# Are Online YouTube Downloader Sites Safe?

Source: https://b-roll-6hk.pages.dev/compare/are-online-downloaders-safe/
Published: 2026-09-25
Updated: 2026-09-25
Author: Ema Zamboni, video editor (https://b-roll-6hk.pages.dev/about/)
Section: Compare (https://b-roll-6hk.pages.dev/compare/)

**In short:** Online YouTube downloader sites are risky mainly because of their ads, not the MP4: fake download buttons, redirects, bundled installers and notification prompts are the common traps. Never run a file you did not ask for, never allow notifications, never type your Google password. A desktop app from a verifiable source removes the ad layer.

## What are the common risks of downloader sites?

The most common risks on downloader sites are fake buttons, redirects and bundled installers. The video file itself is rarely the problem: online downloader sites usually earn money from ads, so the danger sits in the page around the download button.

Google's [Search Central page on social engineering](https://developers.google.com/search/docs/monitor-debug/security/social-engineering) describes the pattern exactly: ads that masquerade as page buttons, and content that tricks visitors into downloading unwanted software. On a downloader site the traps look like this:

- **Fake download buttons.** Two or three large buttons, only one of which is real; the others are ads.
- **Redirect chains.** A click opens a new tab, sometimes several, before or instead of the download.
- **Notification prompts.** "Click Allow to continue" pages that turn your browser into an ad channel after you leave.
- **Bundled installers.** An "HD converter" or "downloader app" you must install to get a better file. Google's [Unwanted Software Policy](https://www.google.com/about/unwanted-software-policy.html) lists software that piggybacks on another install, or is bundled without saying so, as unwanted.
- **Files that are not videos.** An `.exe`, `.scr` or `.zip` where you expected an `.mp4`.

Online downloader sites also tend to fail editors for reasons unrelated to safety: resolution caps and re-encoded files. Those limits are compared in [online downloader vs desktop app vs browser extension](https://b-roll-6hk.pages.dev/compare/online-vs-desktop-vs-extension/).

[Download B-ROLL for Windows](https://b-roll-6hk.pages.dev/download/): free, Windows 10 and 11 today, macOS and Linux planned. No account, no ads.

## What do downloader sites learn about you?

A downloader site learns every link you paste, your IP address and whatever its ad scripts collect from your browser. The reason is structural: with an online downloader, the site's server fetches the video for you, so it has to see the request.

Three things follow from that for a working editor:

- **Your research is visible.** A list of reference links for a client project, pasted one by one, tells a third party what you are working on. Keep project links out of websites you do not control.
- **Notifications outlive the visit.** A site you allowed can keep sending pop-ups after you close the tab. [Chrome Help on notifications](https://support.google.com/chrome/answer/3220216) shows how to remove it: **Settings**, **Privacy and security**, **Site settings**, **Notifications**.
- **Your Google account is not their business.** No legitimate downloader asks for your Google password. When a video needs sign-in, the safe pattern is a cookies file you export yourself and keep on your own PC, as described in [YouTube cookies.txt: export, use and refresh it](https://b-roll-6hk.pages.dev/troubleshooting/youtube-cookies-txt/).

Treat a cookies.txt like a password. The file lets a tool act as your signed-in account, so never upload it to a website.

## How do you check whether a downloader is safe?

A downloader is safe enough to use when it passes ten plain checks, from who makes it to whether you can verify the file you run. The safety checklist lists each check, what a good sign looks like and the red flag that should stop you.

| Check | What to look for | Red flag |
| --- | --- | --- |
| Who makes it | A named person or company with a contact address | No name, no contact, only a domain |
| How it is funded | A price, donations or a visible business | Ad-covered pages and no other visible income |
| Download button | One button that starts one file | Several look-alike buttons, some of them ads |
| What a click does | The download starts on the same page | A new tab or a chain of redirects |
| Browser permissions | No permission requests | "Allow notifications to continue" |
| What you receive | The format you picked: `.mp4`, `.mkv`, `.mov`, `.mp3` | An `.exe`, `.msi`, `.scr` or `.zip` instead of a video |
| Installer screens | The app and its own components, clearly listed | Pre-ticked extra offers, toolbars, "recommended" software |
| Sign-in | No login, or a cookies.txt you export yourself | A form that asks for your Google password |
| Verification | A published SHA-256 checksum or a digital signature | No checksum, no signature, copies on mirror sites |
| Browser or Windows warning | No warning on the page or the file | "Deceptive site ahead", or SmartScreen naming the file as known to be unsafe |

Read Windows warnings carefully, because Microsoft Defender SmartScreen warns for two different reasons. According to [Microsoft's SmartScreen overview](https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/), it warns when a file matches a list of known malicious software, and also when a file is simply not on its list of well-known, frequently downloaded files. The first is a stop sign. The second means low reputation, which is common for small unsigned apps.

If you already clicked something, close the tab, delete any file you did not ask for without opening it, remove the site's notification permission, and run a scan with Windows Security.

## How do desktop apps compare on safety?

A desktop downloader removes the ad layer and the third-party server: your PC sends each request to YouTube directly, and your links stay on your machine. In exchange you run an `.exe` with your own Windows user rights, so trust moves from the web page to the installer and the people behind it.

Judge a desktop app with the same checklist, weighted toward the last four rows. Download it only from the maker's own page or release page, never from a mirror site. Compare the checksum or check the signature before the first run. Read every installer screen, because bundled offers are where paid desktop downloaders and free ones alike can slip in extra software.

