cyberdrop-dl: a bulk asynchronous downloader for file hosts

What cyberdrop-dl actually is

cyberdrop-dl describes itself as a bulk asynchronous downloader for multiple file hosts. The README is unusually short for a project of this size, and it points at two external documents: a list of supported sites and a getting started guide, both on a GitBook wiki.

That means the repository root tells you very little on its own, so the packaging metadata does the describing. The distribution is published to PyPI under a different name than the repository, cyberdrop-dl-patched, and the current version string is 10.12.1dev0. The author is listed as Jacob B, with the email at script-ware.net.

The repository topics are the clearest statement of scope, and they read as a host list: bunkr, cyberdrop, dropbox, filester, gofile, google-drive, mediafire, mega-nz, onedrive, patreon, pawchive, pinterest, pixeldrain, transfer-it, twitch and twitter. Some of those are file hosts, some are link shorteners or social platforms, and the interesting engineering is in the difference between them, since each needs its own way of finding the actual media URL before a download can start.

The technical tags are asyncio and a bulk downloader, and that combination is the design. A tool that has to fetch hundreds of files from a host with per-connection rate limits cannot do it serially without becoming the slowest part of the workflow.

The dependency set as an architecture description

Because the README is thin, the pyproject.toml is the best source for what the tool actually does, and the dependency list is unusually revealing.

The asynchronous core is aiohttp with a version floor of 3.14.5 and a ceiling below 4.0.0, aiohappyeyeballs for happy-eyeballs connection racing, and aiolimiter for rate limiting. That trio is a downloader that opens many connections at once, retries sensibly and stays polite about how fast it hits a host.

The job state is aiosqlite, so the download queue lives in a SQLite file rather than in memory. That is what makes a large run resumable, and it is also why the package needs a filesystem.

The user interface is rich, with a version floor of 15.0.0, and there is a rich-rst companion for rendering reStructuredText. The README shows a TUI preview image, so the terminal interface is a real feature rather than plain log output. Prompts come from questionary, and the command line itself is handled by cyclopts, which is a relatively recent choice and a modern one.

The configuration layer is pydantic pinned to an exact 2.14.1, which is what makes a large settings file validated rather than merely parsed. The hosts are parsed with beautifulsoup4 and soupsieve, and curl-cffi is there for cases where a plain TLS fingerprint gets a server to refuse the connection.

Then there are the specialised ones, and the relevant pinned lines are visible in the manifest.

    "aiohttp >=3.14.5, < 4.0.0",
    "aiohappyeyeballs>=2.7.1",
    "aiolimiter >=1.3.0",
    "aiosqlite>=0.22.1",
    "beautifulsoup4 >=4.15.0",
    "m3u8 >=6.0.0",
    "pydantic == 2.14.1",
    "rich >=15.0.0",

m3u8 handles HLS playlists, which is what a video host returns. async-mega-py handles mega.nz. pycryptodome handles decryption for the hosts that encrypt their links. imagesize reads image dimensions, so the tool can report image details rather than just that it downloaded. wassima handles certificate verification in its dependency set. send2trash moves files to the system trash instead of deleting them, psutil reports process information on platforms other than Android, xxhash is used for fast content hashing, and backports.zstd covers zstd compression on Python versions before 3.14.

Python version support and the packaging shape

The classifiers list Python 3.12, 3.13, 3.14 and 3.15, and the project is classified as Production/Stable with the Environment:: Console tag. Several dependencies carry environment markers that reflect this spread, most visibly backports.zstd which installs only on CPython below 3.14, and psutil which is skipped on Android.

The repository layout is a modern Python project rather than a legacy one. There is a pyproject.toml as the single source of project metadata, a uv.lock for reproducible resolution, a tox.ini for test environments, a.pre-commit-config.yaml for hooks, a.python-version file, and a CHANGELOG.md. The package directory is cyberdrop_dl, with tests/ and docs/ alongside, and a scripts/ directory.

The docs directory holds the assets for the README, including the TUI preview image the README embeds, and the wiki the README links to for supported sites and getting started is published separately from the repository.

