vidpickr

Glossary · protocol

What is PoToken (Player Token)?

PoToken is a signed token YouTube's player generates in the browser as proof that the request comes from a real player session, not a scraper. It's produced by BotGuard (YouTube's obfuscated anti-bot JS) and required for high-resolution playback (1080p+) since 2024. Headless downloaders that can't produce a valid PoToken are capped at 480p.

Also called:pot · player token · po token

Before PoToken, YouTube's anti-bot was largely about URL signatures and IP rate limits. PoToken added a player-identity requirement: every high-resolution request now needs a pot query parameter, an HMAC-equivalent signed by BotGuard, validated server-side. Requests without it can still play but only at lower resolutions.

PoToken makes scraping harder for two reasons. First, BotGuard executes inside a real browser environment that fingerprints the page (UA, screen size, canvas rendering, timing) — a headless extractor without these signals produces detectably-wrong tokens. Second, the BotGuard JS is heavily obfuscated and updated frequently; even successful reverse-engineering ages out within weeks.

The two viable downloader architectures around PoToken: run the user's own browser (where BotGuard generates tokens naturally), or maintain a real-browser cookie session on the backend that ships PoTokens with the cookie. VidPickr uses the second — our server maintains a cookie file refreshed from a real browser, so the extraction includes valid PoTokens and unlocks 1080p+ formats.

Common questions

Why are some YouTube downloaders capped at 480p?
They can't produce a valid PoToken. Without it, YouTube's player API refuses to serve 1080p+ URLs. Tools that work at higher resolutions either run in a real browser (where BotGuard generates tokens) or maintain a logged-in cookie session that produces them on the server side.
Can PoToken be spoofed?
Not durably. BotGuard's obfuscation evolves faster than reverse-engineering can keep up — every "we cracked it" announcement gets broken within a release cycle. The viable path is to actually execute BotGuard rather than try to spoof its output.

Related terms

Signed URL

A signed URL is a download link with cryptographic parameters that authenticate the request and expire after a set time.

BotGuard

BotGuard is the obfuscated JavaScript anti-bot system YouTube's web player executes in every viewer's browser.

IP fingerprinting

IP fingerprinting is the practice of evaluating an IP address against its history, ASN, country, type (residential vs datacenter), and behavioral patterns to decide how to treat requests.

VidPickr is a free, browser-based YouTube downloader. Every term in this glossary either describes how YouTube delivers video or why your downloads behave the way they do. Try the downloader →