Is DepotDownloader safe?

01The short answer

Yes — if you download it from the official SteamRE repository, it's about as trustworthy as third-party software gets. Open source under GPL-2.0, public development history going back to 2013, maintained by the most credible reverse-engineering crew in the Steam ecosystem, credentials go to Valve's servers and nowhere else. I've read the authentication code myself; the receipts are below.

The honest version of the answer has two asterisks, though: the terms-of-service situation is grey rather than green, and there's a thriving cottage industry of malicious clones riding on the name. Both get their own sections.

If you landed here because your antivirus flagged DepotDownloader.exe or you're not sure the file on your disk is genuine, that specific question — false positives, verifying with VirusTotal, and getting the real one — has its own page: is DepotDownloader.exe a virus?

02Who actually makes this

DepotDownloader is a SteamRE project — the same group that builds SteamKit2, the .NET library that re-implements Steam's network protocol. If you've ever used SteamDB or ArchiSteamFarm, you've used software built on their work. The top contributors are people with long public track records: xPaw (who runs SteamDB), azuisleet, psychonic, yaakov-h. These aren't anonymous; their reputations are the collateral.

Why that matters practically: the repo has been public for over twelve years, has thousands of watchers, and every commit is visible. Hiding a credential stealer in a codebase that the Steam datamining community reads for fun is not a realistic attack. The realistic attack is getting you to download a different program with the same name — hold that thought for section 07.

03Where your password goes

This is the question people actually mean when they ask if it's safe — someone even opened a GitHub issue titled exactly that. The flow, from the source: your credentials go into SteamKit2's logon call, which speaks Steam's own protocol over an encrypted connection to Valve's servers. The same handshake the official client performs. There is no middle server, no telemetry, no analytics endpoint — the project doesn't even have infrastructure to send anything to.

And if typing a password into a terminal still feels wrong (a healthy instinct), you never have to:

QR login mirrors what the Steam mobile app does: you approve the session on your phone, the terminal never sees the password at all. It's what I use on any machine I don't fully control. And anonymous mode — free games, demos, most dedicated servers — involves no account whatsoever. All four login methods are documented side by side in the authentication reference.

04What's stored on your disk

Use -remember-password (so you don't re-enter Steam Guard codes every run) and DepotDownloader writes a small config through .NET's isolated storage. I went through the class that defines it, and it contains exactly three things: login tokens (refresh tokens, not passwords), Steam Guard data, and a cache of which content servers have been slow. Your password is used once for the handshake and never written anywhere.

Two properties of those tokens worth knowing. They're revocable — log out of all devices in your Steam account settings (or change your password) and every stored token dies instantly. And they're machine-local — but they are bearer tokens, so treat the machine accordingly: I wouldn't use -remember-password on a shared computer, the same way I wouldn't stay logged into Steam on one.

05The VAC question

Short version: downloading depots cannot VAC-ban you. VAC looks at what's loaded alongside a game process on a VAC-secured server. DepotDownloader never touches a game process — it's a downloader; the game isn't even running. It also doesn't modify your Steam client, inject into anything, or alter your account state beyond a normal login event.

The place VAC does enter the picture is what you do afterwards. Downgraded to an old build and joined a VAC-secured server with mismatched files? Expect to be kicked, and you're in territory where I'd simply say don't. Old builds are for offline play, mods, private servers and research. That's a risk of the downgrading activity, not of the tool — the same applies if you downgrade via the Steam console.

06The terms-of-service question

Here's the part most "is it safe" threads dance around, so let me not. Steam's Subscriber Agreement is written broadly enough that Valve could frown on third-party clients accessing content servers. I won't tell you it's explicitly blessed, because it isn't.

What I can tell you is the observable track record: the tool has operated in the open for over a decade, the SteamDB ecosystem around it is one of the most public projects in the Steam community, Valve engineers are demonstrably aware these tools exist — and the enforcement count, as far as anyone has ever documented, is zero. When Valve decided it didn't like mass manifest downloads, its response wasn't bans; it was an engineering change (manifest request codes) that simply made the servers say no. That's the pattern: Valve enforces at the protocol level, not against user accounts. It only downloads what your account is licensed for, so there's no piracy angle to punish either. My read after years of using it: the practical account risk is negligible. Your call, made with open eyes.

07The risks that ARE real

I'd be doing you a disservice if this page were pure reassurance. The genuine dangers, ranked by how often I see people hit them:

• Fake DepotDownloaders. The name is well-known bait. There are repackaged "DepotDownloader.exe" uploads on file hosts, YouTube-comment links, and Discord attachments that are straight malware. The only download source is github.com/SteamRE/DepotDownloader — releases page, winget, or the official Homebrew tap. Nothing else. Ever.
• Forks that bypass ownership. Modified builds exist that pull content using shared depot keys you don't own. Beyond being piracy, they require trusting an anonymous fork author with your traffic — and they're exactly where malicious code hides, because their users can't exactly file consumer complaints. The ecosystem page's fork section covers where the legitimate boundary runs — and names the one you'll meet most often.
• Bearer tokens on shared machines. Covered in section 04 — -remember-password on a computer that isn't yours is the one genuinely careless thing you can do with this tool.
• Old builds with old bugs. A version from 2015 contains every security hole patched since 2015. For a single-player game, who cares; for something that opens network ports, maybe care.

08My safety checklist

1. Download only from the SteamRE GitHub (or winget / the official brew tap, which point there). Check the URL character by character if you followed a link from anywhere social.
2. Prefer -qr login on any machine you don't fully trust — no password ever enters the terminal.
3. Skip -remember-password on shared computers. On your own machine it's fine and convenient.
4. Use anonymous mode when you can. Dedicated servers and free content need no account at all — most server admins never log in once.
5. Keep old builds away from VAC-secured servers. Offline, mods, private servers: all good.
6. If anything ever feels off, revoke sessions in Steam → Account Security → "Deauthorize all devices". Every stored token dies on the spot.

Still have a question this page didn't answer? The FAQ covers the quick ones, and the GitHub discussions are where the maintainers themselves answer the hard ones.