What it does

Collector	Links are analysed and staged before anything downloads: name, size, availability, which backend will take them. Nothing is ever dropped in silence, and a link that no backend handles is still shown, with the reason on it. With Start added links immediately on under Settings, Link collector, a new batch confirms itself after a countdown you set, which is the time to look it over, throw a link out or change its folder.
Rules	A Packagizer and a link filter, one engine used twice: match on filename, URL, hoster, source, type or size, then set the package, folder, filename, priority or comment, or refuse the link, with the rule's name attached. A test box shows what a rule would do before it does it.
Download list	A real table: choose your columns, resize and reorder them, sort by any of them, fold packages away. The layout is remembered per instance, and sorting is a view: the queue keeps its own order. Rows are as dense as JDownloader's unless Row height under Settings, Appearance is set to Medium or Comfortable, which each browser keeps for itself.
Play while downloading	Press Play on a video or song that is still downloading, from the list's right-click menu or in the phone app. It opens in the browser's player, or in a player app on the phone. KnightLoader fetches that file in order from where you are watching, and its beginning and end come first, because players read a file's index there. The rest of the queue keeps downloading. For a torrent, the pieces just ahead of the player come first; a direct download moves one of its connections to the part being played. If you jump ahead, playback waits until that part has arrived. Once playback stops or the file is complete, the download goes back to its usual order. In a torrent of several files, Play opens the largest video or song among the files it fetches, and a torrent without any gets no Play. A download that stopped halfway has to run again before it plays. The phone needs a direct connection to the instance for this, since a player app cannot go through the relay.
Crawling	Paste a page and each file it links to is staged as its own task.
Containers	.txt link lists, .dlc, .rsdf and .ccf (CCF 0.7 to 1.0, 3.0 and 5.0) are read here. One that will not open here goes to the JDownloader backend. Either way the links come through the ordinary path, so the filter and the Packagizer apply to them like anything else.
Queue	Global and per-host concurrency, priorities, manual order, a stop mark, automatic retries with a growing delay, and a timetable that pauses or throttles by the clock. The timetable is weekly, a window may run past midnight, and it goes by the machine's local time. Pause, resume or move a single link or a whole package. Stopping the queue lets whatever is running finish. Stopping every transfer at once asks first, and says how much of what has arrived cannot be resumed and would be fetched again. A single download can decide for itself whether its archive is unpacked.
Backends	Debrid services, your hoster logins through the built-in JDownloader, MEGA links, which KnightLoader downloads and decrypts itself, yt-dlp, torrents and the direct download, asked in an order you arrange by dragging. A hoster can have its own rule for which backend to ask first and which never to use, and a single download can be pinned to one. With Allow free downloads off, a link that nothing but a free download could fetch waits for an account instead of starting, for every link or per category. When all that is left to fetch of a page is the page itself, or the scripts, styles and images JDownloader finds on it, the download stops there and says that no backend can read the page's video player.
Speed limit	A total for everything, applied while downloads run rather than only to the next one.
Quiet mode	A second set of limits for the speed, the number of downloads at once and the torrents' upload, set on the Automation page. A quiet window in the timetable switches it on, so do the API and the MCP server, and so does a stream on Plex, Jellyfin or Emby once you add the server there. KnightLoader asks the server every ten seconds what is playing and lets go about half a minute after the last stream ends. A stream paused for longer than half an hour does not count, and neither do streams at home if you say so. While something plays, finished archives wait to be unpacked, which leaves the disk to the stream.
Duplicates	The same URL twice is refused; the same file under two URLs is recognised as a mirror and handled by a policy you pick. With Reject links already downloaded switched on under Settings, Link collector, a link the download history already has, by URL or as the same file under that policy, goes to the rejected links instead of being fetched again, and Restore adds it anyway. A download you removed from the list does not count. Refused links are held with their reason, not deleted.
Several sources for one file	With "Use several sources for one file" on under Settings, Downloads, one file is fetched from up to four places at once: its own link, the same link unlocked by a second debrid account, and the spare copies the list keeps from other hosters. Each source gets the connections set for one download, so a second account that allows fewer for that hoster is not asked, and a source that stops part way leaves its share to the others. A source joins only when it answers range requests, reports the same size and sends the same bytes at two sample points in the file, so two split archives whose volumes happen to share a size are never mixed. Files under 64 MB, torrents, and links that JDownloader, yt-dlp or a login header fetch always come from one source. It is off by default. It helps only when a service caps the speed of one link or one connection below what your line can take, every extra unlock uses that account's traffic, some services count the whole file as soon as it is unlocked, and some services' terms forbid downloading with two accounts at once.
