Every music player refuses the file — except exactly one app. That's the .ncm experience: NetEase Cloud Music hands you a song that behaves like it's corrupted everywhere else. It isn't corrupted, it's locked, and the lock is thinner than you'd expect. This is the container pulled apart: what's actually inside an NCM file, why opening it costs zero audio quality, and how to do it on any device without the file ever leaving your machine.

Unlock NCM files in your browser →

Decryption runs locally in JavaScript — MP3/FLAC out bit-for-bit, metadata and cover art kept.

NCM is a lock, not an audio format

The confusing part — and the key to everything — is that NCM is not an audio format. It's a container NetEase Cloud Music wraps downloaded songs in. Inside sits a completely ordinary music file: an MP3, a FLAC, sometimes an M4A. The wrapper never touches the audio; it only scrambles who's allowed to read it. That's why every attempt to "play" the file elsewhere fails so strangely — players hit a wall of encrypted bytes where they expect an MP3 header. The song isn't damaged; it's locked.

Inside the container

After a short magic header identifying the format, an NCM file carries four things:

  • Key material — the data needed to recover the file's AES key, itself hidden under a well-known obfuscation
  • Metadata as JSON — title, artist, album and the music IDs, stored as readable fields once decrypted
  • Cover art — the embedded album image, extracted alongside the audio
  • The audio payload — a standard, unmodified music stream: MP3s keep their ID3 tags, FLACs keep their lossless data

Why opening one is lossless by nature

Because the payload is never re-encoded, unlocking costs nothing: a 320 kbps MP3 comes out as the same 320 kbps MP3, and a lossless FLAC as the identical FLAC. Any tool that "converts" NCM files by decoding and re-encoding is damaging your music for no reason — the lock was never part of the audio.

Opening one on any device

  1. Get the file out of the app's download folder — on desktop it lands next to the cache; on mobile it's usually in the app's own directory
  2. Open an NCM-aware unlocker. The browser-based one we build runs the entire decryption locally in JavaScript, so the file never leaves the device
  3. Drop the file in. The tool recovers the key, reverses the encryption, and reads the true format from the audio's magic bytes — ID3 → MP3, fLaC → FLAC, and so on
  4. Save the unlocked MP3/FLAC with title, artist, album and cover art intact. It now plays in any player, car stereo, DJ software or editor

Why don't players just support NCM?

Supporting it would mean implementing the lock, not the music — and the lock exists specifically to keep playback inside the licensed app, so players have no incentive to bless one store's wrapper. Worth knowing: NCM is technically an obfuscation rather than sanctioned DRM, which is exactly why independent unlockers are possible at all.

The wider family

NCM isn't alone. QQ Music wraps songs in QMC/MFLAC/MGG, Kugou in KGM/KGG, Kuwo in VPR — same concept, different locks, and the same local approach opens the older generations. The honest edge of the map: the newest schemes (Kugou's KGG, QQ Music's musicex) fetch keys from a server at play time and can't be cracked offline — no local tool handles those, ours included. Our converter covers NCM, QMC, KGM and more under the same no-upload, no-re-encode rule.

Quick answers

  • Does the quality drop? No — the audio payload is never re-encoded, so a 320 kbps MP3 stays a 320 kbps MP3 and FLAC comes out bit-identical
  • Are tags and cover art kept? Yes — title, artist and album come out of the container's JSON metadata, the album image is extracted alongside, and MP3s keep their ID3 tags
  • Is my file uploaded? No — the entire decryption runs in JavaScript on your device
  • What about QMC or KGM files? Same concept, same tool: QQ Music's and Kugou's older wrappers open the same way. The newest server-key schemes can't be opened offline, and no honest tool claims otherwise
  • Is this legit? Unlocking music you legitimately obtained — playing your own library on devices and in software the store's player doesn't reach — is the intended use. Uploading, sharing or monetizing the decrypted audio is another thing entirely; the recordings still belong to their rights holders

Unlock NCM files in your browser →

Decryption runs locally in JavaScript. Bit-for-bit output, nothing uploaded.