Stash Spotify + YouTube Music Downloader APK [0.9.83] Jul 2026

Stash is an open-source Android app that connects to your existing Spotify and YouTube Music accounts and presents their libraries, liked songs, playlists, and mixes in a single unified interface on the phone, and allows you to download music and playlists for offline playback in FLAC format.

The app gives you the freedom to choose whether to stream tracks through an index or make them available offline by downloading music to your phone, depending on the source app's own access rules for that content.

How Stash APK works on Android

Stash does not run its own servers, host media, or require a Stash account. It authenticates directly against a user's Spotify and YouTube Music accounts and stores session credentials locally, encrypted with AES-256-GCM via Google's Tink library. The only outbound network requests the app makes are to Spotify and YouTube's own services.

The app operates in two modes per source, set individually for each playlist or mix a user selects:

• Offline mode: The track is retrieved once and stored on-device for playback without a network connection.
• Streaming index mode: Stash keeps a lightweight reference to the track (metadata plus a resolvable identifier) and streams it on demand, without persisting the audio file locally.

You can switch a playlist between these modes at any time, and the two modes aren't mutually exclusive across a library; someone could keep one playlist offline while everything else stays index-only.

Because Stash pulls from two catalogs that don't share identifiers, it runs a matching step to reconcile a track on one service with its counterpart on the other. This matching is heuristic, based on title, artist, album, and duration, rather than guaranteed by a shared database, which is why the app ships a manual correction path (the "wrong match" flag) rather than treating matches as final.

Core features of Stash Spotify Downloader

• Unified library: liked songs, playlists, daily mixes, and other synced mixes from both Spotify and YouTube Music in one view
• Track matching: matches a track from one service to its equivalent on the other, with a manual re-match option (a "wrong match" flag on the Now Playing screen queues a re-search)
• Optional Last.fm scrobbling: off by default
• Bidirectional sync: when enabled, tracks liked or played in Stash are reflected back to the user's Spotify and YouTube accounts
• Audio tools: 5-band equalizer with presets, bass boost, virtualizer, crossfader, and normalizer
• Synced lyrics: pulled from LRCLIB and scrolled in time with playback

Good to know before installing

This app is distributed outside Google Play, so Android will show an "unknown sources" warning before installation. That's standard behavior for any sideloaded APK, not specific to this app's risk level.

How to Install Stash on Android

Pros and cons

Privacy and architecture notes

• No Stash-run backend or account system
• No analytics or third-party crash reporting
• No ads
• Credentials stored on-device only, encrypted
• Codebase is fully open source under GPL-3.0

Because there's no Stash backend, there's also nowhere for the project to have a data breach on the server side, the attack surface is limited to the device itself. Session tokens for Spotify and YouTube Music are encrypted at rest with AES-256-GCM via Tink, which handles key management and nonce generation rather than leaving that to hand-rolled crypto. The GPL-3.0 license means any fork or redistribution of the code has to remain open source, which is a meaningful constraint on how the project could be commercialized or closed off later.

The bidirectional sync feature is worth flagging on its own. Because likes and plays in Stash write back to the linked Spotify and YouTube accounts, those accounts' native recommendation systems and listening history will reflect activity that happened inside Stash, not just inside the official apps.

System requirements and permissions

Beyond the Android 8.0 (API 26) minimum listed above, an app with this feature set would typically need to request:

• Storage access: to write downloaded tracks and cached lyrics to the device
• Network access: to reach Spotify and YouTube's APIs
• Foreground service permission: to keep audio playing when the app isn't in the foreground
• Notification access: for the standard media playback controls on the lock screen and notification shade

The exact permission list isn't fully provided by the developer. If you are planning to install the app, then you should look at the actual permissions prompt on install rather than assume the list above is complete or exact.

Possible limitations

• Matching isn't guaranteed: the heuristic matching between Spotify and YouTube Music catalogs (by title, artist, album, duration) won't always land on the correct version of a track, particularly for live recordings, remixes, or tracks with multiple releases. The manual "wrong match" flag exists specifically because this isn't solved perfectly.
• Catalog gaps: a track, playlist, or mix that exists on one service may not have an equivalent on the other, which limits what can be mirrored regardless of matching quality.
• No iOS version: Stash is Android-only based on what's described here; nothing indicates a parallel iOS build.
• Dependent on external APIs: because Stash has no backend of its own, its functionality depends entirely on Spotify and YouTube Music's own APIs staying accessible in their current form. A change on either platform's end (rate limits, authentication flow, API deprecation) could affect Stash's reliability without any action from the Stash developer.
• Not officially supported: Spotify and YouTube Music have no relationship with Stash and provide no guarantees about compatibility going forward.

Project status

Maintainer: Stash is maintained by a single named developer, Rawnald Clark.

Why it's worth checking: Stash's functionality depends on keeping pace with changes to Spotify and YouTube's APIs. For a project like that, maintenance activity is a reasonable thing to check before relying on it.

How it compares to similar tools

The category: Stash sits in a broader space of unofficial, open-source clients built on top of major streaming platforms' APIs, projects focused on offline access, ad removal, or alternate UIs for Spotify or YouTube Music individually.

What sets it apart: Most tools in this category work against a single platform. Stash's distinguishing choice is unifying two separate services into one library.

On privacy: Its no-account, no-backend, on-device-encryption approach is also more conservative than some tools in this space, which sometimes rely on a hosted backend or a third-party API proxy.

One caveat: This isn't an endorsement or a ranking. Evaluating any specific alternative would need the same scrutiny applied here: what data it touches, what permissions it needs, and how it holds up against the terms of the platforms it connects to.

What Stash does, functionally: Stash downloads and mirrors content from Spotify and YouTube Music outside those platforms' own apps. That's true regardless of how the app is built, licensed, or monetized.

Why that matters: Spotify's and YouTube's terms generally prohibit extracting, downloading, or redistributing streamed content through anything other than their own official clients. That restriction applies whether or not a third-party tool charges money, shows ads, or collects data; it's about the activity, not the business model behind it.

What doesn't change that: Being non-commercial, open source, and privacy-respecting doesn't change whether the underlying activity is authorized by the platforms Stash depends on. Those are two separate questions: one is about how well the app is built and how it handles user data, the other is about whether its core function is permitted at all.

Why this is worth separating out: The privacy and architecture choices described above are real and verifiable in the code. But anyone evaluating the codebase, considering running it, or writing about it should keep that distinction in mind rather than treating good engineering as the same thing as permission.