What it does

Collector	Links are analysed and staged before anything downloads: name, size, availability, which backend will take them. Nothing is ever dropped in silence, and a link that no backend handles is still shown, with the reason on it.
Rules	A Packagizer and a link filter, one engine used twice: match on filename, URL, hoster, source, type or size, then set the package, folder, filename, priority or comment, or refuse the link, with the rule's name attached. A test box shows what a rule would do before it does it.
Download list	A real table: choose your columns, resize and reorder them, sort by any of them, fold packages away. The layout is remembered per instance, and sorting is a view: the queue keeps its own order.
Crawling	Paste a page and each file it links to is staged as its own task.
Containers	.txt link lists are read here. .dlc, .ccf and .rsdf are handed to the JDownloader backend, which holds the key that opens them. Their contents then come back through the ordinary path, so the filter and the Packagizer apply to them like anything else.
Queue	Global and per-host concurrency, priorities, manual order, a stop mark, automatic retries with a growing delay, and a timetable that pauses or throttles by the clock.
Backends	Debrid services, your hoster logins through the built-in JDownloader, yt-dlp, torrents and the direct download, asked in an order you arrange by dragging. A hoster can have its own rule for which backend to ask first and which never to use, and a single download can be pinned to one. With Allow free downloads off, a link that nothing but a free download could fetch waits for an account instead of starting, for every link or per category. When all that is left to fetch of a page is the page itself, or the scripts, styles and images JDownloader finds on it, the download stops there and says that no backend can read the page's video player.
Speed limit	A total for everything, applied while downloads run rather than only to the next one.
Duplicates	The same URL twice is refused; the same file under two URLs is recognised as a mirror and handled by a policy you pick. Refused links are held with their reason, not deleted.
Extraction	zip, rar (incl. multi-volume), 7z, tar, gz, bz2, xz, zst. A multi-part set waits for every part. Encrypted zip (WinZip AES and the legacy ZipCrypto), rar and 7z take passwords, tried from a list in order. Pure Go, with no external unrar or 7z binary in the image.
Integrity	A finished file is checked against an .sfv/.md5/.sha* that came with it, or a CRC in its own name. Nothing is marked as passing that was not checked.
Collisions	What happens when the file already exists is your choice (overwrite, skip or number it), and the name is reserved atomically, so two downloads finishing together cannot pick the same one.
Connections	Several outbound routes with order, credentials and a per-host filter, handed out round-robin up to a cap each. Passwords are stored, never served back.
Reconnect	Get a new address when a hoster's limit is keyed to the one you have: run a command, replay a recorded HTTP exchange, ask the gateway over UPnP (which needs no router details at all), or run a script through a named interpreter. A recorded LiveHeader script imports as it is. An unchanged address counts as a failure.
Programs on events	Start a program of yours when a download finishes or fails, a package is complete or an archive has been unpacked, set up on the Automation page. It runs without a shell, so a file name with $(...) or ; in it stays a file name. It gets the event as placeholders in its arguments and as KL_EVENT, KL_TASK_ID, KL_NAME, KL_FILE, KL_FOLDER, KL_PACKAGE, KL_CATEGORY and KL_EXTRACT_OK in its environment, and each row has a time limit and a limit on how many runs go at once. The exit code and the output go into the log.
Stays awake	The desktop app keeps the computer from going to sleep while a download is running and while its files are checked, unpacked or moved, and lets it sleep again once nothing is left to do. The screen can still turn off.
Torrents	Magnet links and uploaded .torrent files are a resolver like any other, so they land in the same collector, the same queue and the same folder rules. They need no account and no setup. The Torrents page has a file selection that skips samples, .nfo and .exe files, and a category can have its own. Extra trackers help a torrent find peers, and one that announces to a banned tracker is rejected (see Torrents).
