One-click hosters (DDownload, Rapidgator, …) and multihosters (Premiumize.me, AllDebrid, …) are handled by resolvers: signed WebAssembly plugins that turn a hoster page address into a downloadable link. Twenty-seven are bundled with the release.

You do not need an account for most of them — the bundled hosters can follow their own anonymous flow, countdown and captcha included. An account lifts the speed and concurrency limits.

Configure accounts under Settings → Accounts.

Provider	Type	Supported credentials	Works without an account
DDownload	Hoster	Account credentials, or API key	Yes — countdown and widget captcha
Rapidgator	Hoster	Username and password	Yes — countdown and reCAPTCHA
Nitroflare	Hoster	Account e-mail and premium key	Yes — countdown and reCAPTCHA
KatFile	Hoster	API key or cookies	Yes — countdown and widget captcha
1fichier	Hoster	API key	Yes — countdown only, no captcha
Keep2Share	Hoster	Username and password	Yes — image captcha
FileJoker	Hoster	Cookies	Yes — countdown and widget captcha
MediaFire	Hoster	None — the plugin knows no account	Yes — no countdown, no cookie
MEGA	Hoster, encrypted	E-mail address and password, optional	Yes — public file and folder links
Pixeldrain	Hoster	API key, optional	Yes — its limits are reported, not worked around
KrakenFiles	Hoster	None — premium is not part of this cut	Yes — Turnstile
Turbobit	Hoster	Username and password	Yes — Turnstile and countdown
HitFile	Hoster	Username and password	Yes — Turnstile and countdown
Google Drive	Cloud drive	Your own OAuth application	No
OneDrive / SharePoint	Cloud drive	Your own OAuth application	No
Dropbox	Cloud drive	Your own OAuth application	No
Box	Cloud drive	Your own OAuth application, with its client secret	No — shared links included
pCloud	Cloud drive	Your own OAuth application, with its app secret	No
Put.io	Cloud storage with a torrent client	Your own OAuth application, with its client secret	No
Seedr	Cloud storage with a torrent client	E-mail address and password; premium plan	No
XFileSharing sites	Hoster	None — the resolver takes no account	Yes — countdown and captcha
Premiumize.me	Multihoster	API key	No, by design
AllDebrid	Multihoster	API key	No, by design
Debrid-Link	Multihoster	API key	No, by design
LinkSnappy	Multihoster	Username and password	No, by design
Real-Debrid	Multihoster	Connect with a code, or private API token	No, by design
Offcloud	Multihoster	API key	No, by design
TorBox	Debrid service	API key	No, by design

A bundled plugin that no longer verifies — a withdrawn key, a damaged package — is missing from this list and shown with its reason under Settings → Plugins → Installed.

A multihoster needs an account by design and is excluded from the anonymous path: the whole point of the service is that your subscription resolves somebody else's hoster link.

Beside the resolvers there are folder crawlers, which turn one address into the list of files behind it: Google Drive, OneDrive, Dropbox, Box, pCloud, MediaFire, MEGA and Premiumize folders, Pixeldrain lists, a public Nextcloud or ownCloud share, an open directory index served by Apache, nginx, Caddy or lighttpd, and the PeepLink / AlfaLink link containers. A crawler that turns out not to own an address says so, and the search carries on to the next one rather than the link becoming an error.

Built against published APIs, not yet run against live accounts. Box, pCloud, Put.io, Offcloud, TorBox, Seedr, Pixeldrain and MEGA accounts each follow their provider's documented API and are tested against recorded answers; none has yet been confirmed against a real account or the live service. Premiumize.me's remote jobs have been — see Remote jobs.

MEGA encrypts every file; the key travels in the part of the link after the #. rDownloader keeps that key in the encrypted vault, decrypts while it writes and verifies MEGA's integrity value before the file is put in place — no second pass and no second copy on disk. Public file links (mega.nz/file/…#key) and public folder links (mega.nz/folder/…#key) both work; a folder's names, sizes and structure are read in one call.

