends also installing ffmpeg and a JavaScript runtime such as Deno. Mac gets the same kind of single file; on Linux the recommended download is a small file that needs Python already installed.
Numbers on GitHub
- Stars
- 204,232on Oct 31, 2026
- Downloads
- 237,494,0472,341,591 this week
- Growth
- +2,108stars in 6 days
Stars over time
Facts
- Runs on
- Windows, macOS, Linux
- You need to install
- FFmpeg, Other tools
- To build from source
- Python, FFmpeg
- Disk space
- 22 MB–67 MB · from the installer
- Accounts or keys
- None
- Cost
- Free · Free. The code is public domain (Unlicense); the ready Windows, Mac and Linux programs include GPLv3+ code, so those files are under GPLv3+.
- License
- Unlicense (Permissive)
- Can replace
- 4K Video Downloader
- Last update
- Oct 29, 2026
Risk signals (6)
- HighInvolves another company's protection, license or terms
The main use is saving media from sites that do not offer a download, and the README documents working around their defences: "--xff VALUE How to fake X-Forwarded-For HTTP header to try bypassing geographic restriction"; "--impersonate CLIENT[:OS] Client to impersonate for requests"; "pycryptodomex - For decrypting AES-128 HLS streams and various other data". Many sites' terms of use do not allow keeping a copy, and several countries restrict working around a technical protection by law.
AI review
- Attentiondownloading may be restricted where you live
The program's job is to pull media off sites that do not offer a download button, and the README describes working around site defences: "pycryptodomex - For decrypting AES-128 HLS streams and various other data", "--impersonate CLIENT[:OS] Client to impersonate for requests" for "sites that employ TLS fingerprinting", "--xff VALUE How to fake X-Forwarded-For HTTP header to try bypassing geographic restriction", and a JavaScript runtime "Required for full YouTube support". Saving a copy can break a site's terms of use, and in some countries working around a technical protection is itself against the law.
AI review
- Infounverified updates from other repositories
README.md (UPDATE): "You may also use `--update-to <repository>` ... Be careful with what repository you are updating to though, there is no verification done for binaries from different repositories." The normal `-U` update stays on the official channel.
AI review
- Infocan read browser cookies
README.md (DEPENDENCIES): "secretstorage - For `--cookies-from-browser` to access the Gnome keyring while decrypting cookies of Chromium-based browsers on Linux". The program can read your browser's saved logins when you use that option.
AI review
- Infobinary license differs from repository
README.md (Licensing): "the PyInstaller-bundled executables include GPLv3+ licensed code, and as such the combined work is licensed under GPLv3+", while the repository itself is Unlicense.
AI review
- Infocan fetch code at run time
README option `--remote-components COMPONENT`: "Remote components to allow yt-dlp to fetch when required ... ejs:npm (external JavaScript components from npm), ejs:github". The README adds "By default, no remote components are allowed".
AI review
Evidence is shown in its original language.
What Radar could not check
- Whether the current stable release still works with YouTube and other sites on the day you use it; the README says stable is "often stale and prone to external breakage" and recommends the nightly channel
- Whether downloading from a given site is allowed by that site's terms or by the copyright law where you live
- Which sites need ffmpeg or a JavaScript runtime in practice, and how much disk space they add
- Whether Windows or antivirus software warns about the single-file yt-dlp.exe