RuneFetch 1.0 — one tool for YouTube, Spotify, and 1000+ sites
RuneFetch is an open-source desktop download manager with a browser extension that captures media from any tab. Here's what's in the first release.
I download a lot — reference footage, playlists, the occasional stream — and I was tired of juggling a different site-specific tool for every source, or pasting links into web converters I didn’t trust. So I built RuneFetch: one local desktop app that handles all of it, and a browser extension that feeds it links from any tab.
Today it hits 1.0, and it’s open source under MIT.
What it does
RuneFetch is built in Python with a pywebview UI. Under the hood it leans on the
best tools in the ecosystem rather than reinventing them:
- YouTube, Twitter/X, Instagram, TikTok, and 1000+ more through
yt-dlp’s extractors - Spotify via
spotdl - Any direct or streaming URL, including HLS/DASH, through its own resumable HTTP downloader
Everything runs on your machine. Nothing routes through a third-party service.
The parts I’m proud of
Segmented downloads. The raw HTTP downloader splits a file across up to 8 parallel connections using Range headers, and falls back to a single resumable stream when a server won’t cooperate.
A persistent queue. Add a pile of links, close the app, reopen it — the thread-safe queue and its pause/resume state survive the restart.
A browser extension that just hands off. The Manifest V3 extension detects downloadable media on any open tab and passes it to the desktop app over a loopback-only WebSocket bridge, paired with a shared token. The browser does the finding; the app does the downloading.
Zero-setup ffmpeg. On first launch RuneFetch checks for ffmpeg and, if it’s
missing, offers to fetch it into ~/.runefetch/bin/ so muxing just works.
Built to fail closed
Because a download manager takes arbitrary user-supplied URLs, the network layer
got the most care. A dedicated egress guard (net_guard.py) sits in front of the
raw HTTP downloaders and defends against SSRF: it resolves every host, rejects
private / loopback / link-local / reserved addresses, re-validates every redirect
hop manually, and fails closed on DNS errors. The browser bridge binds to
127.0.0.1 only and requires the shared secret. DRM-protected services like
Netflix and Disney+ are detected and politely declined rather than half-attempted.
I’ll write that security design up properly in a follow-up post.
Try it
- Download v1.0.0
- Source on GitHub — stars and issues welcome
If you break it, tell me — that’s how 1.1 gets better.