Extraction	zip, rar (incl. multi-volume), 7z, tar, gz, bz2, xz, zst. A multi-part set waits for every part. Encrypted zip (WinZip AES and the legacy ZipCrypto), rar and 7z take passwords, tried from a list in order. Pure Go, with no external unrar or 7z binary in the image.
Integrity	A finished file is checked against an .sfv/.md5/.sha* that came with it, or a CRC in its own name. Nothing is marked as passing that was not checked.
Collisions	What happens when the file already exists is your choice (overwrite, skip or number it), and the name is reserved atomically, so two downloads finishing together cannot pick the same one.
Connections	Several outbound routes with order, credentials and a per-host filter, handed out round-robin up to a cap each. A route is the machine's own address or a proxy, SOCKS included. Passwords are stored, never served back.
Reconnect	Get a new address when a hoster's limit is keyed to the one you have: run a command, replay a recorded HTTP exchange, ask the gateway over UPnP (which needs no router details at all), or run a script through a named interpreter. A recorded LiveHeader script imports as it is. An unchanged address counts as a failure.
Programs on events	Start a program of yours when a download finishes or fails, a package is complete or an archive has been unpacked, set up on the Automation page. It runs without a shell, so a file name with $(...) or ; in it stays a file name. It gets the event as placeholders in its arguments and as KL_EVENT, KL_TASK_ID, KL_NAME, KL_FILE, KL_FOLDER, KL_PACKAGE, KL_CATEGORY and KL_EXTRACT_OK in its environment, and each row has a time limit and a limit on how many runs go at once. The exit code and the output go into the log.
Messages on events	Tell ntfy, Gotify, Matrix or any webhook of yours when a download finishes or fails, a package is complete, a captcha waits or an account has lapsed, set up on the Automation page with the method, headers and body you write. A Discord webhook needs only its address: each event arrives as a Discord message with the name, size and category, and the reason when something failed. When Discord asks for a pause, the next message waits as long as it says.
Stays awake	The desktop app keeps the computer from going to sleep while a download is running and while its files are checked, unpacked or moved, and lets it sleep again once nothing is left to do. The screen can still turn off.
Torrents	Magnet links and uploaded .torrent files are a resolver like any other, so they land in the same collector, the same queue and the same folder rules. They need no account and no setup. The Torrents page has a file selection that skips samples, .nfo and .exe files, and a category can have its own. Extra trackers help a torrent find peers, and one that announces to a banned tracker is rejected (see Torrents). A torrent still downloading reads Leeching, one still uploading after it finished reads Seeding, and each has a quick filter. The Overview has a Torrents card with both counts, both speeds, what came in and went out today and in all, the overall ratio and the three torrents uploading fastest with the time each has left to its seed target. The built-in client can be tied to one network interface, such as a VPN's wg0, and then sends and receives nothing while that interface is missing or down, a kill switch like qBittorrent's (see Torrents).
Torrents through debrid	TorBox, Real-Debrid, AllDebrid, Premiumize.me, Debrid-Link, Linksnappy and Deepbrid can fetch a torrent in place of the built-in torrent client, the way rdt-client does. The service downloads it to its own servers, and the files then come here over HTTP like any unlocked link, into a folder named after the torrent. A torrent the service already has is ready at once. Unless "Seed what the debrid service fetched" is on, nothing seeds from your machine and your address never appears in a swarm, so no port has to be open. While the service is still fetching, the row shows how far it has got. The download priority order on the Accounts page decides whether a service or the built-in client goes first, and a pin on the task still wins. When a service declines a torrent, for example one too big for the plan, it goes to the next service or to the built-in client, and the task's log says why. The files picked in a .torrent's tree, or by the Torrents page's file selection when nobody picked them, are passed on to Real-Debrid and Debrid-Link; with the other services only those files are downloaded. Deepbrid does not list a torrent's files, so it always sends the whole torrent, and it takes torrents only from a premium account. A torrent from a private tracker never goes to a service, because its passkey would go with it. The built-in client fetches it instead. A .torrent says whether it is private, and a magnet link counts as private when its own tracker address carries a passkey. When a file fails or KnightLoader restarts, the task carries on with the service's copy and the files already here. If the service no longer has the torrent, for example because it was deleted on the service's website, KnightLoader