cobalt Documentation

File: README.md Copy Chapter

cobalt is a media downloader that doesn't piss you off. it's friendly, efficient, and doesn't have ads, trackers, paywalls or other nonsense.

paste the link, get the file, move on. that simple, just how it should be.

cobalt monorepo Copy Section

this monorepo includes source code for api, frontend, and related packages:

• api tree & readme
• web tree & readme
• packages tree

it also includes documentation in the docs tree:

• how to run a cobalt instance
• how to protect a cobalt instance
• cobalt api instance environment variables
• cobalt api documentation

ethics Copy Section

cobalt is a tool that makes downloading public content easier. it takes zero liability.
the end user is responsible for what they download, how they use and distribute that content.
cobalt never caches any content, it works like a fancy proxy.

cobalt is in no way a piracy tool and cannot be used as such.
it can only download free & publicly accessible content.
same content can be downloaded via dev tools of any modern web browser.

contributing Copy Section

if you're considering contributing to cobalt, first of all, thank you! check the contribution guidelines here before getting started, they'll help you do your best right away.

thank you Copy Section

cobalt is sponsored by royalehosting.net. a part of our infrastructure is hosted on their network. we really appreciate their kindness and support!

licenses Copy Section

for relevant licensing information, see the api and web READMEs.
unless specified otherwise, the remainder of this repository is licensed under AGPL-3.0.

File: api/README.md Copy Chapter

cobalt api

this directory includes the source code for cobalt api. it's made with express.js and love!

running your own instance Copy Chapter

if you want to run your own instance for whatever purpose, follow this guide.
we recommend to use docker compose unless you intend to run cobalt for developing/debugging purposes.

accessing the api Copy Chapter

there is currently no publicly available pre-hosted api.
we recommend deploying your own instance if you wish to use the cobalt api.

you can read the api documentation here.

supported services Copy Chapter

this list is not final and keeps expanding over time!
if the desired service isn't supported yet, feel free to create an appropriate issue (or a pull request 👀).

additional notes or features (per service) Copy Section

license Copy Chapter

cobalt api code is licensed under AGPL-3.0.

this license allows you to modify, distribute and use the code for any purpose
as long as you:

• give appropriate credit to the original repo when using or modifying any parts of the code,
• provide a link to the license and indicate if changes to the code were made, and
• release the code under the same license

open source acknowledgements Copy Chapter

ffmpeg Copy Section

cobalt relies on ffmpeg for muxing and encoding media files. ffmpeg is absolutely spectacular and we're privileged to have the ability to use it for free, just like anyone else. we believe it should be way more recognized.

you can support ffmpeg here!

youtube.js Copy Section

cobalt relies on youtube.js for interacting with youtube's innertube api, it wouldn't have been possible without this package.

you can support the developer via various methods listed on their github page!
(linked above)

many others Copy Section

cobalt-api also depends on:

• content-disposition-header to simplify the provision of content-disposition headers.
• cors to manage cross-origin resource sharing within expressjs.
• dotenv to load environment variables from the .env file.
• express as the backbone of cobalt servers.
• express-rate-limit to rate limit api endpoints.
• ffmpeg-static to get binaries for ffmpeg depending on the platform.
• hls-parser to parse HLS playlists according to spec (very impressive stuff).
• ipaddr.js to parse ip addresses (used for rate limiting).
• nanoid to generate unique identifiers for each requested tunnel.
• set-cookie-parser to parse cookies that cobalt receives from certain services.
• undici for making http requests.
• url-pattern to match provided links with supported patterns.
• zod to lock down the api request schema.
• @datastructures-js/priority-queue for sorting stream caches for future clean up (without redis).
• @imput/psl as the domain name parser, our fork of psl.

...and many other packages that these packages rely on.

File: docs/api.md Copy Chapter

cobalt api documentation

methods, acceptable values, headers, responses and everything else related to making and parsing requests from a cobalt api instance.

