Downloading full-size media from DeviantArt

a.md

For direct image URL, the image quality is much lower than the original upload (the resolution and size of the original upload can be found in the right sidebar). This is not the case few years ago when the original image was accessible through right click, but on 2017, Wix acquired DeviantArt, and has been migrating the images to their own image hosting system from the original DeviantArt system. They linked most of the direct images to a stripped-down version of the original images; hence the bad image quality. Below are the three different formats of direct image URLs I found:

• URL with /v1/fill inside: this means that the image went through Wix's encoding system and is modified to a specific size and quality. In this case, you remove ?token= and its values, add /intermediary in front of /f/ in the URL, and change the image settings right after /v1/fill/ to w_5100,h_5100,bl,q_100. The definitions of the values can be found in Wix's Image Service, but basically, w_5100,h_5100 requests the width and height of the image to be 5100x5100 pixels, bl requires the baseline JPEG version, and q_100 sets the quality to 100% of the original. The reasons to have this dimension are: (1) 5100 pixels is the limit of the system; anything above it will result in 400 Bad Request. (2) according to the Wix's API:

  In case the required image is larger than the original, upscale should be enabled (lg_1) in order for a proportional upscale to be applied. If upscale is not enabled, the returned image will maintain the original size.

  Example: original URL vs modified URL. The original url has a file size of 153 KB and 1024x1280 resolution, while the modified URL has a file size of 2.03 MB and 2190x2738 resolution. The result is still not as good as the original upload (4.2 MB and 2700×3375 resolution), but this is the closest I can get

  UPDATE: for new uploads, this trick no longer works. However, the image quality can still be changed. To do this, you keep everything in the image URL the same and change the part q_\d+,strp to q_100

• URL with /f/ but no /v1/fill inside: this is the original image, so just download it

• URL with https://img\d{2} or https://pre\d{2}: this means that the image went through DeviantArt's system and is modified to a specific size. I could not figure out how to get the original image from these types of links, i.e. find https://orig\d{2} from them, so I just download the image as is

thanks

still works 👍

Alas, doesn't work anymore.

After adding /intermediary you can delete /v1/fill/ and everything after.

Doesn't work
Original Link
Modified Link
And that /intermediary remove /v1/fill part too but still doesn't work you can try and see if it works for you!

It does work! thank you! an advice for op: dimensions actually depend on the image itself, so always check the "image details" section and "Image size" dimensions of your image! e.g. This image has dimensions 3500x1969px, so I should actually use w_3500,h_1969,bl,q_100. see Original image vs. Modified image

It does work! thank you! an advice for op: dimensions actually depend on the image itself, so always check the "image details" section and "Image size" dimensions of your image! e.g. This image has dimensions 3500x1969px, so I should actually use w_3500,h_1969,bl,q_100. see Original image vs. Modified image

Nah doesn't work, that's just an old upoad, does anyone know a way ?

If you decode the token from the URL query parameters as a JWT you'll see that wix puts limits on the width and height of the image that you can request there. Here is an example, I used jwt.io to decode:

{
  "sub": "urn:app:{REDACTED}",
  "iss": "urn:app:{REDACTED}",
  "obj": [
    [
      {
        "height": "<=929",
        "path": "/f/22c2914c-47e7-43cf-822f-4acb88beb10c/dfor7e8-7df1b9e0-8659-4954-bfd1-b9f847285e8d.jpg",
        "width": "<=1024"
      }
    ]
  ],
  "aud": [
    "urn:service:image.operations"
  ]
}

So the best quality you can get is bounded by what's specified in that JWT. Some tokens don't have these height/width restrictions, and the reasons why is not clear to me. These max resolution restrictions are mainly less than the original size of the image, but sometimes they are equal to the original image size.

