vidpickr

Glossary · protocol

What is BotGuard?

BotGuard is the obfuscated JavaScript anti-bot system YouTube's web player executes in every viewer's browser. It fingerprints the environment, produces a signed PoToken proving the request is from a real player, and rate-limits suspicious patterns. Operates entirely client-side — no separate server check.

Also called:bot guard · youtube botguard · anti-bot

BotGuard is the core of YouTube's 2024-onwards anti-bot defense. The JS is downloaded as part of the player bundle, obfuscated with aggressive control-flow flattening and dead-code injection. When it runs, it samples dozens of signals: user agent, screen resolution, WebGL renderer, canvas fingerprint, timing of user interactions, audio context characteristics, the order of API calls during page load.

These signals are combined into a signed token (PoToken) that YouTube's servers validate. A genuine browser session produces a token YouTube accepts; a headless browser missing some signals produces a token that gets rejected. Rejections silently downgrade the user to lower-resolution-only formats — the player still works, just at 480p.

For downloaders: bypassing BotGuard isn't a one-time crack. The signaling shape changes every few weeks. The viable approaches are to execute BotGuard rather than imitate its output (run a real or headless browser), or to piggyback on a cookie session that has already produced valid tokens (the route our backend uses).

Common questions

Does BotGuard affect regular YouTube users?
No — it runs invisibly on every page load. Regular users never see it because the JS executes cleanly and the resulting PoToken validates. The friction only appears when something interferes with the JS (broken ad-blocker rules, weird browser environment, headless scrapers).

Related terms

PoToken (Player Token)

PoToken is a signed token YouTube's player generates in the browser as proof that the request comes from a real player session, not a scraper.

Signed URL

A signed URL is a download link with cryptographic parameters that authenticate the request and expire after a set time.

IP fingerprinting

IP fingerprinting is the practice of evaluating an IP address against its history, ASN, country, type (residential vs datacenter), and behavioral patterns to decide how to treat requests.

VidPickr is a free, browser-based YouTube downloader. Every term in this glossary either describes how YouTube delivers video or why your downloads behave the way they do. Try the downloader →