Download HLS Stream Free — m3u8 to MP4, No FFmpeg

You right-clicked the video, picked “Save video as,” and got a 2 KB file that won’t play. Or you got a .ts chunk that’s exactly six seconds long. Or you got a blob: URL that doesn’t save at all. That’s because the video isn’t a single file — it’s an HLS stream, and the browser is stitching hundreds of small segments together on the fly.

Skip the lecture: copy the .m3u8 from Chrome DevTools, paste it into CutFast HLS to MP4, download. No FFmpeg, no extension, no upload. After you have the MP4, trim or caption it in the CutFast editor. Everyday tools stay free; extra AI cuts are pay-as-you-go on cutfa.st.

This guide is the longer path: DevTools, three conversion options, and the DRM wall. Everything still runs locally via WebCodecs.

We’ll also be straight with you about what doesn’t work — DRM-protected streams, low-latency live HLS, and a few subtitle edge cases — so you don’t waste 20 minutes on a stream that was never going to download cleanly.

Why “save video as” fails on modern websites

The video tag on Netflix, Twitter, YouTube, Vimeo, Bilibili, and roughly every streaming site built after 2018 doesn’t point at an MP4. It points at a .m3u8 manifest — a plain-text playlist that lists hundreds of small segment files (typically 2–10 seconds each) in either MPEG-TS (.ts) or fragmented MP4 (.m4s) format. The browser downloads them sequentially, decodes each one, and feeds the bytes into a Media Source Extensions buffer. From the user’s perspective there’s “a video playing.” From the network’s perspective there’s no single video file to save.

This is what’s called the manifest vs segment problem. To get an actual file you can keep, you need three things: the manifest URL, a tool that can fetch every segment listed in that manifest, and a muxer that can concatenate the segments into one container (MP4 being the universal answer). That’s the entire job. The rest of this guide is just three different ways to do it — one with a CLI, one with an extension, and one with nothing but a browser tab.

The manifest also tells you whether the stream is reachable at all. Adaptive streams contain multiple renditions (480p, 720p, 1080p) referenced from a master playlist. Live streams have a sliding window that updates every few seconds. DRM-protected streams reference an encryption scheme like Widevine or FairPlay that no browser tool can decrypt. Knowing which kind you’re looking at saves you a lot of guessing later.

Chrome DevTools method — extract the m3u8 URL in 30 seconds

Open the page with the video. Press F12 (or Cmd+Option+I on macOS) to open DevTools. Click the Network tab. In the filter input near the top, type m3u8. Now hit play on the video. Within a second or two you’ll see one or more requests light up — typically a master playlist (master.m3u8, index.m3u8, or playlist.m3u8) followed by a media playlist for the rendition the player picked.

Right-click the request, choose Copy → Copy URL. That URL is your target. If you see multiple m3u8 requests, the master is the one whose response (click the row, look at the Response tab) contains lines starting with #EXT-X-STREAM-INF — those are pointers to the per-rendition playlists. Pick the master if your tool supports adaptive selection, or pick the highest-bandwidth media playlist if you want a specific quality without the tool guessing.

A few sites obfuscate this. If the filter shows nothing, check the Fetch/XHR subfilter and search for mpd (DASH, the other adaptive format) or m3u8 again with caching disabled (the Disable cache checkbox in DevTools). On some single-page apps the request fires before you open DevTools — refresh the tab with DevTools already open. If the URL still doesn’t appear, the player may be loading the manifest from local storage or a service worker; in that case open the Application tab, expand Service Workers, and look at the cached responses.

The Copy as cURL trick saves you from CORS and Referer headaches. Right-click the m3u8 request and choose Copy → Copy as cURL. You’ll get a multi-line shell command that includes every header the player sent — including the Referer, User-Agent, and any auth cookies. If a download tool later refuses to fetch the manifest, it’s almost always because one of these headers is missing. You don’t have to actually run the cURL command; the headers it contains are the spec for what your downloader needs to send.

Three paths from URL to MP4 — extension, FFmpeg, browser tool

Once you have the URL, three approaches dominate. Each has tradeoffs around install friction, privacy, format support, and how cleanly they handle weird streams. The browser-tool path is the newest because WebCodecs only stabilized across the major browsers in late 2023.

Approach	Install needed	Speed	Privacy	DRM	Live streams	Best for
Browser extension (Stream Detector, Video DownloadHelper, etc.)	Chrome/Firefox extension	Medium (download speed bound)	Mixed — some upload your URL to their servers	No	Limited	One-off downloads when you don’t want a CLI
FFmpeg CLI	ffmpeg + terminal comfort	Fastest, fully offline	Fully local	No	Yes (with -t duration flag)	Power users, batch jobs, pipelines
Browser tool (cutfa.st)	Nothing — just a URL	Bound by your network	Fully local, runs in your tab via WebCodecs	No	VOD only currently	Mobile, locked-down work laptops, anyone who doesn’t want to think

Each path can pull the same VOD stream into a clean MP4 — the question is what’s in your way. Extensions are the lowest friction if you’re already using one, but several popular ones quietly proxy URLs through analytics endpoints, and the well-maintained ones disappear from the Chrome Web Store every few months when policy enforcement sweeps through. FFmpeg is the gold standard for repeatability — but only if you’ve already got it installed and remember the flag for passing a Referer header.