• A folder comes back whole or not at all. One folder link brings at most a thousand files; a larger one is refused with a message saying so rather than arriving as a package quietly missing its end.
• A used-up quota waits the time MEGA names and is reported as a quota, not as a generic failure.
• The key is kept as long as the download exists, so a resumed download still decrypts, and is forgotten with it.

A MEGA account signs in with your e-mail address and password. The password never enters the plugin: rDownloader computes the values MEGA's sign-in needs itself.

Files in your own account download too. Paste mega.nz/fm/<handle> for a folder of the signed-in account and the LinkGrabber lists it like a shared folder; mega.nz/fm/file/<handle> is one file. Each file resolves, decrypts and is checked the same way.

Not built: files that reached your account through somebody else's share, accounts old enough to use MEGA's legacy key derivation, two-factor sign-in, and password-protected links (#P!). The account path has not been run against a real MEGA account yet.

Public files (pixeldrain.com/u/…) need nothing, and a list (/l/…) is unpacked into its files under the list's own title. A download that waits in the queue does not expire.

Without an account Pixeldrain's own limits — the per-address allowance, the transfer volume, the number of parallel downloads, a captcha — are reported with their own message rather than worked around. The allowance is checked before a download is queued, so it does not run out in the middle of a transfer. To lift the limits, add a Pixeldrain account and paste the API key from your Pixeldrain settings, with no user name. The key goes to pixeldrain.com only.

Three more drives you sign in to with an application of your own (see Providers you sign in to with a code). Unlike Google Drive, OneDrive and Dropbox, all three also need the client secret in the account's secret field. None of them has a device code, so a browser that can reach this machine is needed for the sign-in. The redirect address to register is http://127.0.0.1:8710/api/v1/oauth/callback (adjust the port if you serve on another one).

• Box — folders, files and shared links on app.box.com and on an enterprise's own <name>.app.box.com. Even a public shared link needs a signed-in account. For a password-protected shared link, add ?shared_link_password=… to the pasted address; the password goes to Box in a header, never in the download address, and is struck from every log line. Every download is pinned to the file version it was resolved at, so a file somebody replaced during a pause is not spliced onto what is already on disk. A wrong password and a missing permission look the same, because Box answers them the same way.
• pCloud — public links in every spelling pCloud uses, and folders and files of your own drive. pCloud runs two separate data centres, Europe and the United States; you do not configure which one you are on. rDownloader reads it from the address, retries the other exactly once when an answer can only mean "wrong data centre", and shows on the account row which one answered. pCloud's download links expire after a few hours, so a fresh one is fetched for every attempt and every resume. A password-protected public link is refused, because pCloud's API documents no way to supply the password. pCloud issues no refresh token: if you revoke the application at pCloud, sign in again.
• Put.io — files in your account resolve, and magnets and .torrent files run as remote jobs. Put.io's tokens do not expire; revoking the application at Put.io ends the sign-in at once.

• TorBox takes the API key from your TorBox settings page. A magnet, a .torrent, an .nzb or an ordinary link becomes a remote job on the account; the resolver handles only TorBox's own download addresses, renewing the short-lived link on every attempt.
• Offcloud takes the API key from your account page. It resolves other hosters' links like any multihoster, and its cloud downloads — a magnet or an ordinary link — run as remote jobs. The key travels in a header, never in an address that could end up in a log.
• Seedr takes the e-mail address and password you sign in to Seedr with; its API knows no other credential and is available only on a premium plan. Magnets and .torrent files run as remote jobs. The pair is sent to www.seedr.cc only, never to another host a redirect leads to.

These services have no resolver on purpose:

Service	Why not
GoFile	The only account-free listing route is the site's own bot gate; the documented API is premium-only
WeTransfer	The public API was retired in 2022, and the terms forbid automated extraction
FileFactory	The official API accepts no connection; the site's internal one changed three times in a year
filecrypt.cc	Every container answers with a proof-of-work gate that measures how a human used the widget
UploadGig, SwissTransfer	The operator's own robots.txt withholds the download path
Smash	Every package is account-scoped and sold to the sender; there is no route to somebody else's transfer
IcerBox	The terms forbid automated downloading, the service sells premium only, and the files people link to have free downloads switched off
nfile.cc, dwp.la	Not hosters but link cloakers that redirect to one. Their redirect is not followed at intake yet, so open such a link in the browser and paste the address it lands on

The common line: rDownloader answers a captcha, it does not defeat a bot check by faking a browser fingerprint or a person's mouse movements.

