Direct Media Downloader

Save a media file you already have the right to download, from a link that points straight at it. There is no server in between.

Only download media you own or are authorized to download.

This tool does not bypass DRM, authentication, paywalls, or access controls.

Before you download: this is your call, not ours

You are responsible for having the right to download the file you paste in. This tool cannot check that, and it does not pretend to — it has no idea who you are, what you have bought, what your licence says, or what the publisher of that file allows. The tick box on the form is a statement you are making, not a permission this tool is granting.

Only download media you own or are authorized to download. That means your own recordings and uploads, files published for download, material under a licence that allows reuse, public-domain works, podcast episodes, press-kit assets, and files your employer or client has given you for your work.

It does not mean material behind a sign-in, a subscription or a purchase you have not made; material a publisher offers as streaming but not as a download; or anything a platform’s terms prohibit. If you do not know, ask the rights holder before you download. Copyright rules differ by country, and nothing on this page is legal advice.

What this tool will not do to get you a file

This tool does not bypass DRM, authentication, paywalls, or access controls. There is no DRM decryption here, no handling of encrypted or protected streams, and no watermark removal. If a file is protected, this tool leaves it protected.

There is no access-control or authentication bypass either. It sends no cookies and no credentials with any request, so it cannot act as a signed-in user anywhere; it mints no guest tokens and no anonymous sessions; it solves no signatures, ciphers or player tokens; and it contains no platform extractor, so there is no code here that knows how to reconstruct a media URL a site did not offer you.

It also does not spoof a User-Agent or a Referer, rotate identities after a refusal, evade a CAPTCHA, scrape a page’s internal state, or weaken TLS certificate checking. These are not features awaiting a future release. Removing them would change what this product is, so they will stay absent.

How a link is checked before anything is contacted

Typing in the box contacts nothing. The feedback under the field is produced entirely on your device. Only the "Check link" and "Download" buttons reach the network, and each says so on the button itself.

Only https links are accepted, so the file cannot be read or altered in transit. Links carrying a username or password are refused, both because credentials in a URL are unsafe and because that syntax is a common way to disguise which host is really being contacted.

Private and internal addresses are refused: loopback, the private ranges, link-local addresses including the one cloud providers use for instance metadata, and names ending in .local or .internal. Obfuscated spellings are refused too, because 2130706433, 0x7f000001, 0177.0.0.1, 127.1 and ::ffff:127.0.0.1 are all the same address as 127.0.0.1.

Why there is no server in the middle

Your browser talks directly to the host in your link, and the file is saved straight to your device. There is no ToolAcre server in the path, because this product does not have one.

A proxy would make more links work. It would also put your file through a machine you do not control, and it would create an endpoint that fetches arbitrary URLs on request — which can be pointed at private addresses inside a hosting network to reach things that were never meant to be public. That bug class is server-side request forgery, and choosing not to have a server removes the whole category.

The cost of that choice is real and is not hidden from you: a host that refuses cross-origin reads simply cannot be downloaded from here, and the tool says so instead of quietly routing around it.

Scope

  • It accepts direct https links to a media file. Page URLs from video platforms are not supported.
  • It contains no platform extractor, no scraping, and no signature or cipher handling.
  • It has no server proxy, so hosts that refuse cross-origin reads cannot be downloaded from here.
  • It sends no cookies or credentials, so media behind a sign-in is out of reach by design.