ClipSave

Transparency

Nothing to hide. Everything to check.

Android will warn you before installing ClipSave. Here is exactly why, and how to confirm it is safe without taking my word for it.

View the sourceBuild logs Security policy

The warnings

What you'll see, and what to tap.

Chrome

“File might be harmful”

Shown for every .apk downloaded from a website. It is a blanket warning, not the result of scanning ClipSave.

TapDownload anyway

Play Protect

“Unsafe app blocked”

Shown for apps Google hasn't seen on Play, and for apps that update the code they run. ClipSave updates yt-dlp so sites keep working.

TapMore detailsInstall anyway

Why it is safe

Six things you can check for yourself.

  1. 01

    Public code

    The whole app, from the UI to the update checker and build scripts, is on GitHub under GPL-3.0.

  2. 02

    Built in the open

    Merging to main runs the public Release workflow, which builds and publishes the APKs. Every build log is visible.

  3. 03

    Checked on every change

    Unit tests, lint and CodeQL code scanning run on every pull request before anything is released.

  4. 04

    One signing key

    Every release is signed with the same key, so Android refuses an update signed by anyone else.

  5. 05

    No tracking

    No analytics, ad libraries or crash reporters. The app only talks to the sites you choose and to GitHub.

  6. 06

    No hosted content

    ClipSave is a tool with no catalogue, and the developer hosts no media. Save only what you have the right to.

Verify it

Three steps, two commands.

  1. 01

    Get the files

    Download the APK and SHA256SUMS.txt from the latest release.

  2. 02

    Check the checksum

    sha256sum ClipSave-*.apk

    The value must match the line for your file in SHA256SUMS.txt.

  3. 03

    Check the signature

    apksigner verify --print-certs ClipSave-*.apk

    The certificate SHA-256 digest must match the one below.

Signing certificate SHA-256

9e7ac24db911b702528987fc9d181ef06947123de56d8b26cb8b88b48f63aa59

Or build it yourself

If either check fails, don't install the file.

Why not Google Play?

Play doesn't allow apps that download from sites like YouTube, or that fetch code outside Play. Publishing there would mean removing what makes ClipSave useful.

So it ships on GitHub Releases, and works with Obtainium for automatic updates.

Found something?