For filecrypt.cc, open the folder in your browser and press Click'n'Load, which the capture agent receives, or import a DLC file you downloaded by hand.

1. Settings → Accounts → Add.
2. Pick the provider. If it offers more than one way to hold an account, pick the Sign-in method: for DDownload Account credentials or API key, for Real-Debrid Connect with a code or API key. Right after a start or a plugin update the picker says Loading the plugins the providers come from for a moment.
3. Enter the credential. It goes straight into the encrypted vault.
4. Optionally assign a proxy profile, so this account's traffic goes out through a specific route.

A newly saved account is checked in the background straight afterwards (the check can wait on a captcha); the result appears on the row.

Accounts can be enabled, disabled, tested and deleted from the list. Each account's first line looks the same on every account: the switch, the name, a place each for the key and the cookie icon, then Test, Edit and Delete. Connect, Take over from browser and the badges — where the provider reports it, account status, premium status, label and remaining traffic — go on a second line under the name, shown only when there is something on it. In a narrow list Test becomes an icon that names itself when you point at it. A multihoster's Supported hosters opens from the chevron below the row, with a filter.

A green account test means the stored session actually works, not that something is stored:

• Where an account holds cookies, the test makes a request only a live session can answer, so an expired session fails the test instead of the download. An expired session has its own message, separate from an invalid account, and says which to replace: the API key or the browser session.
• Premium is claimed only where it was read. A sign-in that never saw a subscription date reports the subscription was not checked; an expiry that was missing or unreadable reads premium status not confirmed rather than no premium.
• Zero cookies stays green on purpose where the provider's link checks run on the API key alone; the label says so.
• A session that cannot be confirmed either way is not a failure. For DDownload or KatFile with an API key and an imported cookie session, the test asks the account page. An expired session is reported as expired; a page that says neither leaves the test green, with premium status and traffic from the API and the label cookie session not confirmed.
• A DDownload account holding cookies only — no key, no sign-in — has nothing else to prove it, so a page that says neither is reported as DDownload did not confirm the cookie session, with the advice to try again later.
• A page the test cannot read is written to the log as a warning naming its title and length — never its content, which can hold your address and API key.

A credential goes only where it belongs. An API key is only ever sent to the provider's API host and a password only to its login form, even though the same account field holds both. The plugin never sees either.

An account holds either credentials or the API key from the provider's own settings page. A cookie session does not have to be pasted as a whole Cookie: header out of the browser developer tools: see Taking a session over from the browser.

The sign-in answers the Cloudflare Turnstile widget on the login form through the captcha broker, like the free flow. It lasts until the service restarts.

Where a provider accepts a cookie session — DDownload, KatFile and FileJoker — its account row offers Take over from browser. rDownloader cannot read your browser's cookies itself, so the request goes to the browser extension: open it in the browser that is signed in at the hoster, and Hand over this session there. Only that hoster's cookies are sent, they are stored encrypted with the account like typed-in cookies, and the account is checked as soon as they arrive.

Without a paired extension, an account waiting for the browser's session warns about it and offers Pair the browser extension in a dialog on the same page — in the settings as in the setup assistant. The warning goes as soon as an extension reports in.

This is also the way out when a sign-in meets a browser that is already signed in. The hoster then skips its login form, no captcha appears to be answered, and the account test stops within 15 seconds with a message saying so — take the session over, or sign out of the hoster in the browser and test again — instead of waiting until the captcha times out.

Cookies are kept to the provider's site. Whether pasted, imported or handed over, a cookie for a public suffix such as com is refused and nothing is stored; see Where a cookie may go.

Some providers are not a stored password at all. For Google Drive, OneDrive, SharePoint, Dropbox, Box, pCloud, Put.io, Premiumize and Real-Debrid the account is a sign-in you complete once, and rDownloader renews the token afterwards without asking you again — where the provider issues renewal material at all; pCloud and Put.io tokens simply do not expire.