The versioning deserves a note. The GitHub release history shows major versions 10.0.0 in June 2026, 9.3.1 in April 2026 and 8.0.0 in September 2025, and the release names follow the pattern of the package being renamed at each major step, with Cyberdrop-DL V10.0 Start Files and V9 Start Files. The manifest version of 10.12.1dev0 sits between those releases, which tells you the branch tracks development and the tags mark the milestones. The repository is not archived and the last push was on 2026-10-22, so it is being worked on.

Where cyberdrop-dl is the wrong tool

The first limitation is documentation, and it is a real one for anyone evaluating the project. The README has no install command, no usage example and no configuration walkthrough. It links to a wiki for the supported site list and a getting started guide, and everything else is in the metadata. A reader looking for a one-line install in the repository will not find it, and the PyPI project page is the canonical distribution point rather than the repository.

The second is that every host is a moving target. A downloader for a dozen-plus sites depends on the behaviour of a dozen-plus third-party services, and any of them can change its page structure, its token handling or its rate limit without notice. The project mitigates this by shipping host-specific code and by moving fast, but the cost lands on the user as occasional breakage, and the fix is usually a new release rather than a configuration change.

The third is the legal and terms-of-service dimension, and the tool's own topic list is what makes it relevant. Several of the supported hosts and sources are file-sharing and social platforms where what you may download depends on the account, the subscription and the jurisdiction. A downloader that works is not a permission to download, and the sensible use is material you have the right to fetch, which is a narrower set than the topic list suggests.

The fourth is the trust surface of a tool that handles untrusted content. Parsing HTML from sites designed to be scraped, following links through shorteners, handling encrypted links and downloading archives all widen the attack surface, and a project of this kind has to keep its parsing dependencies current. The pinned pydantic and the pinned exact versions elsewhere in the dependency list show a deliberate approach to that, though pinning also means security updates arrive only when the project releases them.

The fifth is that the wiki is a moving dependency. The getting started guide lives outside the repository, so it can change independently of the code, and a reader following a guide that has drifted from the current version will be debugging configuration rather than the tool.

Licence, distribution and the cost of running a bulk downloader

The project is under the GPL-3.0 licence, with the LICENSE file at the root of the repository and the badge in the README pointing at it. For a tool people install as an end user, the practical effect of GPL is on redistribution rather than on use, and the package on PyPI is published under that licence for anyone who forks it.

The distribution channel is worth understanding because the names do not match. The GitHub repository is cyberdrop-dl under the Cyberdrop-DL organisation, the PyPI project is cyberdrop-dl-patched, and the wiki is hosted on a GitBook under script-ware. The patched suffix suggests the PyPI distribution is a maintained fork of an earlier tool, and the version scheme with major renames tracks that history.

The running cost is modest in resources and significant in care. The dependency set is large but all of it is pure Python or has wheels, and the only genuine operational requirement is a Python 3.12 or newer environment. The disk cost is whatever you are downloading. The real cost is bandwidth against the host, and that is exactly what aiolimiter and aiohappyeyeballs are there to manage, since a bulk run that trips a host's rate limit gets the IP blocked and every other user of the tool on that network affected with it.

For that reason the sensible operational posture is to keep concurrency modest, respect the host terms, and treat the SQLite job store as the thing that makes a partial run resumable rather than restarting from nothing. The project ships a SECURITY.md and a CONTRIBUTING.md, so there is a reported channel for both vulnerabilities and patches.

Editorial conclusion

cyberdrop-dl suits someone who already knows which hosts they need to pull from and wants one queue and one set of logs instead of a separate tool per site, since the host support is the product and the asynchronous core is what makes bulk runs bearable. It does not suit a user who wants a documented one-command install from the README, because the setup detail lives on a wiki. Verify the Python version first, at 3.12 or above, and read the host terms of service before pointing it at a site, since a downloader that works is not a permission to download.

Frequently asked questions

Official sources

1. Cyberdrop-DL/cyberdrop-dl on GitHub
2. License: GPL-3.0
3. Project website
4. README
5. Releases