01Two different things
On one side is DepotDownloader — the official, open-source tool maintained by SteamRE (the SteamKit2 / SteamDB-adjacent community). It's the one this whole site documents. On the other is DepotDownloaderMod, which isn't a single project but a family of independent forks — you'll see names ending in "Mod", "-RE", "DumpKey", and others, published by a scattering of separate accounts. They share the upstream's code and name, then bolt on extra capabilities. Because the names are so close, people land on a fork without realizing it's not the official tool — which is exactly why this page exists.
02The official tool's boundary
The official DepotDownloader has a hard, deliberate boundary: it only downloads content your Steam account is licensed for. You log in with your own account; Steam issues the manifest request codes and depot keys for the games you own; the tool fetches those. Try to download something you don't own and Steam simply won't hand over the keys — the tool reports that the depot isn't available to your account (see depot-key-denied). That ownership gate isn't a limitation the developers forgot to remove; it's the thing that keeps the tool legitimate — a way to access your games' older versions, not a way around paying for games.
03What the forks add
The "Mod" forks exist to remove that boundary. At a high level, they add the ability to feed the tool externally-supplied depot keys and offline manifest files — data that would normally come from Steam only for games you own. With those supplied from outside, the fork can download content the logged-in account has no license for. This is the capability the whole fork family is built around, and it's why they cluster near piracy-distribution ecosystems (the same circles that pass around key lists and manifest files for exactly this purpose). I won't pretend that's anything other than what it is, and this page won't walk through how any of it works — the point here is identification and informed choice, not a how-to.
04The line they cross
Downloading the files of a game you haven't bought is piracy, full stop — copyright infringement, against Steam's terms, and in many places a civil or criminal matter. The official tool stays on the legal side of that line precisely because it can't do it. The forks are designed to cross it. Everything else about them — the convenience, the GUIs built on top, the active development — sits on top of that single fact. Whatever your view of game preservation or abandonware, supplying a key for a title you don't own to pull its files is not the "downgrade a game you bought" use case the rest of this site is about; it's a different activity with different consequences, and you should go into it (or not) clear-eyed about which one it is.
05The extra safety risk
Set the legality aside for a moment, because there's a second, independent problem: a random fork is a worse safety bet than the audited upstream. The official DepotDownloader's appeal is that it's open, reviewed, and from a known, reputable group — you can read exactly what it does. A fork from an anonymous account inherits the name and the trust by association, but none of the guarantees:
- No assurance the published binary matches the published source, or that the source is unmodified upstream.
- A natural cover for bundled payloads — a tool people already expect their antivirus to flag (see false positives) is the perfect place to hide a real one, because users are primed to dismiss the warning.
- Ties to distribution ecosystems whose incentives don't include your security.
So even someone who's made peace with the legal side is trusting an unknown party's executable with their machine and their Steam login. "It has more features" is not worth "I have no idea what this specific build actually does."
06Telling them apart
If you want the legitimate tool, getting it is the whole solution — the boundary problem and the trust problem both vanish when you take the real one from where it's actually published:
- Official source: SteamRE's GitHub releases, or
winget install --exact --id SteamRE.DepotDownloader, or Homebrew (brew tap steamre/tools). The publisher is SteamRE; the package and repo say so. Our download page points only to these. - If the name has extra words — "Mod", "DumpKey", "-RE", or it's published by an account you don't recognize — it's a fork, not the upstream. That doesn't make it automatically dangerous, but it does mean none of the official tool's guarantees apply, and if it advertises downloading games "without owning them," you now know exactly what that means.
The bottom line is simple. The official DepotDownloader downloads your games and requires you to own them — that's a feature. The forks that remove that requirement trade a legal boundary and an audited codebase for the ability to pirate, and ask you to run unknown code to do it. For the use cases this site exists for — old versions, dedicated servers, mods, preservation of games you actually own — the official tool is not just the safer choice; it's the only one you need, and it's the only one I'll point you at.