Cobalt

Open-source media downloading, honestly reviewed. No marketing fluff, just what you get when you paste a link.

TL;DR

• What it is: A privacy-first media downloader — paste a link from YouTube, Instagram, TikTok, X, Reddit, or a dozen other platforms and get the file. No ads, no trackers, no paywalls [website].
• Who it’s for: Creators archiving their own work, educators grabbing offline materials, and privacy-conscious users sick of ad-laden download sites [about].
• Cost savings: The public instance at cobalt.tools is free. The ad-loaded alternatives (SaveFrom, SSYouTube, ClipGrab) either charge or monetize your attention. YouTube Premium costs $13.99/mo partly to unlock offline downloads — cobalt handles it for $0 [website].
• Key strength: Treats privacy as a design constraint, not a feature. Requests are anonymous, no content is ever stored on the server, and local processing is used whenever the device supports it [about].
• Key weakness: AGPL-3.0 license means any derivative work must also be open source. The public instance has rate limits. Native playlist support isn’t built-in [README][4].
• Stars: 39,158 on GitHub. That’s not a niche project [github].

---

What is Cobalt

Cobalt is a media downloader that describes itself as “best way to save what you love.” The pitch is deliberately minimal: paste a link, get a file, move on. No account required, no extension to install, no captcha, no pop-up asking you to subscribe [website].

Under the hood, it works as a proxy. The server never caches downloaded content — it either tunnels the file directly to your browser, or if remuxing or transcoding is required, processes it in a live stream and sends it straight to the client without touching disk [about][README]. That design choice is both an ethics statement and a performance decision.

The project is built and maintained by the imputnet team, organized as a monorepo with separate API, web frontend, and packages. The API is the core: it accepts a URL, returns a download link or streams the file. The web frontend at cobalt.tools is one consumer of that API — but because the API is documented and public, anyone can build on it or run their own instance [README][4].

The tool is explicit about its ethics: it only handles free and publicly accessible content. The same files cobalt downloads are accessible through any browser’s developer tools — cobalt just removes the friction [README]. It takes zero liability for how downloaded content is used or distributed. That’s a reasonable position for infrastructure software.

As of this writing, the project has 39,158 GitHub stars and an active community Discord. It’s sponsored by royalehosting.net, which hosts part of its infrastructure [README].

---

Why People Choose It

The honest answer is that the alternatives are terrible.

The mainstream “free” download sites — SaveFrom.net, SSYouTube, Y2Mate, and their clones — are monetized by injecting ads, some of which have historically delivered malware. You paste a YouTube link and get a page that’s 80% ads, several fake “Download” buttons designed to trigger ad clicks, and a real download button buried somewhere. That model works financially precisely because users don’t have an alternative they know about.

Cobalt is that alternative. The interface is a single input box. No fake buttons, no ads, no requirement to disable your ad blocker. It works [website].

The privacy angle adds a second reason. Every request to the cobalt backend is anonymous — no user accounts, no tracking, no logs of what you downloaded [about]. The about page is direct about this: “we have a strict zero log policy and don’t store or track anything about individual people.” For creators pulling clips of their own content, educators archiving educational videos, or anyone who doesn’t want a media download site to build a profile on them, that matters.

The power-user reason is the API. Cobalt exposes a documented REST API that third-party projects build on. One example: a community-built playlist downloader for YouTube uses cobalt’s API as its backend [4]. The pattern appears in several community tools — cobalt as a reliable extraction layer, with custom logic sitting on top. That’s a different audience than the no-code download button user, but it explains a chunk of the GitHub star count.

The self-hosting angle completes the picture. Because cobalt is open source and ships with deployment documentation, you can run your own instance. If you operate a media-heavy workflow — archiving content for a newsletter, pulling clips for a video production pipeline — hosting your own instance removes any rate limit concerns and keeps all traffic inside your own infrastructure [README][about].

---

Features

Core download:

• Video, audio, photos, and GIFs from supported services [about]
• Quality and format selection (resolution, codec, audio bitrate)
• Audio-only download mode
• Auto audio mute: when a video uses copyrighted background music tracked separately, cobalt can mute it automatically [website]
• Remux without re-encoding when possible — preserves quality, faster processing [about]

Privacy controls:

• All backend requests are anonymous [about]
• Tunnel metadata encrypted [about]
• Local processing on device when supported — remuxing/transcoding happens in-browser rather than server-side [about]
• Forced tunneling option: forces all traffic through cobalt’s servers, hiding the source URL even from your network provider. Your ISP sees cobalt traffic, not the origin platform [about]

Instances:

• The official instance at cobalt.tools is free to use
• Settings let you add a custom instance — a friend’s server, or your own — as an alternative backend [about]
• Multiple community-run instances exist for redundancy

