
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
votify
Advanced tools
A command-line app for downloading songs, podcasts and videos from Spotify.
Join our Discord Server: https://discord.gg/aBjMEZ9tnq
[!WARNING]
- Some users have reported that Spotify suspended their accounts after using Votify. Use it at your own risk.
- You may not be able to download songs with default settings if your account is too new. In this case, refer to the Dependencies section for alternative configurations that may support new accounts.
Add these tools to your system PATH or specify their paths via command-line arguments or the config file. The tools needed depend on which audio quality, video format, and download speed you want. Use the table below to find the required tools for your use case:
| Feature | Configuration | Required Tools |
|---|---|---|
| Songs in Vorbis (default) | audio_quality: vorbis-low|vorbis-medium|vorbis-highsession_type: librespot | None |
audio_quality: vorbis-low|vorbis-medium|vorbis-highsession_type: desktop | Spotify DLL | |
| Songs in AAC Quality | audio_quality: aac-medium|aac-highsession_type: librespot|webaudio_remux_mode: ffmpeg | .wvd file FFmpeg |
audio_quality: aac-medium|aac-highsession_type: librespot|webaudio_remux_mode: mp4box | .wvd file MP4Box mp4decrypt | |
audio_quality: aac-medium|aac-highsession_type: librespot|webaudio_remux_mode: mp4decrypt | .wvd file mp4decrypt | |
| Songs in FLAC Quality | audio_quality: flac-mp4|flac-mp4-24session_type: librespot|webaudio_remux_mode: ffmpeg | L1-certified .wvd file FFmpeg |
audio_quality: flac-flac|flac-flac-24session_type: desktop | Spotify DLL | |
| Podcasts in Vorbis | audio_quality: vorbis-low|vorbis-medium|vorbis-high | None |
| Podcasts in AAC Quality | audio_quality: aac-medium|aac-highaudio_remux_mode: ffmpeg | FFmpeg |
audio_quality: aac-medium|aac-highaudio_remux_mode: mp4box | MP4Box mp4decrypt | |
audio_quality: aac-medium|aac-highaudio_remux_mode: mp4decrypt | mp4decrypt | |
| Music Videos | session_type: librespot|webvideo_format: mp4video_remux_mode: ffmpeg | .wvd file FFmpeg mp4decrypt |
session_type: librespot|webvideo_format: mp4video_remux_mode: mp4box | .wvd file MP4Box mp4decrypt | |
session_type: librespot|webvideo_format: webmvideo_remux_mode: ffmpeg | .wvd file FFmpeg Shaka Packager | |
session_type: librespot|webvideo_format: webmvideo_remux_mode: mp4box | .wvd file MP4Box Shaka Packager | |
| Podcast Videos | prefer_video: truevideo_remux_mode: ffmpeg | FFmpeg |
prefer_video: truevideo_remux_mode: mp4box | MP4Box | |
| Faster Downloads | audio_download_mode: aria2c | aria2c |
audio_download_mode: curl | cURL |
| Tool | Download | Notes |
|---|---|---|
| .wvd file | Extract using KeyDive | Required for AAC/FLAC quality. L1-certified required for FLAC. Extract from Android device (emulator files may not work) |
| Spotify DLL | Extract from the Spotify for Windows desktop app version 1.2.85.519 inside its installation directory (Spotify.dll) | Required for desktop session |
| FFmpeg | Windows / Linux | Used for audio/video remuxing and conversion |
| MP4Box | Download | Alternative for audio/video remuxing |
| mp4decrypt | Download | Decrypts MP4 files when used with MP4Box |
| Shaka Packager | Download | Decrypts WebM video files |
| aria2c | Download | Faster download alternative |
| cURL | Download | Download alternative |
Install Votify via pip:
pip install votify[librespot]
Set up the cookies file:
cookies.txt, or--cookies-path or in the config file.[!NOTE]
- The 'librespot' extra is required when
session_typeis set tolibrespot. If you want to use the desktop or web session types, the extra is not required and you can install the package withpip install votifyinstead.
votify [OPTIONS] URLS...