[!IMPORTANT]
hosted api instances (such as api.cobalt.tools) use bot protection and are not intended to be used in other projects without explicit permission. if you want to use the cobalt api, you should host your own instance or ask an instance owner for access.

• POST /
• POST /session
• GET /
• GET /tunnel

all endpoints (except for GET /) are rate limited and return current rate limiting status in RateLimit-* headers, according to the "RateLimit Header Fields for HTTP" spec.

authentication Copy Chapter

an api instance may be configured to require you to authenticate yourself.
if this is the case, you will typically receive an error response
with a api.auth.<method>.missing code, which tells you that a particular method
of authentication is required.

authentication is done by passing the Authorization header, containing
the authentication scheme and the token:

Authorization: <scheme> <token>

currently, cobalt supports two ways of authentication. an instance can
choose to configure both, or neither:

• Api-Key
• Bearer

api-key authentication Copy Section

the api key authentication is the most straightforward. the instance owner
will assign you an api key which you can then use to authenticate like so:

Authorization: Api-Key aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee

if you are an instance owner and wish to configure api key authentication,
see the instance documentation!

bearer authentication Copy Section

the cobalt server may be configured to issue JWT bearers, which are short-lived
tokens intended for use by regular users (e.g. after passing a challenge).
currently, cobalt can issue tokens for successfully solved turnstile
challenge, if the instance has turnstile configured. the resulting token is passed like so:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

POST `/` Copy Chapter

cobalt's main processing endpoint.

[!IMPORTANT]
you must include correct Accept and Content-Type headers with every POST / request.

Accept: application/json
Content-Type: application/json

request body Copy Section

body type: application/json

not a fan of reading tables of text?
you can read the api schema directly from code instead!

api schema Copy Section

all keys except for url are optional. value options are separated by /.

general

service-specific options

response Copy Section

body type: application/json

the response will always be a JSON object containing the status key, which is one of:

• tunnel: cobalt is proxying and/or remuxing/transcoding the file for you.
• local-processing: cobalt is proxying the files for you, but you have to remux/transcode them locally.
• redirect: cobalt will redirect you to the direct service URL.
• picker: there are multiple items to choose from, a picker should be shown.
• error: something went wrong, here's an error code.

tunnel/redirect response Copy Section

local processing response Copy Section

output object

output.metadata object

all keys in this table are optional.

audio object

picker response Copy Section

picker object

error response Copy Section

error object

error.context object

POST `/session` Copy Chapter

used for generating JWT tokens, if enabled. currently, cobalt only supports
generating tokens when a turnstile challenge solution
is submitted by the client.

the turnstile challenge response is submitted via the cf-turnstile-response header.

response body Copy Section

on failure, an error response is returned.

GET `/` Copy Chapter

provides basic instance info.

response Copy Section

body type: application/json

cobalt object

git object

GET `/tunnel` Copy Chapter

endpoint for file tunnels (proxy/remux/transcode). the response is a file stream. all errors are reported via
HTTP status codes.

returned headers Copy Section

• Content-Length: file size, in bytes. returned when exact final file size is known.
• Estimated-Content-Length: estimated file size, in bytes. returned when real Content-Length is not known.
  a rough estimate which should NOT be used for strict size verification.
  can be used to show approximate download progress in UI.

possible HTTP status codes Copy Section

• 200: OK
• 401: Unauthorized
• 403: Bad Request
• 404: Not Found
• 429: Too Many Requests (rate limit exceeded, check RateLimit-* headers)
• 500: Internal Server Error.

File: docs/api-env-variables.md Copy Chapter

cobalt api instance environment variables

you can customize your processing instance's behavior using these environment variables. all of them but API_URL are optional.
this document is not final and will expand over time. feel free to improve it!

general vars Copy Section

view details

networking vars Copy Section

undici proxy vars

view details

limit vars Copy Section

view details

security vars Copy Section

view details

service-specific vars Copy Section

view details

general Copy Chapter

jump to the table

API_URL Copy Section

[!NOTE]
API_URL is required to run the API instance.

the URL from which your instance will be accessible. can be external or internal, but it must be a valid URL or else tunnels will not work.

the value is a URL.

