Metrolist: ad-free YouTube Music for Android, with privacy caveats

By AiCoN | Published 24 October 2026 | Sources checked 24 October 2026

Metrolist is a free, open-source Android client for YouTube Music. Salman uses this project and likes its interface and recommendations. The source review below is separate from his experience: maintenance mode, login-session storage, backups and YouTube's terms all matter before you install.

Official publisher artwork hosted by its publisher. Official source. Independent guide, not affiliated or sponsored. Artwork and trademarks belong to their owners.

Official repository screenshot, not Salman's phone or an AiCoN test session. Publisher source.

What is Metrolist?

Metrolist streams from YouTube Music's own library and wraps it in a fast, clean, customizable player. The public project dates to 2023 and has its own website, Discord and Telegram communities.

• Free and open source (GPLv3). Full source code is public on GitHub.
• No ads, no subscription. Works with or without a Google account.
• Latest stable release v13.7.0 (7 September 2026), with nightly builds continuing.

One honest caveat up front: the project is in maintenance mode. The developers say the app is not dead, but they are only fixing bugs and making minor improvements while work on a rewrite continues. That statement is about the developers' maintenance plan, not a guarantee that every feature works on every phone.

Main features listed by the developers

• Developer-listed song and video playback from YouTube Music, in the background, with offline downloads and caching.
• Live synced lyrics, with optional AI-powered lyrics translation (you supply your own API key for OpenAI/Claude/OpenRouter and similar).
• Personalized quick picks and full search across songs, albums, artists, videos and playlists.
• Full library management: local playlists, playlist import, queue and playlist reordering.
• Optional YouTube Music account login to sync your songs, artists, albums and playlists.
• Equalizer, crossfade, audio normalization, tempo and pitch control, skip silence, sleep timer.
• Listen together with friends in real time; Last.fm scrobbling; optional Discord Rich Presence.
• Recognize music (Shazam-style), home-screen widget, light/dark/black/dynamic themes.
• Audio quality setting: Auto, Low or High. There is no lossless mode - all audio is YouTube Music's own stream, and Metrolist does not pretend otherwise.

What our own use says

Salman, who runs AiCoN, uses Metrolist himself and says it works, and that he likes its interface and recommendations. That is one person's experience on his phone, not a promise about every device. Separately from his experience, everything in the privacy, quality and install sections below comes from our own source-code review at the v13.7.0 release - it is not a hands-on security test of the app.

Sign-in and privacy: what we found in the code

• Sign-in is optional. The developers describe anonymous use; syncing a YouTube Music library needs an account. We did not test which features are available in every signed-out session.
• Google sign-in opens the real accounts.google.com page in an Android WebView (LoginScreen.kt), so your password and 2FA are entered on Google's page. The app reads the resulting YouTube Music cookie and its API calls go to music.youtube.com (InnerTube.kt).
• The session cookie has no app-level encryption. Metrolist stores it as plain text in its private app storage (PreferenceKeys.kt, key innerTubeCookie) with no app-level encryption of its own. Whatever protection it has comes from the phone's own storage encryption, where that is enabled, and from how Google handles backups. We checked two paths: the app's Android backup settings (AndroidManifest.xml allowBackup="true", and its backup rules exclude only downloaded media, not settings), and its own Backup/Restore feature, which exports the settings file including this cookie (BackupRestoreViewModel.kt). So the cookie is eligible to be included in Android cloud backup and device transfer where those are turned on, and the app's Backup feature includes the settings file that holds it, when a session is present - treat that file as sensitive. Our recommendation: use Metrolist without signing in unless you need library sync, or use a secondary Google account.
• The app also offers a manual "paste your cookie" login option. Never paste session cookies copied with help from random guides or tools; a stolen cookie is a stolen session.
• With features switched on, the app also contacts other services, each with its own privacy policy: lyrics providers (LRCLIB, KuGou and others), Last.fm, Discord, Shazam for song recognition, GitHub for update checks, and your chosen AI provider if you set up lyrics translation. The reviewed YouTube Music client uses the Google cookie. This source review is not an exhaustive data-flow or security audit.
• We inspected the public repository at the exact v13.7.0 release code. The APKs are built and signed by the project's CI (keystore held in GitHub secrets), but we did not find a published checksum or certificate fingerprint in the checked release listing, and we could not independently verify that the released APK matches this source byte-for-byte. Public source makes inspection possible, but it does not prove the distributed binary is safe.

Is it allowed? What YouTube's Terms say

YouTube's Terms of Service say you are not allowed to "access, reproduce, download... any part of the Service or any Content except (a) as expressly authorized by the Service; or (b) with prior written permission from YouTube" (youtube.com/t/terms, "Permissions and Restrictions"). Third-party clients like Metrolist are not expressly authorized, and the same document says violations can lead to Google terminating your account or access. We do not give a legal verdict. Anonymous use avoids handing the app a Google-account session, but does not remove service-terms or availability risks.

How to install (Android)

1. Official releases page: github.com/MetrolistGroup/Metrolist/releases - download Metrolist.apk (standard). Variants: Metrolist-with-Google-Cast.apk adds Chromecast support; Metrolist-izzy.apk is the IzzyOnDroid build.
2. Or install from the IzzyOnDroid F-Droid repository (package com.metrolist.music), which handles updates for you.
3. Android may require permission to install from that source. Verify the project and release first, grant only the needed permission, and turn it off afterward. Do not dismiss a Play Protect or other security warning as harmless; stop and investigate it.
4. Metrolist is not on the Play Store. Avoid copies from random APK sites.
5. The developers say YouTube Music must be available in your region. Our source review did not test regional playback; Salman's experience on his own phone is not a region-wide guarantee.