Browser extensions sit in between: they need no installer, but they run inside your browser with whatever page access they request. Open-source command-line tools are the most transparent option, since anyone can read their code and their release pages. B-ROLL is built on one of them, and whether yt-dlp itself is safe to run is covered in [what is yt-dlp and is it safe to use](https://b-roll-6hk.pages.dev/compare/what-is-yt-dlp/). The full category comparison lives on the [ways to download YouTube videos, compared](https://b-roll-6hk.pages.dev/compare/) hub.

Safety is also separate from permission. A clean tool does not make a download allowed; the rules are set out in [is it legal to download YouTube videos](https://b-roll-6hk.pages.dev/attribution/is-downloading-youtube-legal/).

> **Careful:** Download only footage you have the right to use: your own uploads, Creative Commons, licensed or permitted material.

## How can you check B-ROLL before you run it?

B-ROLL is not code-signed and its source code is not published, so the check you can run yourself is the SHA-256 checksum shown on the [B-ROLL download page](https://b-roll-6hk.pages.dev/download/). B-ROLL is a free Windows app made by video editor Ema Zamboni with Claude as coding assistant, funded by voluntary donations, with no account and no ads.

To verify the file, open PowerShell after the download and run `Get-FileHash` on it. [Get-FileHash](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash) uses SHA-256 by default, and changing even one character of a file changes its hash.

```powershell
Get-FileHash "$env:USERPROFILE\Downloads\BROLL-Setup.exe"
```

Compare the Hash line with the value on the download page; letter case does not matter. For the portable version, use `BROLL-portable.exe` instead. Because the app is unsigned, Windows may show "Windows protected your PC" before the first run. What that means, and how B-ROLL handles antivirus flags, is covered in [is B-ROLL safe? SmartScreen, signing and checksums](https://b-roll-6hk.pages.dev/troubleshooting/windows-smartscreen-warning/).

Know what happens after that first run:

- **First launch downloads third-party tools** from their own GitHub releases (the helper also pulls packages from the npm registry) into `%LOCALAPPDATA%\Broll`: `yt-dlp.exe` (17.0 MB), `ffmpeg.exe` (194.8 MB), `deno.exe` (96.4 MB) and a local helper that yt-dlp uses (165.4 MB), 473.7 MB in total on Ema's PC. The helper listens only on 127.0.0.1 port 4416, so no other computer can reach it, and its `deno.exe` process may keep running after you close B-ROLL until you sign out or restart. After that, yt-dlp updates itself from GitHub at every launch.
- **Updates are not signature-checked.** B-ROLL asks GitHub for a new version 4 seconds after every launch. **Update now** downloads the installer over HTTPS but checks no signature or checksum, and falls back to an unverified connection after a certificate error. For full control, download new versions from the download page and verify them the same way.
- **Your data stays local.** Settings, the last 200 finished downloads and any cookies.txt stay on your PC; cookies are sent only to YouTube. With **Use browser login for age-restricted videos** on (the default) and no cookies.txt set, yt-dlp reads your browser's YouTube cookies on your PC for lookups such as titles and subtitles.

The complete list of addresses B-ROLL contacts is on the [B-ROLL privacy page](https://b-roll-6hk.pages.dev/privacy/).

## Frequently asked questions

Q: Can a downloaded video contain a virus?
A: Only when something else is wrong: the file is not really a video, or your player has an unpatched flaw. A real MP4, MKV or MOV file is data that a player decodes, not a program Windows runs. Watch for an .exe with a video-style name or a codec pack a site tells you to install, and turn on file name extensions in File Explorer.

Q: Why does my browser warn me about a downloader site?
A: Your browser warns you because the site, or an ad running on it, matches a list of reported phishing, malware or deceptive pages. Chrome shows warnings such as Deceptive site ahead, and Microsoft Defender SmartScreen does the same job in Edge and Windows. The warning is about the page itself, so leave it instead of clicking through to the download.

Q: Does B-ROLL collect data about my downloads?
A: No. B-ROLL has no account, no telemetry, no analytics and no ads. Its download history, the last 200 finished downloads with link, file path and title, stays in a settings file on your own PC. Your links go only to YouTube, unless you choose to email a bug report with the log attached. Every address the app contacts is listed on the [B-ROLL privacy page](https://b-roll-6hk.pages.dev/privacy/).

## Sources

1. [Google Search Central: Social engineering (phishing and deceptive sites)](https://developers.google.com/search/docs/monitor-debug/security/social-engineering)
2. [Google: Unwanted Software Policy](https://www.google.com/about/unwanted-software-policy.html)
3. [Microsoft Learn: Microsoft Defender SmartScreen overview](https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/)
4. [Google Chrome Help: Allow or block notifications from websites](https://support.google.com/chrome/answer/3220216)
5. [Microsoft Learn: Get-FileHash](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash)

---

B-ROLL is a free, donation-supported desktop YouTube downloader for video editors: it downloads videos, clips, playlists and channels, converts them automatically into edit-ready ProRes or DNxHR (or saves MP4, MKV, WEBM or audio), and includes built-in trimming, subtitles and automatic creator credit files. Part of [Ways to Download YouTube Videos, Compared](https://b-roll-6hk.pages.dev/compare/) on the B-ROLL website. Download B-ROLL, free for Windows 10 and 11 (macOS and Linux planned): https://b-roll-6hk.pages.dev/download/