API_PORT Copy Section

port from which the API server will be accessible.

the value is a number from 1024 to 65535.

COOKIE_PATH Copy Section

path to the cookies.json file relative to the current working directory of your cobalt instance (usually the main (src/api) folder).

PROCESSING_PRIORITY Copy Section

nice value for ffmpeg subprocesses. available only on unix systems.

note: the higher the nice value, the lower the priority. you can read more about nice here.

the value is a number.

API_INSTANCE_COUNT Copy Section

supported only on linux and node.js >=23.1.0. when configured, cobalt will spawn multiple sub-instances amongst which requests will be balanced. API_REDIS_URL is required to use this option.

the value is a number.

API_REDIS_URL Copy Section

when configured, cobalt will use this redis instance for tunnel cache. required when API_INSTANCE_COUNT is more than 1, because else sub-instance wouldn't be able to share cache.

the value is a URL.

DISABLED_SERVICES Copy Section

comma-separated list which disables certain services from being used.

the value is a string of cobalt-supported services.

FORCE_LOCAL_PROCESSING Copy Section

the value is a string: never (default), session, or always:

• when the var is not defined or set to never, all requests will be able to set a preference via localProcessing in POST requests.
• when set to session, only requests from session (Bearer token) clients will be forced to use on-device processing.
• when set to always, all requests will be forced to use on-device processing, no matter the preference.

API_ENV_FILE Copy Section

the URL or local path to a key=value-style environment variable file. this is used for dynamically reloading environment variables. not all environment variables are able to be updated by this. (e.g. the ratelimiters are instantiated when starting cobalt, and cannot be changed)

networking Copy Chapter

jump to the table

API_LISTEN_ADDRESS Copy Section

defines the local address for the api instance. if you are using a docker container, you usually don't need to configure this.

the value is a local IP address.

HTTP_PROXY, HTTPS_PROXY, NO_PROXY Copy Section

URL of the proxy that will be passed to EnvHttpProxyAgent for proxying external requests. if some cobalt functionality breaks when using a proxy, please make a new issue about it!

quoted from undici docs:

When HTTP_PROXY and HTTPS_PROXY are set, HTTP_PROXY is used for HTTP requests and HTTPS_PROXY is used for HTTPS requests. If only HTTP_PROXY is set, HTTP_PROXY is used for both HTTP and HTTPS requests. If only HTTPS_PROXY is set, it is only used for HTTPS requests.

NO_PROXY is a comma or space-separated list of hostnames that should not be proxied. The list may contain leading wildcard characters (*). If NO_PROXY is set, the EnvHttpProxyAgent() will bypass the proxy for requests to hosts that match the list. If NO_PROXY is set to "*", the EnvHttpProxyAgent() will bypass the proxy for all requests.

the value is a string:

• HTTP_PROXY/HTTPS_PROXY: URL or hostname.
• NO_PROXY: comma or space-separated list of hostnames.

API_EXTERNAL_PROXY (deprecated) Copy Section

[!WARNING]
this env variable is deprecated and will be removed in a future release. please update your configuration to use HTTP_PROXY or HTTPS_PROXY, as mentioned above.

URL of the proxy that will be passed to EnvHttpProxyAgent and used for proxying external requests. HTTP(S) only.

the value is a URL.

FREEBIND_CIDR Copy Section

IPv6 prefix used for randomly assigning addresses to cobalt requests. available only on linux systems.

setting a FREEBIND_CIDR allows cobalt to pick a random IP for every download and use it for all requests it makes for that particular download.

to use freebind in cobalt, you need to follow its setup instructions first.

if you want to use this option and run cobalt in a docker container, you also need to set the API_LISTEN_ADDRESS env variable to 127.0.0.1 and set network_mode for the container to host.

the value is an IPv6 range.

limits Copy Chapter

jump to the table

DURATION_LIMIT Copy Section

media duration limit, in seconds

the value is a number.

