LosslessCut is a desktop app for the most common video job there is: keeping the good parts of a long recording and throwing the rest away. Because it copies the original streams instead of re-encoding them, a cut that would take a video editor ten minutes to export takes seconds, and the result is bit-for-bit the same quality. It is a graphical front end for FFmpeg, built for GoPro, drone, phone and screen recordings that eat gigabytes.
Beyond trimming it merges segments or whole files with matching codecs, adds, removes or extracts audio and subtitle tracks, changes container (MKV to MP4, for example) without touching the picture, detects scenes, black frames and silence, and edits chapters, metadata and rotation. Segments can be imported and exported as CSV, EDL and chapter lists, and there is a command line and an experimental HTTP API for scripting.
The honest limit is the same one every lossless cutter has: without re-encoding, cuts snap to the nearest keyframe, so a cut may land a fraction of a second off where you clicked. It is the work of one developer since 2016, at about 45,000 stars and v3.70.1 when scanned, GPL-2.0, with free downloads on GitHub and paid store versions that fund the project.
- Repository: github.com/mifi/lossless-cut
- Licence: GPL-2.0 (GNU General Public License v2.0)
- Language: TypeScript. Stars: 45.3K. Forks: 2,279. Last push: Oct 25, 2026.
- Scan: safe, Oct 26, 2026, commit 138bc72
Who it is for
Anyone who records long videos and wants to cut them down fast without losing quality, from drone and action-camera owners to people trimming screen recordings, lectures or game captures.
Getting started
1. Download the build for your system: macOS DMG, Windows 7z, or Linux AppImage or tar
open https://github.com/mifi/lossless-cut/releases/latest2. Optional: start it with the experimental HTTP API, for controlling it from scripts
LosslessCut --http-apiThe GitHub downloads are free forever. Buying it from the Mac App Store or Microsoft Store, or installing from the Snap Store, supports the developer and gives you automatic updates. The README warns that the APPX and PKG files on the releases page do not work, and that Flathub and other package-manager builds are unofficial.
Safety scan
We cloned mifi/lossless-cut at commit 138bc72 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no committed binaries and no bare-IP URLs across 385 files and about 64,000 lines. The one pattern hit is a 3,105-character line in src/common/types.ts, which is simply the list of keyboard action names on one line.
- The only install hook is the standard electron-builder install-app-deps postinstall, which rebuilds native modules for Electron.
- The app's one call home is to api.github.com for the latest release; the other hosts the scanner lists are links in documentation and the website.
- The 70 known advisories (34 high, none critical) are mostly in build tooling in yarn.lock (brace-expansion, body-parser and similar) and in the website's yarn.lock. One high advisory concerns Electron itself, which ships inside the app; it is a certificate-mitigation fix that a routine Electron update clears.
- 5 workflows, none using pull_request_target; the 3 third-party actions are pinned to tags, not commits. Licence and contributing guide present; no security policy, Dependabot or CodeQL. OpenSSF Scorecard 3.7.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 1 pattern hit found and read; every one is listed under the raw findings. |
| Install-time code | 1 npm lifecycle script |
| Committed binaries | None. |
| CI workflows | 5 workflows. None use pull_request_target. 3 of 3 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, stackoverflow.com, losslesscut.app, superuser.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 70 advisories across 1,766 pinned packages: 0 critical, 34 high, 27 moderate, 9 low. website/yarn.lock: 601 packages, 8 advisories; yarn.lock: 1,348 packages, 66 advisories. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | 3.7 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (1)
| Where | Rule | Match |
|---|---|---|
| src/common/types.ts:5 | very-long-line | 3105 chars |
npm lifecycle scripts (1)
package.jsonpostinstall:electron-builder install-app-deps
Worst known vulnerabilities (24 of 70)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-xjj6-f33q-929c | high | undici@7.29.1 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
| GHSA-27r3-jxmh-p828 | high | body-parser@2.3.0 | body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@2.0.1 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@2.0.1 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@2.0.1 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@2.0.1 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-rgw5-rvv9-x895 | high | brace-expansion@2.0.1 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@5.0.6 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@5.0.6 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@5.0.6 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@5.0.6 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-rgw5-rvv9-x895 | high | brace-expansion@5.0.6 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-jr5w-w6x2-84p9 | high | electron@42.11.15 | Electron: Mitigation for compromised eMudhra intermediate certificates |
| GHSA-ch52-4w7c-c8xp | high | http-cache-semantics@4.2.0 | http-cache-semantics max-stale handling can disclose cross-user cached responses |
| GHSA-qjx8-664m-686j | high | js-cookie@2.2.1 | JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection |
| GHSA-23c5-xmqv-rm74 | high | minimatch@5.1.6 | minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
| GHSA-3ppc-4f35-3m26 | high | minimatch@5.1.6 | minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
| GHSA-7r86-cg39-jmmj | high | minimatch@5.1.6 | minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
| GHSA-23c5-xmqv-rm74 | high | minimatch@9.0.5 | minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions |
| GHSA-3ppc-4f35-3m26 | high | minimatch@9.0.5 | minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern |
| GHSA-7r86-cg39-jmmj | high | minimatch@9.0.5 | minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments |
| GHSA-2v37-7h3g-55p8 | high | nanoid@3.3.16 | nanoid: custom generators can loop indefinitely when size is zero |
| GHSA-28wg-ghj8-5hjv | high | nanoid@5.1.11 | nanoid: non-secure generators can loop indefinitely with negative size |
| GHSA-xjj6-f33q-929c | high | undici@6.29.0 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
By the numbers
| Stars | 45.3K |
|---|---|
| Forks | 2,279 |
| Contributors | 184 |
| Commits | 4,097 |
| Open issues | 157 |
| Open pull requests | 16 |
| Releases | 108 |
| Latest release | v3.70.1 |
| Licence | GPL-2.0 |
| Main language | TypeScript |
| Project age | 9 years |
| Last push | Oct 25, 2026 |
| Tracked files | 385 |
| Lines of code | 63.7K |
| Checkout size | 10 MB |
Lines by language: TypeScript 32.1K, JSON 27.4K, Markdown 1,917, CSS 1,550, YAML 577, JavaScript 81.
Questions
Is LosslessCut free?
Yes. LosslessCut is free and open source under GPL-2.0, and the downloads on GitHub will always be free. The Mac App Store and Microsoft Store versions are paid, and that is how the developer is supported; they add automatic updates but no extra features.
Why is my cut a little off from where I set it?
Lossless cutting copies the video without re-encoding it, so a cut can only start on a keyframe. LosslessCut snaps to the nearest one, which can be up to a few seconds away in footage with sparse keyframes. Its experimental smart cut re-encodes just the first few frames to get closer to the exact point.
What formats does LosslessCut open?
It plays MP4, MOV, WebM, Matroska, OGG and WAV natively, and FFmpeg underneath can open almost any other file. For formats the built-in player cannot show, it falls back to FFmpeg-assisted playback so you can still mark cuts, and the export keeps the original streams.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.