Torrents through debrid	TorBox, Real-Debrid, AllDebrid, Premiumize.me and Debrid-Link can fetch a torrent in place of the built-in torrent client, the way rdt-client does. The service downloads it to its own servers, and the files then come here over HTTP like any unlocked link, into a folder named after the torrent. A torrent the service already has is ready at once. Unless "Seed what the debrid service fetched" is on, nothing seeds from your machine and your address never appears in a swarm, so no port has to be open. While the service is still fetching, the row shows how far it has got. The priority order on the Accounts page decides whether a service or the built-in client goes first, and a pin on the task still wins. When a service declines a torrent, for example one too big for the plan, it goes to the next service or to the built-in client, and the task's log says why. The files picked in a .torrent's tree, or by the Torrents page's file selection when nobody picked them, are passed on to Real-Debrid and Debrid-Link; with the other services only those files are downloaded. A torrent from a private tracker never goes to a service, because its passkey would go with it. The built-in client fetches it instead. A .torrent says whether it is private, and a magnet link counts as private when its own tracker address carries a passkey. When a file fails or KnightLoader restarts, the task carries on with the service's copy and the files already here. Once every file is here, the torrent is deleted on the service unless Settings, Torrents says to keep it. A torrent the account already had is fetched from there instead of being added again, and it is never deleted. Premiumize.me does not say which torrents it holds and turns such a torrent down, so that one goes on to the next service or the built-in client. With "Send only cached torrents to the debrid service" on under Settings, Torrents, KnightLoader first asks the service whether it has the torrent cached, and one it has not goes on to the next service or the built-in client even though the service would take it. TorBox and Premiumize.me are asked directly. Real-Debrid, AllDebrid and Debrid-Link have no way to ask, so KnightLoader adds the torrent there and deletes it again unless the service has it finished within those few seconds: Real-Debrid has to report it downloaded once the files are chosen, AllDebrid has to report it Ready, and Debrid-Link has to have it at 100 percent. A check that fails or takes longer than 15 seconds counts as not cached. "Give up on a debrid service after" hands a torrent on when the service has made no progress on it for that many minutes, 10 unless you change it, counting the time it waits in the service's queue or reads the magnet link. The torrent is deleted there, it goes to the next service or the built-in client, and its row says why. This covers only the service's own download, not the files on their way here, and it never touches a download imported from the account or a torrent pinned to the service. 0 turns it off. "Seed what the debrid service fetched" hands a torrent to the built-in client or to an external qBittorrent once all its files are here, which helps with cross-seeding, and nothing is fetched for this. The built-in client seeds under the seeding targets. qBittorrent gets the torrent through its Web UI with the files where they are, so cross-seed or qui can find it there, and is told to skip its own check. It has to reach the files at the same path, or at the path set as "Download folder in qBittorrent" when the two containers mount the download folder differently. Every file has to be there at the size the torrent gives, and for a torrent added as a .torrent file every piece is checked as well, which a magnet link does not carry, so a magnet gets the size check only. A torrent that fails the check, or that qBittorrent does not take, is not seeded, and its row says why.
Captchas	A captcha from the JDownloader backend opens a window in the web interface: type the text, click the points, or solve the reCAPTCHA or hCaptcha there. The phone app answers all of these and a Cloudflare Turnstile as well. 2Captcha and Anti-Captcha can answer for you, in the order you set: pictures, reCAPTCHA v2, v3 and Enterprise, and Cloudflare Turnstile once JDownloader hands one out. Neither service takes hCaptcha any more, so that one stays with you. A captcha goes to the paid solvers once at most, a restart included, and one a solver took without answering goes to no other solver, since the first may bill it anyway. The window and the phone app's card say which solver is working on it and why one declined. With Only when nobody is watching switched on, the solvers wait while KnightLoader is open in the foreground in a browser tab, the desktop app or the phone app, or another app keeps reading its captcha list, and take over once you switch away or a wait you set runs out. They wait only for a captcha the one watching can answer: a Cloudflare Turnstile waits only for the phone app, which shows it under the hoster's address, since a browser tab cannot. When a widget captcha will not load in the window or the phone app, that one stops holding them back until Refresh loads it after all. A solver that has already started keeps working, and whichever answer arrives first counts.
Usenet	An .nzb goes to your TorBox or Premiumize.me account, which fetches it from Usenet and unpacks it. The files it hands back download like any other link. See Getting links in.
Sonarr and Radarr	qBittorrent's API for torrents and SABnzbd's for link lists and .nzb files, off until you switch them on. A grab through either is filed in the category of the same name, which is created with its own folder inside the download folder the first time it is used.
Intake	Paste, drop, Click'n'Load from a site's own button, a container file, a watched folder for link lists, .torrent files, containers and .nzb files, Sonarr and Radarr, which see KnightLoader as qBittorrent or SABnzbd, or what you add on your debrid service's website.
Multi-instance	Register other KnightLoaders and drive them all from one dashboard. Instances on the same network announce themselves and take one click to add, with nothing to configure.
Twelve words	Read a phrase off one instance, type it into the next, and they find each other across networks without an account, a login, a port forward or a domain. The words carry a secret; the relay only ever sees a hash of it, so nobody running one can reconstruct them. Use ours or run your own. See Connecting instances and apps.
Your own relay	Don't want to use ours? Point both ends at a relay you run and the same twelve words work against it. It terminates its own TLS over TLS-ALPN-01, so it needs no proxy, certbot or cron, and only port 443 open.
Everywhere	The web UI, a desktop build, an Android app and a browser extension all talk to the same instance, and to each other's.
Access	An optional password lock, off by default. Named API tokens, each limited to the rights it needs: read, add, control or admin. See API tokens and their rights. Same-origin API, origin-checked WebSocket.
Languages	42, each fetched only when chosen, right-to-left included.