TUNNEL_LIFESPAN Copy Section

the duration for which tunnel info is stored in ram, in seconds.

it's recommended to keep this value either default or as low as possible to preserve efficiency and user privacy.

the value is a number.

RATELIMIT_WINDOW Copy Section

rate limit time window for api requests, but not session requests, in seconds.

the value is a number.

RATELIMIT_MAX Copy Section

amount of api requests to be allowed within the time window of RATELIMIT_WINDOW.

the value is a number.

SESSION_RATELIMIT_WINDOW Copy Section

rate limit time window for session creation requests, in seconds.

the value is a number.

SESSION_RATELIMIT_MAX Copy Section

amount of session requests to be allowed within the time window of SESSION_RATELIMIT_WINDOW.

the value is a number.

TUNNEL_RATELIMIT_WINDOW Copy Section

rate limit time window for tunnel (proxy/stream) requests, in seconds.

the value is a number.

TUNNEL_RATELIMIT_MAX Copy Section

amount of tunnel requests to be allowed within the time window of TUNNEL_RATELIMIT_WINDOW.

the value is a number.

security Copy Chapter

jump to the table

[!NOTE]
in order to enable turnstile bot protection, TURNSTILE_SITEKEY, TURNSTILE_SECRET, and JWT_SECRET must be set. all three at once.

CORS_WILDCARD Copy Section

defines whether cross-origin resource sharing is enabled. when enabled, your instance will be accessible from foreign web pages.

the value is a number, either 0 or 1.

CORS_URL Copy Section

configures the cross-origin resource sharing origin. your instance will be available only from this URL if CORS_WILDCARD is set to 0.

the value is a URL.

TURNSTILE_SITEKEY Copy Section

cloudflare turnstile sitekey used by the web client to request & solve a challenge to prove that the user is not a bot.

the value is a specific key.

TURNSTILE_SECRET Copy Section

cloudflare turnstile secret used by the processing instance to verify that the client solved the challenge successfully.

the value is a specific key.

JWT_SECRET Copy Section

the secret used for issuing JWT tokens for request authentication. the value must be a random, secure, and long string (over 16 characters).

the value is a specific key.

JWT_EXPIRY Copy Section

the duration of how long a cobalt-issued JWT token will remain valid, in seconds.

the value is a number.

API_KEY_URL Copy Section

the URL to the the external or local key database. for local files you have to specify a local path using the file:// protocol.

see the api key section in the "how to protect your cobalt instance" document for more details.

the value is a URL.

API_AUTH_REQUIRED Copy Section

when set to 1, the user always needs to be authenticated in some way before they can access the API (either via an api key or via turnstile, if enabled).

the value is a number, either 0 or 1.

service-specific Copy Chapter

jump to the table

CUSTOM_INNERTUBE_CLIENT Copy Section

innertube client that will be used instead of the default one.

the value is a string.

YOUTUBE_SESSION_SERVER Copy Section

URL to an instance of yt-session-generator. used for automatically pulling poToken & visitor_data for youtube. can be local or remote.

the value is a URL.

YOUTUBE_SESSION_INNERTUBE_CLIENT Copy Section

innertube client that's compatible with botguard's (web) poToken and visitor_data.

the value is a string.

YOUTUBE_PLAYER_ID Copy Section

a comma-separated-list of player IDs to use for youtube fetching.
if defined, cobalt chooses one of them at each client initialization, otherwise
defaults to the current latest player ID.

the value is a string.

YOUTUBE_ALLOW_BETTER_AUDIO Copy Section

when set to 1, cobalt will try to use higher quality audio if user requests it via youtubeBetterAudio. will negatively impact the rate limit of a secondary youtube client with a session.

the value is a number, either 0 or 1.