Two shapes, depending on the provider: a device code — the interface shows a short code, you confirm it on the provider's own site — or a browser redirect. A provider that does not serve the entrance you asked for refuses with a stated reason rather than opening a sign-in that dies in front of you, and a refusal says which it was: consent denied, the code's window expired, an unreadable reply, or the sign-in refused.

Each installation registers its own application. rDownloader ships no OAuth client id and no client secret: a secret in an open-source project is public, and the provider's rate limits are per application. Your own registration means your own limits and your own revocation. Until one is registered, the sign-in refuses and the message names the steps. The registration path per provider is in the repository's README.md. Real-Debrid is the exception: it issues each person a client of their own during the sign-in, so there is nothing to register.

Box renews its sign-in with your own application's client secret. Put.io and pCloud issue tokens that stay valid until you revoke them, so there is nothing to renew.

A Real-Debrid account offers two sign-in methods:

• Connect with a code (the default) — there is no credential to type in. Save the account; the sign-in starts at once and its row shows an address and a code. Open real-debrid.com/device, signed in to Real-Debrid, and confirm the code. From then on rDownloader keeps the sign-in renewed without asking you again — no username, no token to copy, no application to register. You can close the page while it waits; the sign-in carries on. If the code expires or the sign-in stops being accepted, press Connect on the row for a new one.
• API token — the private API token. Open real-debrid.com/apitoken, signed in, copy the token and enter it as the account's credential; no username is needed. The token stays valid until you renew it there — then enter the new one.

Links of other hosters and torrent jobs both use whichever of the two the account holds. A refused sign-in says why: the consent was declined, the code expired, Real-Debrid asked for two-factor confirmation, or it is receiving too many requests right now.

One operator, two brands. Without an account a link downloads the way the site's own page does it — the Turnstile answered through the captcha broker, then the countdown the site states, one file per guest window. With an account the premium mirror is taken without captcha or countdown, and the password only ever reaches the operator's API host.

The link the site hands out is good for exactly one request from your address and then expires, so it is resolved immediately before the transfer, never probed and never remembered. A stopped, failed or restarted transfer resolves again.

Neither takes an account. MediaFire resolves public file links through its documented API and the file page's own download button — no cookie, no countdown — and a sibling crawler lists a public folder. Premium is deliberately not offered: MediaFire's official route needs an application registered in your own account, and this project ships no key for it.

KrakenFiles downloads through the file page's own form with a Turnstile answer obtained through the captcha broker. Premium accounts, password-protected files and folder links are not supported.

rDownloader picks the provider and the account from the URL and, for a multihoster, from that service's hoster catalogue. The account and resolver route actually used are recorded on every download.

A provider exists exactly while its plugin does. The list follows installing, removing and switching off plugins at once, so the accounts list offers exactly what this installation can resolve. An account whose plugin was uninstalled stays editable, so you can switch it off; only a new account for an unknown provider is refused.

Where a plugin is offered for selection, its version is visible: installing a plugin never removes the older one, and the highest version wins at load time.

A provider that answers HTTP 429 (too many requests) or a 5xx server error without saying how long to wait gets a fixed pause from its plugin instead of an immediate retry. A Retry-After the provider sends always wins.

Provider	After a 429	After a 5xx
AllDebrid, Debrid-Link, LinkSnappy, Keep2Share, Nitroflare, Rapidgator, Real-Debrid, TorBox, Put.io, Seedr	60 seconds	5 minutes
1fichier	5 minutes, its flood protection	5 minutes
Offcloud	1 hour — Offcloud reports a used-up allowance as 429	5 minutes

A 429 is a limit the provider imposed: waiting it out spends none of the download's attempts. A 5xx is a fault and spends one, like any failed attempt — see Retries.

One resolver claims 140 XFileSharing sites across 211 domains — independent installations of the same hosting script. It takes no account, because an account at one site is not an account at another, so it stays out of the accounts list. The list holds only sites that still served the XFileSharing login form when it was compiled.

Video and image hosts among them still go to the media and gallery downloaders first.