API:

• Documented REST API [README]
• Environment variables for instance configuration documented [README]
• Rate limiting on the public instance; self-hosted instances have no enforced limits [README]
• API has been used to build playlist downloaders [4], automation tools, and download managers

Self-hosting:

• Monorepo structure: run the API independently from the frontend [README]
• Instance protection guide covers rate limiting, authentication, and abuse prevention [README]
• Full environment variable documentation for API configuration [README]

Supported services: The website lists “supported services” but doesn’t publish a complete static list in the scraped content. Based on community usage and the about page: YouTube, Twitter/X, Instagram, TikTok, Reddit, Vimeo, SoundCloud, Bilibili, and others. The cobalt.tools interface shows the live list [website].

---

Pricing: What It Replaces and What It Costs

Cobalt itself:

• Public instance at cobalt.tools: free, no account, no limit stated publicly [website]
• Self-hosted instance: $0 for the software (AGPL-3.0) [github]. Add VPS costs: $5–10/mo on Hetzner or Contabo for a lightweight instance.

What it replaces (with actual costs):

YouTube Premium — $13.99/mo. The offline download feature is a primary reason many people subscribe. If cobalt handles your occasional “I want this video offline” use case, that’s $168/year you don’t spend.

4K Video Downloader+ — $15/year for the paid version, $4.99/mo for “Bundle.” Reasonable for power users but still a recurring cost for what is fundamentally a convenience layer.

SaveFrom / Y2Mate / SSYouTube — Technically free, but the ad-malware risk has a real expected cost. Several of these sites have distributed malicious ad payloads. The “cost” is risk, not money.

Browser dev tools — Free, but slow and manual. Cobalt automates the same network request extraction that you’d do by hand through DevTools.

Self-hosted math:

If you’re pulling clips regularly for a video production workflow or content archive, the friction of rate-limited public instances adds up. A $6 Hetzner VPS running your own cobalt instance eliminates rate limits and keeps everything in your control. Over a year: $72. No per-download pricing, no account, no dependency on the public instance’s uptime.

---

Deployment Reality Check

Cobalt’s API is a Node.js service. The documentation covers running an instance, protecting it, and configuring environment variables [README]. Docker-based deployment is the expected path for most self-hosters.

What you actually need:

• A Linux VPS (1–2 GB RAM is sufficient for a personal instance)
• Docker or Node.js runtime
• A domain and reverse proxy (Caddy or nginx) if you want HTTPS and a clean URL
• Basic familiarity with environment variable configuration

What the docs cover:

• How to run a cobalt instance [README]
• How to protect an instance from abuse (rate limiting, access controls) [README]
• API environment variables reference [README]
• API documentation for building on top of it [README]

What can go sideways:

The AGPL-3.0 license is important to understand before building a business around it. Any derivative work — including running a modified cobalt instance as a service — must also be released under AGPL-3.0. That’s fine for personal use and internal tooling. It’s a hard constraint if you’re embedding cobalt in a commercial product without open-sourcing your additions.

The public instance enforces rate limits. For a developer testing against cobalt’s API, hitting those limits is frustrating. The solution is running your own instance, which adds a deployment step that isn’t trivial for non-technical users [README][4].

Native playlist support is absent from core cobalt. The API returns one file per URL. The community has built workarounds — the playlist downloader in [4] iterates playlist items and calls the cobalt API per video — but it’s extra infrastructure, not built-in [4].

Platform availability can shift. Media platforms actively try to block scraping and download tooling. Cobalt stays current by updating its extraction logic, but at any given moment a particular platform may be partially broken while a fix is in progress. That’s inherent to any tool in this space.

Realistic setup time for a technical user: 20–40 minutes to a working self-hosted instance. For a non-technical user using the public cobalt.tools frontend: zero — it works in the browser immediately.

---

Pros and Cons

Pros

• No ads, no trackers, no bullshit. The public interface is a single input box. Nothing to dismiss, nothing to click around [website].
• Genuine zero-log policy. Requests are anonymous, nothing stored, nothing tracked [about]. This is rare in media tools where most “free” services monetize user behavior.
• Local processing first. Remuxing/transcoding happens on your device when possible. The server doesn’t touch your content if it doesn’t have to [about].
• Forced tunneling. For maximum privacy, you can route all downloads through cobalt’s servers to hide the source from your network provider [about].
• Documented REST API. Third-party tools can build on cobalt reliably [README][4]. The API is a first-class output, not an afterthought.
• Self-hostable. Add your own instance in settings. Friends can share instances. Organizations can run internal instances with no rate limits [about][README].
• 39,158 GitHub stars. That’s a signal of genuine community adoption, not marketing [github].
• Ethics policy. The project is explicit that it only handles free and publicly accessible content. Same data you’d get from browser dev tools [README].