Download a song:
votify "https://open.spotify.com/track/18gqCQzqYb0zvurQPlRkpo"
Download an album:
votify "https://open.spotify.com/album/0r8D5N674HbTXlR3zNxeU1"
Download a podcast episode:
votify "https://open.spotify.com/episode/3kwxWnzGH8T6UY2Nq582zx"
Download a podcast series:
votify "https://open.spotify.com/show/4rOoJ6Egrf8K2IrywzwOMk"
Download a music video:
votify "https://open.spotify.com/track/31k4hgHmrbzorLZMvMWuzq"
Download a music video from a song:
votify "https://open.spotify.com/track/18gqCQzqYb0zvurQPlRkpo" --prefer-video
Download a podcast video:
votify "https://open.spotify.com/episode/3kwxWnzGH8T6UY2Nq582zx" --prefer-video
Choose which media to download from an artist:
votify "https://open.spotify.com/artist/0gxyHStUsqpMadRV0Di1Qt"
Auto-select artist albums without a prompt:
votify "https://open.spotify.com/artist/0gxyHStUsqpMadRV0Di1Qt" --auto-media-option albums
Download liked tracks:
votify --auto-media-option liked-tracks
| Key | Action |
|---|---|
| Arrow keys | Move selection |
| Space | Toggle selection |
| Ctrl + A | Select all |
| Enter | Confirm selection |
Votify can be configured using command-line arguments or the config file.
Config file location:
~/.votify/config.ini%USERPROFILE%\.votify\config.iniThe file is created automatically on first run. Command-line arguments override config file values.
| Command-line argument / Config file key | Description | Default |
|---|---|---|
| General | ||
--wait-interval / wait_interval | Wait interval between downloads in seconds | 10 |
--read-urls-as-txt, -r / - | Read URLs from text files | false |
--config-path / - | Config file path | <home>/.votify/config.ini |
--log-level / log_level | Logging level | INFO |
--log-file / log_file | Log file path | null |
--no-exceptions / no_exceptions | Don't print exceptions | false |
--no-config-file, -n / - | Don't use a config file | false |
--database-path / database_path | Path to the SQLite database file for registering downloaded media | null |
--auto-media-option / auto_media_option | Auto media option | null |
| Spotify | ||
--session-type / session_type | Session type to use | librespot |
--cookies-path, -c / cookies_path | Cookies file path | ./cookies.txt |
--wvd-path / wvd_path | .wvd file path | null |
--spotify-dll-path / spotify_dll_path | Spotify DLL file path for desktop session decryption | null |
--prefer-video / prefer_video | Prefer video streams when available | false |
| Output | ||
--output, -o / output | Output directory path | ./Spotify |
--temp / temp | Temporary directory path | . |
--save-cover-file / save_cover_file | Save cover as a separate file | false |
--save-playlist-file / save_playlist_file | Save a M3U8 playlist file when downloading a playlist | false |
--overwrite / overwrite | Overwrite existing files | false |
--cover-size / cover_size | Cover size to use | extra-large |
--exclude-tags / exclude_tags | Comma-separated tags to exclude | null |
--truncate / truncate | Maximum length of file/folder names | null |
| Template | ||
--album-folder-template / album_folder_template | Folder template for album tracks | {album_artist}/{album} |
--compilation-folder-template / compilation_folder_template | Folder template for compilation tracks | Compilations/{album} |
--podcast-folder-template / podcast_folder_template | Folder template for podcast episodes | Podcasts/{album} |
--no-album-folder-template / no_album_folder_template | Folder template for tracks not in an album | {artist}/Unknown Album |
--single-disc-file-template / single_disc_file_template | File template for single-disc album tracks | {track:02d} {title} |
--multi-disc-file-template / multi_disc_file_template | File template for multi-disc album tracks | {disc}-{track:02d} {title} |
--podcast-file-template / podcast_file_template | File template for podcast episodes | {track:02d} {title} |
--no-album-file-template / no_album_file_template | File template for tracks not in an album | {title} |
--playlist-file-template / playlist_file_template | File template for M3U8 playlists | Playlists/{playlist_artist}/{playlist_title} |
