Optional · runs on your machine
Pro Mode
Pull any timestamp from a YouTube URL at the video's true source resolution, by running a small companion server locally. 4K in, 4K out.
npm run server and this page will unlock automatically. No refresh needed.Extract a frame
Setup
You need Node 18+, ffmpeg and yt-dlp.
1. Install the tools
# macOS
brew install ffmpeg yt-dlp
# Debian / Ubuntu
sudo apt install ffmpeg
pipx install yt-dlp
# Windows
winget install Gyan.FFmpeg yt-dlp.yt-dlp2. Start the server
npm run serverIt prints which tools it found and listens on 127.0.0.1:8477:
floi Pro Mode
Listening on http://127.0.0.1:8477 (loopback only)
yt-dlp : v2026.07.04
ffmpeg : v8.1.23. Come back to this page
The site probes for the server automatically and unlocks the panel above the moment it answers.
How it works
yt-dlpresolves a direct media URL for the video, walking a fallback chain of format selectors so it works on videos without a progressive MP4 stream.ffmpegseeks to your timestamp and decodes exactly one frame.- The image is streamed back to your browser and the temporary file is deleted.
Security
This server is written to be safe to leave running:
- Loopback only. Bound to
127.0.0.1, never0.0.0.0, so it is unreachable from your network. - No shell. Subprocesses are spawned with argument arrays, so no input is ever parsed as a shell command.
- Strict input validation. The video ID must match YouTube's exact 11-character grammar; the timestamp must be a finite number in range. Everything else is rejected before any process starts.
- Origin allowlisting and hard timeouts on every child process.
- Zero dependencies. Node built-ins only, so there is nothing from npm in its supply chain.
Configuration
| Variable | Purpose |
|---|---|
PORT | Listen port (default 8477) |
YT_DLP_PATH | Explicit path to the yt-dlp binary |
FLOI_ORIGIN | Extra browser origin to allow (MEDIAGRAB_ORIGIN and FRAMEGRAB_ORIGIN still work) |
Rights
Pro Mode downloads video data to produce a frame. Only use it on content you own or are otherwise entitled to use, and respect YouTube's Terms of Service.
Frequently asked questions
Why can the website not do this on its own?
Extracting an arbitrary timestamp requires reading the actual video stream. YouTube's media servers send no CORS headers, so a browser is not permitted to fetch them, and the player runs in a cross-origin iframe whose pixels a page cannot read. The only way through is a process outside the browser. That is exactly what this server is.
Is it safe to run?
It binds to 127.0.0.1 only, so nothing on your network can reach it. It spawns subprocesses with argument arrays rather than shell strings, so no input can be interpreted as a command, and it rejects anything that is not exactly an 11-character YouTube ID. Every child process has a hard timeout. It has zero npm dependencies, only Node built-ins.
Does my data go anywhere?
No. The browser talks to 127.0.0.1; yt-dlp talks to YouTube exactly as it would from your terminal. Nothing passes through any third party.
Why is the first extraction slow?
If you are using the bundled standalone yt-dlp binary, it is a PyInstaller bundle that unpacks itself on every run, which takes around 15 seconds before it does any work. Installing yt-dlp properly (brew install yt-dlp or pipx install yt-dlp) makes it near-instant.