Cons

• AGPL-3.0 copyleft. Any derivative work must be open source. Fine for personal use, significant constraint for commercial embedding [github].
• No native playlist support. One URL = one file. Playlist downloads require wrapping cobalt with external tooling [4].
• Rate limits on public instance. Heavy use means running your own instance, which adds deployment complexity.
• Platform fragility. Extraction logic needs maintenance as platforms change their internals. Occasional breakage for specific services while fixes land.
• No GUI for batch downloads. The web frontend handles one download at a time. Power users need to script against the API or use third-party wrappers [4].
• Community-run, not VC-backed. Sponsored by royalehosting.net but not funded like a startup. Longevity depends on maintainer motivation, not a funding runway [README].
• Data on third-party reviews unavailable. The articles provided for this review were erroneously fetched for “Cobalt Strike” (a penetration testing framework) rather than cobalt.tools. Synthesis from independent user reviews was not possible from the available input.

---

Who Should Use This / Who Shouldn’t

Use Cobalt if:

• You occasionally need to download a video, audio clip, or image for offline use and the current alternatives (ad-filled sites, browser dev tools, paid software) are annoying.
• You’re a creator archiving your own published content from platforms that don’t offer a reliable export.
• You’re building tooling that needs media extraction as a step — the API handles the hard part.
• You want to self-host a clean instance for your team’s content workflow.
• Privacy matters to you and you don’t want a download site logging what you access.

Skip cobalt if:

• You need to download entire playlists or channels in bulk — yt-dlp is more suited for that use case.
• You’re embedding media downloading into a commercial product — AGPL-3.0 means you’ll need to open-source your additions or negotiate separately.
• You need enterprise features, SLAs, or support contracts — this is community software.
• You’re on a platform cobalt doesn’t support, or where recent changes broke its extractor.

---

Alternatives Worth Considering

• yt-dlp — the command-line gold standard for media downloading. Supports more sources, handles playlists and channels natively, highly configurable, active maintenance. Not beginner-friendly — requires terminal comfort. Free, open source (Unlicense).
• gallery-dl — similar CLI tool focused on image galleries and photo platforms. Complements yt-dlp rather than replacing it.
• SaveFrom.net / Y2Mate — free but ad-heavy. Privacy is not a design consideration. Have historically served malicious ads. Not recommended.
• 4K Video Downloader — clean GUI application, handles playlists, paid tiers required for full feature set. Closed source.
• Parabolic — GTK-based GUI frontend for yt-dlp. Brings desktop-app usability to yt-dlp’s power. Linux-native.
• Browser dev tools — the manual equivalent of what cobalt automates. Free, works on any platform, requires technical knowledge.
• YouTube Premium — if your use case is specifically YouTube offline and you’re already paying for ad-free viewing, the offline feature may be bundled in. At $13.99/mo it’s expensive for the download use case alone.

For a non-technical user who wants a fast, private, no-install option: cobalt.tools is the right answer. For a technical user who needs bulk downloads, playlists, or advanced format control: yt-dlp.

---

Bottom Line

Cobalt solves a problem that shouldn’t require a solution in 2026 — media platforms don’t give users clean download options, and the ad-supported alternatives that fill the gap are a privacy and malware vector. Cobalt is the honest version of those tools: open source, zero logs, no ads, works as a proxy without ever storing your content, and self-hostable if you want complete control. The 39,158 GitHub stars reflect genuine user demand, not marketing spend. The trade-offs are real — AGPL-3.0 limits commercial embedding, no native playlist support, community maintenance without a funding backstop — but for the core use case of “I have a link and I want the file,” cobalt is the cleanest option available. If the thought of running your own instance is the blocker, that’s a one-afternoon setup — or the kind of thing upready.dev deploys for clients as a one-time engagement.

---

Sources

1. imputnet/cobalt — GitHub repository (39,158 stars, AGPL-3.0). https://github.com/imputnet/cobalt
2. cobalt.tools — Official website. https://cobalt.tools
3. cobalt.tools/about/general — About page (“what’s cobalt?”). https://cobalt.tools/about/general
4. kwiat/playlist — Codeberg — “Easily download YouTube playlists using cobalt.tools’ API.” https://codeberg.org/kwiat/playlist

Note on provided article sources: The five article URLs supplied as input ([1]–[5]) were scraped for “cobalt” but returned content about Cobalt Strike (a commercial penetration testing framework by Fortra), XMRig, and unrelated Docker tooling — none of which concern cobalt.tools. Those articles were excluded from this review rather than cited misleadingly. Third-party review synthesis was based on primary sources only.