adds it there once more and keeps the files already here. When the service loses it a second time, the torrent goes to the next service or the built-in client, and its row says why. Once every file is here, the torrent is deleted on the service unless Settings, Torrents says to keep it. A torrent the account already had is fetched from there instead of being added again, and it is never deleted. Premiumize.me does not say which torrents it holds and turns such a torrent down, so that one goes on to the next service or the built-in client. With "Send only cached torrents to the debrid service" on under Settings, Torrents, KnightLoader first asks the service whether it has the torrent cached, and one it has not goes on to the next service or the built-in client even though the service would take it. TorBox, Premiumize.me and Linksnappy are asked directly. Real-Debrid, AllDebrid, Debrid-Link and Deepbrid have no way to ask, so KnightLoader adds the torrent there and deletes it again unless the service has it finished within those few seconds: Real-Debrid has to report it downloaded once the files are chosen, AllDebrid has to report it Ready, Debrid-Link has to have it at 100 percent, and Deepbrid has to report it downloaded. A check that fails or takes longer than 15 seconds counts as not cached. "Give up on a debrid service after" hands a torrent on when the service has made no progress on it for that many minutes, 10 unless you change it, counting the time it waits in the service's queue or reads the magnet link. The torrent is deleted there, it goes to the next service or the built-in client, and its row says why. This covers only the service's own download, not the files on their way here, and it never touches a torrent pinned to the service. 0 turns it off. "Seed what the debrid service fetched" hands a torrent to the built-in client or to an external qBittorrent once all its files are here, which helps with cross-seeding, and nothing is fetched for this. The built-in client seeds under the seeding targets. qBittorrent gets the torrent through its Web UI with the files where they are, so cross-seed or qui can find it there, and is told to skip its own check. It has to reach the files at the same path, or at the path set as "Download folder in qBittorrent" when the two containers mount the download folder differently. Every file has to be there at the size the torrent gives, and for a torrent added as a .torrent file every piece is checked as well, which a magnet link does not carry, so a magnet gets the size check only. A torrent that fails the check, or that qBittorrent does not take, is not seeded, and its row says why.
Captchas	A captcha from the JDownloader backend opens a window in the web interface: type the text, click the points, or solve the reCAPTCHA or hCaptcha there. The phone app answers all of these and a Cloudflare Turnstile as well. Captcha accounts at seven paid services can answer for you, in the order you set under Captcha priority order on the Accounts page: 2Captcha, Anti-Captcha, CapMonster Cloud, CapSolver, 9kw.eu, DeathByCaptcha and Solvecha. Their keys, or DeathByCaptcha's login, go in the Captcha accounts section of the Accounts page, where each is checked against the service before it is saved, and a captcha account switched off there is not tried. All seven read pictures, and all but Solvecha solve reCAPTCHA v2. reCAPTCHA v3 goes to all but 9kw.eu and Solvecha, reCAPTCHA Enterprise to 2Captcha, Anti-Captcha, CapMonster Cloud and CapSolver, and Cloudflare Turnstile, once JDownloader hands one out, to all but 9kw.eu and Solvecha. Only CapMonster Cloud and 9kw.eu take hCaptcha, and a click on points goes to 2Captcha, Anti-Captcha and 9kw.eu. A captcha goes to the captcha accounts once at most, a restart included, and one a service took without answering goes to no other captcha account, since the first may bill it anyway. The window and the phone app's card say which service is working on it and why one declined. With Only when nobody is watching switched on, the captcha accounts wait while KnightLoader is open in the foreground in a browser tab, the desktop app or the phone app, or another app keeps reading its captcha list, and take over once you switch away or a wait you set runs out. They wait only for a captcha the one watching can answer: a Cloudflare Turnstile waits only for the phone app, which shows it under the hoster's address, since a browser tab cannot. When a widget captcha will not load in the window or the phone app, that one stops holding them back until Refresh loads it after all. A service that has already started keeps working, and whichever answer arrives first counts. A button under Captcha priority order on the Accounts page sends a test captcha, so you can try the window, the phone app and, with the second button, the captcha accounts, and see whether the answer was right. It is a picture KnightLoader draws itself, or a Cloudflare Turnstile, hCaptcha or reCAPTCHA check on the test key the service publishes for this, which always passes. A Turnstile test shows in the phone app only.