Every named hoster that has a free flow, and the XFileSharing sites, follow the hoster's own: wait out the countdown, answer the captcha, post the download form. Nothing is bypassed and nothing is faked — where a site asks for a Cloudflare Turnstile answer, that answer comes from a solver service or from you, in your own browser.

Three rules govern it:

• One free download at a time per hoster. Hosters allow one free download per IP; a second attempt would break the first one's session and earn both an IP block.
• An IP block holds back every free link of that host until it expires. When the hoster names no duration, rDownloader waits fifteen minutes. Premium downloads are unaffected.
• A hoster landing page is never stored as the finished file. A plugin-resolved link whose response turns out to be markup fails with download.not_a_file, quoting the hoster's own wording.

Waiting captchas and IP blocks do not survive a restart: a download whose captcha was waiting returns to the queue and raises a fresh one, and the first free link of a blocked hoster is tried once more and re-arms the block if the hoster still refuses.

Hosters limit anonymous downloads per address, so a script you write can ask your router for a new one when free downloads are stuck behind such a limit. Configure it under Settings → Network → Reconnect.

It runs in the same sandbox as post-processing scripts, only inside the times you allow, keeps its distance from the previous attempt, and by default waits until nothing is transferring.

Off by default. The address checks that confirm the change are the one part of this feature that talks to somebody outside your machine, and which addresses are asked is configurable.

A captcha a sandboxed resolver cannot answer is handed to the application, which either buys an answer from a solver service or asks you. Six kinds are carried:

Kind	Where it is answered
Image captcha	In the rDownloader interface, or by a solver service
Click captcha	In the rDownloader interface, or by a solver service
reCAPTCHA v2	In your own browser through the extension, or by a solver service
hCaptcha	Same
Cloudflare Turnstile	Same
CutCaptcha	A solver service only

An image captcha appears as a prompt anywhere in the web interface — the picture inline, a countdown to the deadline, and the choice to answer or decline.

A click captcha is a picture with a prompt asking you to click one particular spot in it. Click the picture to place a mark, click again to move it, and press the button to send. Nothing is sent on the click itself, because a wrong spot fails the download. The keyboard works too: the arrow keys move the mark by one pixel, Shift with them by ten, Enter sends it.

reCAPTCHA v2, hCaptcha and Turnstile are bound to the hoster's own domain and are never rendered inside rDownloader — neither the web interface nor the desktop agent can show them. Two ways to answer one:

• In your own browser, through the browser extension. The extension announces a waiting captcha with a notification, a badge and a line in its popup; one click opens the hoster's own page in a tab and hands the answer back. Closing the tab without answering declines the captcha. Nothing about the token is stored, logged or echoed.
• A solver service, which answers it without you.

The prompt says which of the two applies to you: that the extension is connected and will open the page, or that none is and a solver service is therefore the only route, with a link to the pairing page. There is no desktop captcha window: Cloudflare recognises an embedded browser.

A CutCaptcha is the one kind no browser rDownloader drives can read. It is neither queued for a person nor offered to the extension: without a configured solver service the download fails at once with a stated reason instead of waiting out the manual timeout.

Settings → Captcha & solver. Any service with a 2captcha-compatible createTask/getTaskResult API works — 2captcha, CapMonster, CapSolver and others. Configure an https endpoint and an API key; the key lives in the encrypted vault.

The stored key can be tested against the service before any download depends on it. The test reports the remaining balance, or a translated reason for the refusal.

Behaviour when the solver cannot help:

• A rejected key or an empty balance stops the attempt, rather than quietly falling back to asking you.
• A service that is merely busy falls back to asking you — for image captchas only.

The answer timeout is configurable between 15 and 600 seconds (default 180).

Handing a magnet, a .torrent or an .nzb to a provider account is not a download but a job the provider runs for you. Those have their own view, Remote jobs in the sidebar (5). Six providers offer this: Real-Debrid, TorBox, Premiumize.me, Put.io, Offcloud and Seedr — see Remote jobs for which takes what.

• The LinkGrabber
• The download queue
• Remote jobs — work that runs at a provider account
• Plugin overview — what a resolver is and what it may do
• Bundled plugins
• Security and privacy — where credentials live