ENABLE_DEPRECATED_YOUTUBE_HLS Copy Section

the value is a string: never (default), key, or always:

• when the var is not defined or set to never, youtubeHLS in POST requests will be ignored.
• when set to key, only requests from api-key clients will be able to use youtubeHLS in POST requests.
• when set to always, all requests will be able to use youtubeHLS in POST requests.

File: docs/protect-an-instance.md Copy Chapter

how to protect your cobalt instance

if you keep getting a ton of unknown traffic that hurts the performance of your instance, then it might be a good idea to enable bot protection.

[!NOTE]
this tutorial will work reliably on the latest official version of cobalt 10.
we can't promise full compatibility with anything else.

configure cloudflare turnstile Copy Chapter

turnstile is a free, safe, and privacy-respecting alternative to captcha.
cobalt uses it automatically to weed out bots and automated scripts.
your instance doesn't have to be proxied by cloudflare to use turnstile.
all you need is a free cloudflare account to get started.

cloudflare dashboard interface might change over time, but basics should stay the same.

[!WARNING]
never share the turnstile secret key, always keep it private. if accidentally exposed, rotate it in widget settings.

1. open the cloudflare dashboard and log into your account

2. once logged in, select Turnstile in the sidebar

3. press Add widget

4. enter the widget name (can be anything, such as "cobalt")

5. add cobalt frontend domains you want the widget to work with, you can change this list later at any time

   • if you want to use your processing instance with cobalt.tools frontend, then add cobalt.tools to the list

6. select invisible widget mode

7. press create

8. keep the page with sitekey and secret key open, you'll need them later.
   if you closed it, no worries!
   just open the same turnstile page and press "settings" on your freshly made turnstile widget.

you've successfully created a turnstile widget!
time to add it to your processing instance.

enable turnstile on your processing instance Copy Section

this tutorial assumes that you only have API_URL in your environment variables list.
if you have other variables there, just add new ones after existing ones.

[!CAUTION]
never use any values from the tutorial, especially JWT_SECRET!

1. open your docker-compose.yml config file in any text editor of choice.
2. copy the turnstile sitekey & secret key and paste them to their respective variables.
   TURNSTILE_SITEKEY for the sitekey and TURNSTILE_SECRET for the secret key:

environment:
    API_URL: "https://your.instance.url.here.local/"
    TURNSTILE_SITEKEY: "2x00000000000000000000BB" # use your key
    TURNSTILE_SECRET: "2x0000000000000000000000000000000AA" # use your key

3. generate a JWT_SECRET. we recommend using an alphanumeric collection with a length of at least 64 characters.
   this string will be used as salt for all JWT keys.

   you can generate a random secret with pnpm -r token:jwt or use any other that you like.

environment:
    API_URL: "https://your.instance.url.here.local/"
    TURNSTILE_SITEKEY: "2x00000000000000000000BB" # use your key
    TURNSTILE_SECRET: "2x0000000000000000000000000000000AA" # use your key
    JWT_SECRET: "bgBmF4efNCKPirD" # create a new secret, NEVER use this one

4. restart the docker container.

configure api keys Copy Chapter

if you want to use your instance outside of web interface, you'll need an api key!

[!NOTE]
this tutorial assumes that you'll keep your keys file locally, on the instance server.
if you wish to upload your file to a remote location,
replace the value for API_KEYS_URL with a direct url to the file
and skip the second step.

[!WARNING]
when storing keys file remotely, make sure that it's not publicly accessible
and that link to it is either authenticated (via query) or impossible to guess.

if api keys leak, you'll have to update/remove all UUIDs to revoke them.

1. create a keys.json file following the schema and example down below.

