Building a Browser-Based NCM File Converter (NetEase Cloud Music to FLAC/MP3)

#opensource #tutorial #javascript #webdev

What is NCM?

NCM (.ncm) is a proprietary encrypted audio format used by NetEase Cloud Music (网易云音乐), one of the largest music streaming platforms in China. Files downloaded for offline use are stored in this format and can't be played by standard music players like VLC or foobar2000.

I wanted to convert my NCM files to standard FLAC/MP3 without installing any desktop software, so I built a tool that does it entirely in the browser.

The Tool

NCM Converter — a free, open-source web app that converts .ncm files to FLAC or MP3 with album art.

Key features:

Runs 100% in the browser — no files are uploaded to any server
Preserves original audio quality (lossless FLAC or MP3)
Automatically embeds high-resolution album cover art
Supports batch conversion with drag & drop
Works on desktop and mobile

Try it here: https://ncm.nr2bj.com/

How It Works

The conversion process has 4 steps:

1. Read the NCM Container

NCM files are essentially encrypted containers. The file starts with a magic header (CTENFDAM), followed by an AES-encrypted key and metadata.

2. Decrypt with AES

The tool decrypts the file using the AES algorithm in ECB mode. First it decrypts the RC4 key, then uses that key to decrypt the actual audio stream.

// AES decryption of the key material
const keyData = new Uint8Array(await crypto.subtle.decrypt(
    { name: "AES-ECB" },
    coreKey,
    encryptedKey
));

All of this runs client-side using the Web Crypto API — nothing leaves your browser.

3. Extract Audio

After decryption, the raw audio data is either FLAC or MP3 format. The tool detects the format by checking the file signature (fLaC for FLAC, ID3 or sync bits for MP3).

4. Embed Metadata

The tool fetches album artwork from the NetEase API and embeds it along with title, artist, and album info directly into the output file using proper FLAC metadata blocks or ID3v2 tags.

Privacy

Since everything runs in the browser using JavaScript, your music files never leave your device. There's no backend server processing — it's purely client-side decryption and conversion.