Limits to know

• Maintenance mode: bug fixes only, no new features for now (notice present in the README at the 7 September 2026 v13.7.0 release and still on the project's main README as of 24 October 2026; nightly bug-fix builds continued as of 21 October 2026).
• Third-party client: could break if YouTube changes its internals.
• Downloading does not grant permission to reuse or redistribute music.
• Session cookie stored without app-level encryption; phone-level protections are separate (see privacy section).

FAQ

Is Metrolist free? Yes. Free, open source, no ads. The developers accept donations.

Do I need a Google account? The developers offer anonymous use. YouTube Music library sync needs sign-in; we did not test every feature without an account.

Does it play lossless audio? No. It streams YouTube Music's standard audio (Auto/Low/High quality settings) and makes no lossless claim.

Is it safe? Public code and a Google-hosted sign-in page do not prove an APK is safe. The reviewed login cookie has no app-level encryption on the device, so prefer anonymous use. Install only from the official GitHub or IzzyOnDroid pages.

What about legal and account risk? Open-source licensing is not permission from YouTube to access or download its content. The app is independent of Google; read the service-terms caveat above. We give no legal clearance.

Sources (checked 24 October 2026)

• Official repo: github.com/MetrolistGroup/Metrolist
• Latest stable release v13.7.0 (7 September 2026): github.com/MetrolistGroup/Metrolist/releases
• Official website: metrolist.cc
• IzzyOnDroid listing: apt.izzysoft.de/fdroid/index/apk/com.metrolist.music
• YouTube Terms of Service: youtube.com/t/terms

Verification appendix (code evidence, v13.7.0 release commit 7c5ba3ad22cb562d337897f82163a2b7fce665f3)

All links pinned to the exact v13.7.0 release commit:

• Google sign-in via WebView to real accounts.google.com / music.youtube.com: https://github.com/MetrolistGroup/Metrolist/blob/7c5ba3ad22cb562d337897f82163a2b7fce665f3/app/src/main/kotlin/com/metrolist/music/ui/screens/LoginScreen.kt#L124 (cookie read), L336-L357 (page filter + login URL)
• Cookie stored unencrypted in Preferences DataStore: https://github.com/MetrolistGroup/Metrolist/blob/7c5ba3ad22cb562d337897f82163a2b7fce665f3/app/src/main/kotlin/com/metrolist/music/constants/PreferenceKeys.kt#L520 (no EncryptedSharedPreferences anywhere in the repo)
• Android backup config: manifest allowBackup="true" with both rule files attached - https://github.com/MetrolistGroup/Metrolist/blob/7c5ba3ad22cb562d337897f82163a2b7fce665f3/app/src/main/AndroidManifest.xml#L32-L37 - and both rule files exclude only media cache/downloads, not settings: https://github.com/MetrolistGroup/Metrolist/blob/7c5ba3ad22cb562d337897f82163a2b7fce665f3/app/src/main/res/xml/backup_rules.xml and https://github.com/MetrolistGroup/Metrolist/blob/7c5ba3ad22cb562d337897f82163a2b7fce665f3/app/src/main/res/xml/data_extraction_rules.xml
• Runtime backup code: the app's own Backup/Restore exports files/datastore/settings.preferences_pb (the file holding the cookie) into the backup zip: https://github.com/MetrolistGroup/Metrolist/blob/7c5ba3ad22cb562d337897f82163a2b7fce665f3/app/src/main/kotlin/com/metrolist/music/viewmodels/BackupRestoreViewModel.kt#L81-L90
• API-host code: https://github.com/MetrolistGroup/Metrolist/blob/7c5ba3ad22cb562d337897f82163a2b7fce665f3/innertube/src/main/kotlin/com/metrolist/innertube/InnerTube.kt
• Audio quality AUTO/LOW/HIGH, no lossless: https://github.com/MetrolistGroup/Metrolist/blob/7c5ba3ad22cb562d337897f82163a2b7fce665f3/app/src/main/kotlin/com/metrolist/music/constants/PreferenceKeys.kt#L107-L113
• CI-signed releases (ilharp/sign-android-release, keystore in repo secrets): https://github.com/MetrolistGroup/Metrolist/blob/7c5ba3ad22cb562d337897f82163a2b7fce665f3/.github/workflows/release.yml#L135-L144
• Manual cookie-paste login option: https://github.com/MetrolistGroup/Metrolist/blob/7c5ba3ad22cb562d337897f82163a2b7fce665f3/app/src/main/kotlin/com/metrolist/music/ui/screens/settings/AccountSettings.kt
• Maintenance mode notice: https://github.com/MetrolistGroup/Metrolist/blob/7c5ba3ad22cb562d337897f82163a2b7fce665f3/README.md#L33-L36 (present at the v13.7.0 release commit; still shown on the main-branch README as of 24 Oct 2026)

Source-based review on 24 October 2026. Release code pinned to v13.7.0 (7 September 2026); current README and release listing checked separately. No APK execution, sign-in, payment or independent security audit. Official screenshots are publisher examples.