2. expose the keys.json to the docker container:

volumes:
    - ./keys.json:/keys.json:ro # ro - read-only

3. add a path to the keys file to container environment:

environment:
    # ... other variables here ...
    API_KEY_URL: "file:///keys.json"

4. restart the docker container.

limit access to an instance with api keys but no turnstile Copy Chapter

by default, api keys are additional, meaning that they're not required,
but work alongside with turnstile or no auth (regular ip hash rate limiting).

to always require auth (via keys or turnstile, if configured), set API_AUTH_REQUIRED to 1:

environment:
    # ... other variables here ...
    API_AUTH_REQUIRED: 1

• if both keys and turnstile are enabled, then nothing will change.
• if only keys are configured, then all requests without a valid api key will be refused.

why not make keys exclusive by default? Copy Section

keys may be useful for going around rate limiting,
while keeping the rest of api rate limited, with no turnstile in place.

api key file format Copy Chapter

the file is a JSON-serialized object with the following structure:

type KeyFileContents = Record<
    UUIDv4String,
    {
        name?: string,
        limit?: number | "unlimited",
        ips?: (CIDRString | IPString)[],
        userAgents?: string[],
        allowedServices?: "all" | string[],
    }
>;

where UUIDv4String is a stringified version of a UUIDv4 identifier.

• name is a field for your own reference, it is not used by cobalt anywhere.

• limit specifies how many requests the API key can make during the window specified in the RATELIMIT_WINDOW env.

  • when omitted, the limit specified in RATELIMIT_MAX will be used.
  • it can be also set to "unlimited", in which case the API key bypasses all rate limits.

• ips contains an array of allowlisted IP ranges, which can be specified both as individual ips or CIDR ranges (e.g. ["192.168.42.69", "2001:db8::48", "10.0.0.0/8", "fe80::/10"]).

  • when specified, only requests from these ip ranges can use the specified api key.
  • when omitted, any IP can be used to make requests with that API key.

• userAgents contains an array of allowed user agents, with support for wildcards (e.g. ["cobaltbot/1.0", "Mozilla/5.0 * Chrome/*"]).

  • when specified, requests with a user-agent that does not appear in this array will be rejected.
  • when omitted, any user agent can be specified to make requests with that API key.

• allowedServices is an array of allowed services or "all".

  • when "all" is specified, the key will be able to access all supported services, even if they're globally disabled via DISABLED_SERVICES.
  • when an array of services is specified, the key will be able to access only the services included in the array.
  • when omitted, the key will use the global list of supported services.

• if both ips and userAgents are set, the tokens will be limited by both parameters.

• if cobalt detects any problem with your key file, it will be ignored and a warning will be printed to the console.

an example key file could look like this:

{
    "b5c7160a-b655-4c7a-b500-de839f094550": {
        "limit": 10,
        "ips": ["10.0.0.0/8", "192.168.42.42"],
        "userAgents": ["*Chrome*"]
    },
    "b00b1234-a3e5-99b1-c6d1-dba4512ae190": {
        "limit": "unlimited",
        "ips": ["192.168.1.2"],
        "userAgents": ["cobaltbot/1.0"]
    }
}

if you are configuring a key file, do not use the UUID from the example but instead generate your own. you can do this by running the following command if you have node.js installed:
node -e "console.log(crypto.randomUUID())"

File: docs/run-an-instance.md Copy Chapter

how to run a cobalt instance

this tutorial will help you run your own cobalt processing instance. if your instance is public-facing, we highly recommend that you also protect it from abuse using turnstile or api keys or both.

using docker compose and package from github (recommended) Copy Chapter

to run the cobalt docker package, you need to have docker and docker-compose installed and configured.

if you need help with installing docker, you can find more information here:

• how to install docker
• how to install docker compose

how to run a cobalt docker package: Copy Chapter

1. create a folder for cobalt config file, something like this:

   sh Copy

   mkdir cobalt

2. go to cobalt folder, and create a docker compose config file:

   sh Copy

   cd cobalt && nano docker-compose.yml

   i'm using nano in this example, it may not be available in your distro. you can use any other text editor.

3. copy and paste the sample config from here and edit it to your needs.
   make sure to replace default URLs with your own or cobalt won't work correctly.