--date-tag-template / date_tag_template | Date tag template | %Y-%m-%dT%H:%M:%SZ |
| Song / Podcast | ||
--audio-quality / audio_quality | Comma-separated audio quality priority | vorbis-medium |
--audio-download-mode / audio_download_mode | Audio download mode to use | ytdlp |
--audio-remux-mode / audio_remux_mode | Audio remux mode to use | ffmpeg |
--synced-lyrics-only / synced_lyrics_only | Only download synced lyrics file | false |
--no-synced-lyrics-file / no_synced_lyrics_file | Don't create synced lyrics file | false |
| Video | ||
--video-format / video_format | Video format to use | mp4 |
--video-resolution / video_resolution | Video resolution to use | 1080p |
--video-remux-mode / video_remux_mode | Video remux mode to use | ffmpeg |
| Executables | ||
--aria2c-path / aria2c_path | Path to aria2c binary | aria2c |
--curl-path / curl_path | Path to curl binary | curl |
--ffmpeg-path / ffmpeg_path | Path to FFmpeg binary | ffmpeg |
--mp4box-path / mp4box_path | Path to MP4Box binary | mp4box |
--mp4decrypt-path / mp4decrypt_path | Path to mp4decrypt binary | mp4decrypt |
--shaka-packager-path / shaka_packager_path | Path to Shaka Packager binary | packager |
Tags usable in template folder/file options and in the exclude_tags list:
album, album_artistartistcomposerdate (supports strftime format: {date:%Y})disc, disc_totalisrclabelmedia_idmedia_typeplaylist_id, playlist_artist, playlist_title, playlist_trackproducer, publisherratingtitle, track, track_totalTags usable in the exclude_tags list only:
compilation, copyright, coverdescriptionlyricsurlsmall - Up to 64pxmedium - Up to 300pxlarge - Up to 640pxextra-large - Up to 2000pxvorbis-low - Vorbis 96kbpsvorbis-medium - Vorbis 160kbps, songs onlyvorbis-high - Vorbis 320kbps, songs only, requires an active premium subscriptionaac-medium - AAC 128kbps, .wvd file required for songsaac-high - AAC 256kbps, songs only, .wvd required, requires an active premium subscriptionflac-flac - FLAC lossless (native), songs only, Spotify DLL required, requires an active premium subscriptionflac-flac-24 - FLAC 24-bit (native), songs only, Spotify DLL required, requires an active premium subscriptionflac-mp4 - FLAC lossless in MP4 container, songs only, L1-certified .wvd file required, requires an active premium subscriptionflac-mp4-24 - FLAC 24-bit in MP4 container, songs only, L1-certified .wvd file required, requires an active premium subscription[!NOTE]
- L1-certified .wvd file is required for flac-mp4 and flac-mp4-24 qualities.
- Spotify DLL is required for flac-flac and flac-flac-24 qualities (desktop session only).
mp4 - H.264 up to 1080p with AAC 128kbpswebm - VP9 up to 1080p with Opus 160kbpsask - Prompt to choose available video and audio codecslibrespot - Librespot session (for Vorbis quality with web support)desktop - Spotify desktop session (for Vorbis and FLAC quality)web - Spotify web session (for AAC quality and videos)ytdlp - Default download modearia2c - Faster alternativecurl - Alternative using curl[!NOTE]
- yt-dlp is only used as a file download library. Tracks are still fetched directly from Spotify's servers, and yt-dlp is only responsible for handling the file download process.
ffmpegmp4boxffmpegmp4boxmp4decrypt[!NOTE] Audio remux modes only apply for AAC qualities.
144p, 240p, 360p, 480p, 576p, 720p, 1080partist-top-tracks - Auto-select artist top tracksartist-albums - Auto-select albumsartist-compilations - Auto-select compilationsartist-singles - Auto-select singlesartist-videos - Auto-select music videosliked-tracks - Auto-select liked tracks (URL not required)DEBUG, INFO, WARNING, ERRORMIT License - see the LICENSE file for details.
I'm generally not reviewing pull requests that change or add features at this time. Only critical bug fixes will be considered. Feel free to open issues for bugs or feature requests.
FAQs
A command-line app for downloading songs, podcasts and videos from Spotify.
We found that votify demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.