If you click the "Free download" button for the image then you will be redirected to the ultimate URL with the token that doesn't have such restrictions, and that token expires in 10 minutes 10 seconds:

{
  "sub": "urn:app:{REDACTED}",
  "iss": "urn:app:{REDACTED}",
  "exp": 1675821802,
  "iat": 1675821192,
  "jti": "{REDACTED}",
  "obj": [
    [
      {
        "path": "/f/22c2914c-47e7-43cf-822f-4acb88beb10c/dfor7e8-7df1b9e0-8659-4954-bfd1-b9f847285e8d.jpg"
      }
    ]
  ],
  "aud": [
    "urn:service:file.download"
  ]
}

still works, you're the fucking goat

Disclaimer: attempts below were done by a friend of mine, I'm only documenting his attempt. I did not attempt to access anything I am not authorized to access.

As of May 31, 2023, this doesn't seem to be working for my friend's image. The premise of the test was the artist is a friend of mine and was concerned about this workaround, so a second friend was testing for him to check. I am guessing there is some impact as to whether the image has any "Free download" button at all. The image tested with this method does not have it. Here are steps tried, all of them resulted in "bad path", "forbidden", "storage: object doesn't exist", or invalid token errors. Also here's the original link:

https://images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com/f/lotofstuffhere.png/v1/fill/w_1280,h_854/somefilename.png?token=longtokenhere

Here's some of what was tried, not entirely exhaustive list:

1. (add intermediary) https://images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com/intermediary/f/lotofstuffhere.png/v1/fill/w_1280,h_854/somefilename.png?token=longtokenhere
2. (change to 5100 etc) https://images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com/intermediary/f/lotofstuffhere.png/v1/fill/w_5100,h_5100,bl,q_100/somefilename.png?token=longtokenhere
3. (removed bl,q_100) https://images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com/intermediary/f/lotofstuffhere.png/v1/fill/w_5100,h_5100/somefilename.png?token=longtokenhere
4. (using the listed actual original dimensions) https://images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com/intermediary/f/lotofstuffhere.png/v1/fill/w_3600,h_2400,bl,q_100/somefilename.png?token=longtokenhere
5. (no token) https://images-wixmp-ed30a86b8c4ca887773594c2.wixmp.com/intermediary/f/lotofstuffhere.png/v1/fill/w_3600,h_2400,bl,q_100/somefilename.png
6. Tried replacing the token with the one from a separate "Free download" image
7. Tried modifying the token from an image that did have a "Free download" button, since the token itself also lists the filename that it's for. However modifying the token to have the correct filename threw either forbidden or invalid token errors (as expected)

A lot of variations on the above were also tried. Nothing seemed to work. So this is either patched, it doesn't work for some images (the ones without a free download button?), or my friend missed something here when attempting all this.

Tested with an image from 2018. Works.

I was gonna request anyone to just create an extension that has the download button enabled as always (even if some artists disabled it for security purposes), but I found this outdated extension from Chrome Strats.
Source: https://chrome-stats.com/d/kdcokocnkphjbaelobcehjokdleflnmj/download
Archive: https://www.4shared.com/folder/IhZnDOdu/DeviantArt_Downloader_OUTDATED.html

If you decode the token from the URL query parameters as a JWT you'll see that wix puts limits on the width and height of the image that you can request there. Here is an example, I used jwt.io to decode...

Sadly if one tries to change the payload (remove the dimensions restrictions for instance) they encounter token validation failed, because the token contains a HMACSHA256 hash of the payload. Their system hashes the supplied payload with their private key and checks whether the hash supplied by the user equals the payload hash. Without knowing the private key, it's infeasible to come up with a valid hash for a modified payload.

Can anyone test if this still works? Curious to know if it's still applicable.

I tested all methods mentioned in the thread for a 2018 deviantart image but nothing worked. As a workaround, you could check if the artist posts their work elsewhere where the image quality is not filtered down. Not at all code related, but figured most people would be interested.

Work

URL with /f/ but no /v1/fill inside: this is the original image, so just download it

It says Unauthorized