Stash: A FLAC-First Android Client for Your Spotify and YouTube Music Libraries

What Stash Actually Solves

Stash addresses a specific gap: Spotify and YouTube Music do not let you download lossless FLAC files for offline playback on your phone, and their official APIs restrict what third-party apps can do. Stash mirrors your entire library, including liked songs, playlists, and daily mixes, to your Android device. It offers two modes. Offline mode downloads each track as a real FLAC file, which you can play with no connection. Online mode builds a local index and streams tracks, using almost no storage. The target user is someone who wants a unified library across both services, wants lossless audio, and is comfortable with a non-official approach. This is not for the casual listener who is happy with AAC streams. It is for the person who checks bitrates and wants files on disk.

The Cookie Authentication Mechanism

Stash does not use Spotify's or YouTube's official APIs. The README states that the official APIs do not allow third-party apps to do what Stash does. Instead, Stash uses your existing login cookies. For Spotify, you can sign in inside the app, and Stash extracts the cookie automatically. If that fails, you manually copy the sp_dc cookie from your browser's Developer Tools. For YouTube Music, you copy the entire cookie header from a network request, because YouTube authenticates with multiple cookies together. These cookies are stored on-device, encrypted with AES-256-GCM via Google's Tink library. The only network traffic Stash makes is to Spotify and YouTube themselves. This design avoids running a server and keeps your credentials local, but it also means your account is authenticated the same way a browser session is. The README notes that cookies are session-scoped and can be revoked by logging out of Spotify on the web. This is a fragile mechanism: if a service changes its login flow or cookie format, Stash could break until updated.

The FLAC Backbone and Its Dependencies

Stash does not generate FLAC files itself. It relies on two external projects: QBDLX, a Qobuz downloader that streams lossless files, and arcod, referenced only by a URL. The README describes these as run by solo developers, free, and the reason Stash can hand you a real lossless file instead of a re-encode. This is a significant architectural dependency. If either backend becomes unavailable, is taken down, or changes its API, Stash's core promise of FLAC downloads collapses. The README even asks users to send thanks or tips to these projects, acknowledging their fragility. For an engineering evaluation, this means Stash is not self-contained. Your ability to get FLAC files depends on third parties that are not part of the Stash repository. You should verify that QBDLX and arcod are still active and compatible with current service changes before relying on Stash for a permanent library.

Installation and Build Requirements

There are three installation paths. The simplest is to download the latest Stash-v*.apk from the Releases page and allow unknown sources. For automatic updates, you can add the repository to Obtainium, which tracks GitHub Releases. Building from source requires Android Studio Hedgehog (2023.1.1) or later, JDK 17, and Android SDK 35. The command is straightforward: git clone, cd Stash, then ./gradlew assembleDebug. The APK lands in app/build/outputs/apk/debug/. The app requires Android 8.0 (API 26) or later. Offline mode needs 9 to 15 GB of free storage for a medium library, which scales with how much you sync. Online mode needs almost nothing. The build process is standard for a Kotlin Android project, but the cookie extraction steps are the real onboarding cost. You are not just installing an app; you are learning to use browser Developer Tools to copy session credentials.

Key Features and Their Trade-offs

Stash offers a unified library view, which is its main convenience. It also includes 'bulletproof matching' that finds the right version of a track 99% of the time, according to the README. That claim is unverified, but the wrong-match flag is a useful feature: if Stash picks the wrong version, you tap once from Now Playing and it queues a re-search. Likes and History mirroring is optional, so your in-app actions can sync back to Spotify and YouTube. Playback features include a 5-band equalizer with presets, bass boost, virtualizer, crossfader, normalizer, and synced lyrics from LRCLIB. Privacy is a strong point: no Stash servers, no accounts, no analytics, no third-party crash reporters. All of this is GPL-3.0 licensed. The trade-off is that the app's functionality depends on scraping your cookies, which is a security risk if your device is compromised, and it violates Spotify's and YouTube's terms of service, which could lead to account action. The README does not mention this risk, but it is an obvious consequence of the design.

Real Limitations and Failure Modes

The most obvious limitation is the account risk. Using cookies to authenticate is against the terms of service of both Spotify and YouTube. The README does not warn about potential account bans, but any engineer should recognize that this is a violation. Another limitation is the dependency on external backends. QBDLX and arcod are not part of Stash's codebase, and their availability is not guaranteed. If they stop working, Stash's offline mode may degrade to non-lossless or fail entirely. The README also notes that cookies from incognito or private windows sometimes fail to sync, which is a practical annoyance. The storage requirement is another constraint: 9 to 15 GB for a medium library is substantial, and it scales with what you sync. Finally, the setup process is not user-friendly for non-technical people. Copying a cookie from DevTools is a barrier that many users will not cross. Stash is the wrong tool if you want a plug-and-play experience, if you are not willing to risk your account, or if you need official API stability for a production environment.

Alternative Approaches

The obvious alternative is to use Spotify's and YouTube Music's official offline features. Spotify Premium allows offline downloads, but they are encrypted and not lossless. YouTube Music Premium offers offline listening, but again, not FLAC. These are official, account-safe, and require no cookie extraction, but they do not give you files you can move or keep. Another alternative is to use a dedicated downloader like QBDLX directly, which is one of Stash's backends. You could download FLAC files from Qobuz yourself and manage them with a media player like Plex or Jellyfin. That approach gives you full control over your files and does not tie you to Stash's sync logic, but you lose the unified library and daily mix integration. Stash's approach is to automate the entire flow, but it does so by leaning on the same tools you could use manually. The difference is convenience versus control. Stash gives you convenience at the cost of dependency and risk.

Maintenance and License Implications

Stash is actively maintained, with recent releases in August 2026, and the repository is not archived. The project is GPL-3.0, which means all code is open source and any derivative works must also be GPL-3.0. This is a copyleft license, so if you fork or modify the app, you must release your changes under the same license. For an engineer evaluating this for personal use, the license is permissive enough to inspect and modify. For commercial use, the GPL-3.0 obligations might be a concern. The maintenance cost is ongoing because Stash depends on the fragile cookie and backend ecosystem. Each time Spotify or YouTube changes their authentication, Stash will need updates. The release cadence suggests the developer is responsive, but there is no guarantee of long-term support. You should check the release notes for each version to see what broke and what was fixed, and be prepared to update frequently via Obtainium or manually.

Editorial conclusion

Adopt Stash if you are an Android user who wants true lossless FLAC files for offline listening without paying a subscription, and you accept the cookie-based authentication and the dependency on third-party download backends. Do not use it if you are unwilling to extract cookies from browser DevTools, if you need official API stability, or if your Spotify or YouTube account is valuable enough that a ban would be costly. Before installing, verify that the QBDLX and arcod backends are still operational, check the latest release notes for any sync issues, and confirm your device has the 9 to 15 GB of storage that Offline mode demands for a medium library.

Official sources

1. Official README
2. Project repository
3. Release notes