Skip to content

Notes

What an online YouTube downloader does with your link

Not a scare piece. The mechanics of what happens when you paste a URL into a website — which explains the ads, the queues, the quality caps, and what the link itself tells them.

Paste a YouTube URL into a website, wait, get a file. It works, it is free, and nothing is installed. Reasonable question: what is the catch?

This is the mechanics, not a warning. Once you know what the machine does, the ads, the queues and the 720p cap all stop being mysterious, and you can judge for yourself which sites are fine.

Disclosure: I build a downloader that runs locally, so I have a side. I have tried to write the parts that are true regardless.

What actually happens

You paste a link. Then, in order:

  1. Your link goes to their server, with your IP address, your browser fingerprint and a timestamp.
  2. Their server downloads the video from YouTube. Not you — them. Their machine, their bandwidth, their address.
  3. Their server stores the file, at least briefly.
  4. You download it from them, over their bandwidth.

The video never travels from YouTube to you. It goes YouTube → them → you. Every consequence below follows from that one fact.

Why there are so many ads

They paid for the bandwidth twice — once to fetch the video, once to send it to you. A 200 MB download costs them 400 MB of transfer, plus storage and CPU for the muxing.

At scale that is a real hosting bill, with no subscription behind it. So it is funded by advertising, and the ad inventory available to a site in this category is the low end of the market: pop-unders, redirects, fake download buttons, push notification prompts.

That is not a moral failing, it is arithmetic. A free service with a large bandwidth bill and no subscription is funded by whatever advertising will have it.

The practical consequence is the well-documented one: the risk on these sites is rarely the video file and usually the page around it — the button that is not the download button, the “update your player” prompt, the extension it suggests. Being careful about which button you click matters more than which site you use.

Why the quality is capped

Above 1080p, YouTube serves video and audio as separate streams that must be combined. That is a CPU cost per download, on their machines.

So many sites cap at 720p or 1080p, offer higher tiers behind an account, or serve a pre-merged format — the one YouTube still provides combined, which tops out at 360p.

When a site offers “4K” free with no queue, it is worth wondering what pays for it.

Why there is a queue

Their servers are downloading everyone’s videos. YouTube rate-limits them harder than it would rate-limit you, because they are making thousands of requests from a handful of datacentre addresses — the same 429 you would hit yourself, at industrial scale.

So they queue, and they rotate through proxies to stay ahead of it, which is another line on the bandwidth bill.

Worth being precise here, because this gets exaggerated in both directions.

A URL plus an IP address plus a timestamp is not nothing. Over repeated use it is a list of what you watched and when, attached to an address that usually maps to one household. Whether that is logged, for how long, and whether it is sold, is not knowable from outside — you are trusting a privacy policy you did not read on a site whose name you will not remember tomorrow.

What it is not: access to your machine, your files, or your YouTube account. Pasting a public URL into a website does not compromise anything. The realistic risk is a profile of your viewing and whatever the ad network does with it.

If the video is a public music video, that is a small thing. If it is an unlisted link to a family recording or an internal company video, understand that you have just handed the URL to a third party, and that unlisted links are not access-controlled — anyone with the link can watch it, including them.

What a local downloader does instead

The request goes from your Mac to YouTube. The file comes back to your Mac. There is no third party, so:

  • No queue, because nobody else is sharing it.
  • Your connection’s speed, not a shared allocation.
  • Every format YouTube offers, including the ones that need muxing.
  • No advertising, because there is no bandwidth bill to fund.
  • The link goes to YouTube, which already knows you are watching.

That last one is the honest framing of the privacy point. A local downloader does not make you anonymous to YouTube — it removes one additional party, and that is all it does.

The cost is that you install software, and software is a thing you have to trust too. Which is a fair objection, and the reason mine is open source and does not bundle a bandwidth-funded business model. Judge that claim by reading it, not by my saying so.

The one online tool worth naming

cobalt (cobalt.tools) has no ads and no tracking. The mechanics above still apply — it is still their server fetching the video — but the funding is not advertising, so the page around the button is not hostile.

For one video, on a machine that is not yours, it is a perfectly sensible answer. I would not send anyone anywhere else in that category.

How to judge any of these sites

Rather than a blocklist, which rots in a month:

  • How many buttons look like the download button? More than one is the whole story.
  • Does it want a browser extension? An extension can read every page you visit. That is a large permission for saving a video.
  • Does it want notification permission? Push notifications are an ad channel that outlives the tab.
  • Is there a real privacy policy naming a real company? Usually not.
  • Does it ask you to install a “player” or “codec”? Leave.

The file itself is usually fine. It is a video file from YouTube. Everything worth worrying about is in the page.

In short

Online downloader Local tool
Who downloads Their server Your Mac
Who sees the link Them, and YouTube YouTube
Speed Shared bandwidth, queued Yours
Quality What they choose to serve Everything YouTube has
Funded by Advertising Nothing, or a purchase
Installs anything No Yes
Main risk The page around the button Trusting the software

Neither is dangerous in the way the panic articles suggest. They are different trades, and the trade is: no installation, in exchange for a middleman who has to be paid somehow.