Usenet	An .nzb is fetched from your own Usenet servers, over TLS and as many connections as your plan allows, or goes to your TorBox, Premiumize.me or Deepbrid account, whichever comes first in the priority order. A main server and fill servers on higher levels are asked in turn for each article, and an article that arrives damaged is fetched again. Each release is checked against its par2 files and repaired when articles are missing: a file posted under a random name gets its real name back, and only as many recovery files are downloaded as the repair needs. A release your servers cannot complete or repair goes on to the debrid account. See Getting links in.
Sonarr and Radarr	qBittorrent's API for torrents and SABnzbd's for link lists and .nzb files, off until you switch them on. A grab through either is filed in the category of the same name, which is created with its own folder inside the download folder the first time it is used.
Debrid drive	What is on your TorBox, Real-Debrid, AllDebrid, Premiumize.me and Debrid-Link accounts as a read-only WebDAV share, off until you switch it on. Mount it with rclone, and Plex or Jellyfin stream from the service without anything being downloaded first. A file is unlocked only when something reads it, and a player can seek. See Debrid drive.
MCP server	AI assistants such as Claude Code, Cursor or VS Code read your downloads and, with the rights you give them, add links and control the queue through the Model Context Protocol, each with a token of its own. Off until you set up a client. See MCP server.
Intake	Paste, drop, Click'n'Load from a site's own button, a container file, a watched folder for link lists, .torrent files, containers and .nzb files, or Sonarr and Radarr, which see KnightLoader as qBittorrent or SABnzbd.
Multi-instance	Register other KnightLoaders and drive them all from one dashboard. Instances on the same network announce themselves and take one click to add, with nothing to configure.
Twelve words	Generate a phrase on one instance under Settings, Pairing, enter it on the next, and they find each other on one network directly and across networks through the relay, without an account, a port forward or a domain. A badge says whether another instance or the phone is really there, and a group that stays alone says what to do. The words carry a secret; the relay only ever sees a hash of it, so nobody running one can reconstruct them. Use ours or run your own. See Connecting instances and apps.
Your own relay	Don't want to use ours? Point both ends at a relay you run and the same twelve words work against it. It terminates its own TLS over TLS-ALPN-01, so it needs no proxy, certbot or cron, and only port 443 open.
Everywhere	The web UI, a desktop build, an Android app and a browser extension all talk to the same instance, and to each other's.
Access	An optional password lock, off by default. A new password needs at least 12 characters. A six-digit code from an authenticator app can stand beside the password as a second factor, with recovery codes for the day the phone is gone, and a passkey signs you in without typing the password. Named API tokens, each limited to the rights it needs: read, add, control or admin. See API tokens and their rights. Same-origin API, origin-checked WebSocket.
Backups	Download backup under Settings, General, Backup & transfer saves everything the instance holds as one archive: the download list and history, the settings, the hoster and debrid logins with the header profiles, captcha keys, VPN logins and media server tokens, the login password, the API and assistant tokens, the scripts and the pairing. Without an app key every password in it is readable, so keep the file private; with one the archive is sealed with it. The download needs a login password. Upload backup says what it replaces and puts everything back at the next start, all of it or nothing. A backup restores under another app key or none: enter the key of the instance that made it with the upload. The login password comes along unless it was set under another app key, which this instance could never check; then it keeps its own, and a backup without a password never takes one away. The confirmation says which before anything changes. Passkeys always stay. Automatic backups, off by default, write the same archive every so many days into a folder you choose, the backups folder in the data folder unless you pick another; saving the settings refuses a folder that cannot be made or written. KnightLoader keeps the newest seven unless you set another number and deletes only the automatic backups it wrote itself, never anything else in the folder. The days count from the newest backup in the folder, so a container that restarts every night still backs up once per interval. A failed backup shows under Settings, Health & diagnostics and is tried again an hour later, and while the data folder is under the Do not start below mark the backup waits for room.
Bug report	The Bug report button under Settings, Info downloads one JSON file to attach to an issue: the details of the build, the settings with every password removed and the latest log lines. Settings, Health & diagnostics shows the build's details and the log on the page.
Every setting by name	Settings, Advanced lists every setting of the build under its raw name, to read and to change, the few without a control of their own included.
From JDownloader	Point it at a JDownloader 2 settings folder, uploaded as a zip or as a path on the server, and it takes over the hoster and debrid accounts, the Packagizer and link filter rules, the archive passwords, the download folder and the open download list, which lands in the collector without starting. A preview with a switch per item comes first, and whatever cannot come over is named with the reason. JDownloader's folder is only read. See Moving over from JDownloader.
Languages	42, each fetched only when chosen, right-to-left included.