4. finally, start the cobalt container (from cobalt directory):

   sh Copy

   docker compose up -d

if you want your instance to support services that require authentication to view public content, create cookies.json file in the same directory as docker-compose.yml. example cookies file can be found here.

cobalt package will update automatically thanks to watchtower.

it's highly recommended to use a reverse proxy (such as nginx) if you want your instance to face the public internet. look up tutorials online.

run cobalt api outside of docker (useful for local development) Copy Chapter

requirements:

• node.js >= 18
• git
• pnpm

1. clone the repo: git clone https://github.com/imputnet/cobalt.
2. go to api directory: cd cobalt/api.
3. install dependencies: pnpm install.
4. create .env file in the same directory.
5. add needed environment variables to .env file. only API_URL is required to run cobalt.
   • if you don't know what api url to use for local development, use http://localhost:9000/.
6. run cobalt: pnpm start.

ubuntu 22.04 workaround Copy Section

nscd needs to be installed and running so that the ffmpeg-static binary can resolve DNS (#101):

sudo apt install nscd
sudo service nscd start

list of environment variables Copy Chapter

this section has moved to a dedicated document that is way easier to understand and maintain. go check it out!

File: web/README.md Copy Chapter

cobalt web

the cobalt frontend is a static web app built with
sveltekit + vite.

configuring Copy Chapter

• to run the dev environment, run pnpm run dev.
• to make the release build of the frontend, run pnpm run build.

environment variables Copy Chapter

the frontend has several build-time environment variables for configuring various features. to use
them, you must specify them when building the frontend (or running a vite server for development).

WEB_DEFAULT_API is required to run cobalt frontend.

* don't use plausible.io as receiver backend unless you paid for their cloud service.
use your own domain when hosting community edition of plausible. refer to their docs when needed.

link prefill Copy Chapter

to prefill the link into the input box & start the download automatically, you can pass the URL in the # parameter, like this:

https://cobalt.tools/#https://www.youtube.com/watch?v=dQw4w9WgXcQ

the link can also be URI-encoded, like this:

https://cobalt.tools/#https%3A//www.youtube.com/watch%3Fv=dQw4w9WgXcQ

license Copy Chapter

cobalt web code is licensed under CC-BY-NC-SA-4.0.

this license allows you to:

• copy and redistribute the code in any medium or format, and
• remix, transform, use and build upon the code

as long as you:

• give appropriate credit to the original repo,
• provide a link to the license and indicate if changes to the code were made,
• release the code under the same license, and
• don't use the code for any commercial purposes.

cobalt branding, mascots, and other related assets included in the repo are copyrighted and not covered by the license. you cannot use them under same terms.

you are allowed to host an unmodified instance of cobalt with branding for non-commercial purposes, but this does not give you permission to use the branding anywhere else, or make derivatives of it in any way.

when making an alternative version of the project, please replace or remove all branding (including the name).

open source acknowledgments Copy Chapter

svelte + sveltekit Copy Section

the cobalt frontend is built using svelte and sveltekit, a really efficient and badass framework, we love it a lot.

libav.js Copy Section

our remux and encode workers rely on libav.js, which is an optimized build of ffmpeg for the browser. the ffmpeg builds are made up of many components, whose licenses can be found here: encode, remux.

you can support ffmpeg here!

fonts, icons and assets Copy Section

the cobalt frontend uses several different fonts and icon sets.

• Tabler Icons, released under the MIT license.
• Fluent Emoji by Microsoft, released under the MIT license.
• Noto Sans Mono used for the download button, is licensed under the OFL license.
• IBM Plex Mono used for all other text, is licensed under the OFL license.
• and the Redaction font, which is licensed under the OFL license (as well as LGPL-2.1).
• many update banners were taken from tenor.com.

other packages Copy Section

• mdsvex to convert the changelogs into svelte components.
• compare-versions for sorting the changelogs.
• svelte-sitemap for generating a sitemap for the frontend.
• sveltekit-i18n for displaying cobalt in many different languages.
• vite for building the frontend.

...and many other packages that these packages rely on.