For completeness, here’s the FFmpeg one-liner that handles the two headers most sites require:

ffmpeg \
  -headers "Referer: https://example.com/$'\r\n'User-Agent: Mozilla/5.0$'\r\n'" \
  -i "https://cdn.example.com/path/to/playlist.m3u8" \
  -c copy \
  -bsf:a aac_adtstoasc \
  output.mp4

-c copy tells FFmpeg to remux without re-encoding (fast, lossless). aac_adtstoasc is the bitstream filter that converts ADTS-framed AAC (which TS segments use) into the format MP4 wants. If the input is already CMAF/fMP4 you can drop that flag. Add -headers "Cookie: <copied from DevTools>$'\r\n'" if the manifest is behind auth.

The browser tool path skips all of this. WebCodecs gives a webpage direct access to hardware video decoders, so any modern browser tab can do what FFmpeg does — fetch the segments, decode, remux to MP4, and offer a download — without ever sending the bytes off your machine. You need Chrome 102+, Safari 16.4+, or Firefox 130+ for the WebCodecs APIs we lean on. Mobile Safari on iOS 16.4+ works, which is the part that surprises people the first time.

The cutfa.st zero-install flow step by step

Open the m3u8 player in a new tab. Paste the m3u8 URL into the input. The player loads it, parses the manifest, and shows you what’s inside — duration, codec, resolution, segment count, whether the stream is live or VOD, whether there’s an encryption tag. This step alone is useful: if the manifest fails to load here, it’ll fail in any other browser-based tool too, and the error message tells you whether the issue is CORS, a missing Referer, or a DRM key request you can’t satisfy.

Once it plays, scrub through to confirm the right stream is loaded. Some sites serve a low-bitrate preview from a similar-looking URL; the player view confirms what you actually grabbed. If the manifest is a master playlist with multiple renditions, the player picks the highest-quality one by default, but you can switch via the quality menu before converting.

Click the Convert to MP4 button (or open HLS to MP4 directly and paste the URL there). The converter runs entirely in your browser tab. It downloads each segment over the same network connection your browser already uses, demuxes the TS or fMP4 packets, and writes a single MP4 file using WebCodecs and Mediabunny’s MP4 muxer. For most VOD streams under an hour the whole thing finishes in roughly the time it takes to download the segments — no re-encoding, no quality loss. The MP4 saves to your Downloads folder when it’s done.

If you need a different output container or codec — say, MOV for Final Cut, MKV for VLC compatibility, or audio-only MP3 / WAV / AAC for podcasts — the multi-format HLS converter handles those in the same flow. It’s the same underlying pipeline; you just pick a different output target on the right side of the screen. Audio-only conversion is noticeably faster because video decode is skipped entirely.

A few things worth knowing about this flow. Nothing is uploaded — the manifest fetches and the segment fetches go from your browser straight to the origin CDN, the muxing happens in a Web Worker on your machine, and the resulting MP4 lives in browser memory until you save it. Your tab needs to stay open for the duration; backgrounding it on mobile may pause WebCodecs depending on the OS. And while we support stream input up to several hours of VOD, very long streams (4+ hours of 1080p) can hit browser memory limits before the final mux — for those, FFmpeg’s segmented muxing is still the more reliable option.

When the m3u8 won’t load — CORS, Referer, AES-128, DRM

Things break for a small set of predictable reasons. Knowing which one you’ve hit takes about 30 seconds with DevTools open.

CORS errors show up as red entries in the Network tab with a status of (blocked:cors) or a console message about Access-Control-Allow-Origin. The CDN serving the manifest is configured to refuse requests from origins other than the original site. Browser-based tools can’t override this — it’s enforced by the browser itself, by design. The workarounds are: a CORS-bypassing proxy (which means trusting the proxy operator with your URL and bytes), a desktop tool like FFmpeg that doesn’t run in a browser, or a browser extension that has cross-origin permissions. For occasional use, the cleanest answer is FFmpeg.

Referer or User-Agent gating is the second most common failure. The manifest loads fine in the original site but 403s when fetched from a tool. Look at the Copy as cURL output you grabbed earlier — every header in there may be load-bearing. Many CDN configs check Referer specifically. Browser-based tools can’t easily forge Referer (Chromium blocks scripts from setting it via fetch), so this is another case where the FFmpeg -headers flag wins. If you absolutely need a no-install path, the m3u8 player inherits the parent page’s Referer, so manifests that gate by Referer-equals-cutfa.st will fail but ones that gate by “not empty” will sometimes succeed.

