DwarvenStack
← All products
Shipped

RuneFetch

Download from YouTube, Spotify, and 1000+ sites — with a browser extension that captures media from any tab.

View repository on GitHub:★ 0⑂ 0PythonApplicationsMIT
  • Python
  • pywebview
  • yt-dlp
  • spotdl
  • JavaScript
Star on GitHub

RuneFetch is an open-source desktop download manager built in Python and pywebview. It pulls video and audio from YouTube, Spotify, and 1000+ sites through yt-dlp and spotdl, and grabs any direct file URL — including HLS/DASH streams — with resumable, multi-connection HTTP. A companion Chrome/Edge/Brave extension (Manifest V3) captures downloadable media from any open tab and hands it off to the desktop app over a local, token-authenticated bridge.

It’s for people who download a lot and want one tool that handles everything — creators pulling reference footage, archivists saving playlists, anyone tired of juggling site-specific downloaders or sketchy web converters. Everything runs locally; nothing routes through a third-party service.

Highlights

  • Broad source support — YouTube, Spotify (via spotdl), Twitter/X, Instagram, TikTok, and 1000+ more via yt-dlp’s extractors, plus any direct or streaming URL
  • Segmented downloads — multi-connection HTTP via Range headers (8 parallel by default) with single-stream resume as a fallback
  • Persistent queue — thread-safe queue with pause/resume that survives restarts
  • Browser extension — an MV3 extension pairs to the app with a shared token over a loopback-only WebSocket bridge
  • Zero-setup ffmpeg — checks for ffmpeg on first launch and offers to auto-download it to ~/.runefetch/bin/

Built security-first

The notable part is the plumbing. A dedicated egress guard (net_guard.py) protects the raw HTTP downloaders against SSRF: it resolves every host, rejects private / loopback / link-local / reserved addresses, re-validates every redirect hop manually, and fails closed on DNS errors. The browser bridge binds to 127.0.0.1 only and requires a shared secret. DRM-protected services like Netflix and Disney+ are explicitly detected and declined rather than half-attempted.

Get it