AES-128 segment encryption is HLS’s lightweight protection — segments are encrypted with a key file referenced from the manifest via #EXT-X-KEY. The key URL is fetched and the segments are decrypted on the fly. This is fully supported by browser-based tools and FFmpeg as long as the key URL is publicly fetchable with the right headers. If the key is gated behind auth that’s hard to reproduce, you may see the manifest load but conversion fail at the first segment with a decryption error. In that case, the Copy as cURL trick on the key request itself usually surfaces the missing auth.

DRM (Widevine, PlayReady, FairPlay) is the hard wall. These systems use a separate license server, hardware-backed key storage, and content decryption modules that are deliberately unreachable from web pages — that’s the entire point. Mediabunny and our converters can read the manifest of a DRM stream (so the player will load and show you metadata), but no browser-based tool can decrypt protected segments. FFmpeg can’t either. If the manifest contains #EXT-X-SESSION-KEY referencing a license server, or segments fail with “key request failed” errors, you’ve hit DRM. Stop trying to convert it. Use the official download feature the platform offers, or accept that this stream isn’t designed to leave the platform’s player.

A few smaller gotchas. WebVTT subtitle muxing isn’t yet supported in our HLS-to-MP4 path — if the stream has embedded subtitles, you can download them separately as a .vtt file but the resulting MP4 won’t include them as a subtitle track. Multi-rendition adaptive output also isn’t supported — when you convert, you get a single fixed-quality MP4, not an adaptive stream. Low-latency HLS with sub-second #EXT-X-PART segments works for playback but not for live recording yet. And live streams in general — the HLS to MP4 converter currently targets VOD; for live capture, FFmpeg with -t <duration> is still the dependable answer.

Legal and ethical guidance

The technology is neutral; what you’re allowed to do with it varies wildly. A few honest distinctions matter.

Generally fine: downloading streams whose copyright you hold (your own Vimeo uploads, a university lecture you recorded, a livestream you produced), streams explicitly licensed for download (Creative Commons content, public-domain footage, your employer’s training videos that the LMS happens to serve as HLS), and streams you’re saving for accessibility purposes that fall under fair use or fair dealing in your jurisdiction (e.g., adding captions to an inaccessible educational video for personal study).

Risky and platform-specific: downloading paid streaming content for offline personal viewing. Most major platforms’ Terms of Service explicitly prohibit this even when no DRM is present, and even when most jurisdictions wouldn’t treat it as a copyright violation per se. The platform can revoke your account. In the EU, private copying carve-outs may apply but are narrowing every year. In the US, fair use is fact-specific and the existence of an official offline-download feature on the platform weakens any “no alternative was available” argument.

Outright illegal in most jurisdictions: circumventing DRM (covered by the DMCA in the US, the Copyright Directive Article 6 in the EU, and similar provisions in most countries), redistributing downloaded content, downloading paid content you don’t have a subscription to via shared credentials or auth bypasses, and commercial use of any copyrighted stream without a license. None of the tools described here will help with any of this — DRM circumvention specifically is the wall we cannot and will not climb.

The practical rule: if the platform has a download button and you’re using this method to bypass tier restrictions, you’re on shaky ground. If the platform has no download feature and you’re saving content for documented personal use of a stream you have legitimate access to, you’re usually fine but check your local copyright law. If the stream is encrypted with Widevine or FairPlay, the law in your jurisdiction almost certainly prohibits any attempt to decrypt it regardless of your intent.

When in doubt, the question to ask isn’t “can I technically download this” — by 2026, the answer to that is almost always yes for non-DRM streams. The question is “would the rights holder consider this acceptable use,” and “am I willing to defend this position if asked.” For your own content, your students’ content, and licensed content, that bar is easy to clear. For everything else, think before you click.

FAQ

Why does the m3u8 URL change every time I refresh the page? CDNs sign URLs with short-lived tokens (often 1–24 hours). Copy it again if CutFast says the playlist expired. The segments did not change — only the token did.

Can I download a 4K HDR stream this way? If the manifest lists a 4K rendition and your browser can decode it, CutFast remuxes without re-encoding. Long 4K files eat RAM; split them first.

Why is the audio out of sync after conversion? Rare with remuxing. Re-run through CutFast’s HLS converter into MOV. If it still drifts, FFmpeg -async 1 is the fallback.

Can I download just the audio from an HLS stream? Yes. CutFast’s HLS converter can write MP3, WAV, or AAC and skip video decode.

Does this work on iPhone or iPad? Paste the URL into CutFast HLS to MP4 on Safari 16.4+. Grab the m3u8 on a desktop first — mobile DevTools are painful. Long streams may hit Safari’s memory cap.

What about DASH (.mpd) streams? Same DevTools trick, filter mpd instead of m3u8. CutFast converters are HLS-first; DASH still means FFmpeg or yt-dlp.

The MP4 is the raw file. Open it in the CutFast editor to cut highlights, burn captions, or raise volume, then export. Everyday tools stay free; extra AI minutes are pay-as-you-go on cutfa.st.