CS2 Match Share Codes: Download the Demo, Read the Code

A match share code looks like a licence key and works like an address. CSGO-GADqf-jjyJ8-cSP2r-smZRo-TO2xK names one match on Valve's servers, and anything holding it can ask for that match.

If you have only ever pasted one into a stats site, it is worth ten minutes to know what you were pasting.

From a code to a demo

The short route is the console:

csgo_download_match CSGO-GADqf-jjyJ8-cSP2r-smZRo-TO2xK

CS2 still ships this command under its CS:GO name, and the client describes it as "Downloads a match via serial code and starts playback".⁴ One line, and you are watching.

You will also meet the code wrapped in a link:

steam://rungame/730/76561202255233023/+csgo_download_match%20CSGO-GADqf-jjyJ8-cSP2r-smZRo-TO2xK

That is the same command handed over as a launch argument, which is why it works with the game closed. The %20 is only the space between the command and the code. If someone sends you the link and you want the bare code for a tracker, it is the last 34 characters.

Both routes depend on the demo still existing. The code never expires; the file does. CS Demo Manager's documentation puts the limit at one month after the match ends, and notes that the game's own match list goes back only eight Valve matchmaking games because that is all the Game Coordinator hands out.⁵ So a code from last season will still decode cleanly and fetch nothing.

FACEIT is a separate system. Share codes belong to Valve matchmaking, and a FACEIT demo comes from its match room instead.⁵

Three numbers in 25 characters

Strip CSGO and the dashes and 25 characters are left. They are digits of one large number in base 57, written with the least significant digit first. The alphabet is the letters and numbers you would expect minus five that are easy to misread: 0, 1, capital I, lowercase l and lowercase g.

Write that number out in binary and it fills 18 bytes, which split into three fields.²

The names come from Valve's own messages. When the client wants the full details of a match, the request it sends has exactly three fields: matchid, outcomeid and token.³ A share code is that request, packed small enough to paste into a chat.

Two details are easy to trip over if you ever handle the raw values.

The first is naming. The middle field is outcomeid in the request and reservationid elsewhere in the same file, and community libraries use either. They are the same eight bytes.

The second is the token. It is the low 16 bits of the match's tv_port, a field Valve stores as 32 bits.³ The reference library's own example shows the cut: it encodes a port of 599906796 and decodes 55788 from the resulting code, which is that number with everything above the sixteenth bit dropped. If your port does not match the token you decoded, nothing is broken.

What the code does not hold is the part people expect: the map, the score, the ten players, or where the demo file lives. The game finds out where the replay is by sending those three numbers to Valve. That is why a share code on its own is useless to a plain downloader and enough for the game. The match share code decoder shows the three fields for any code and builds both forms of the download command.

Nothing checks your typing

A crosshair code uses the same wrapper, and its first byte is a checksum. Mistype one character and the game almost always refuses it.

A match code spends all 18 bytes on data, so no byte is left to check the others.² Change one character and you have a different, perfectly well-formed code for a match that almost certainly never happened. Nothing on your side can tell that the code is wrong. The request goes out, no such match comes back, and from where you sit that is indistinguishable from an expired demo.

There is one accident of arithmetic that helps. Twenty-five base-57 digits can count a little higher than 18 bytes can hold, so the top of the range is unreachable.

That number flatters the check, though. It describes random strings, and a typo is not random: it changes one digit of a code that was already in range. A slip near the end of the code moves the value a long way and often pushes it out of bounds, where it can be caught. A slip near the start barely moves it and sails through. Copy and paste; do not retype.

One code leads to the next

Stats sites ask for a share code and something called an authentication code, which looks like one credential too many. The reason is the shape of one API.

Valve documents a single endpoint for match history, GetNextMatchSharingCode. It takes your steamid, a steamidkey and a knowncode, and returns the share code of the match you played after the known one.¹ Only the next one. The page documents no call for the previous match and none for a list.

So a tracker follows your history the way you would follow a paper trail: ask for the next code, store it, ask again with the new one. When it reaches your latest match the API answers HTTP 202 with "nextcode": "n/a", and the site waits for you to play again.¹

The steamidkey is the authentication code. You create it on the Steam help site, it is scoped to match history, and Valve's page says plainly that you can revoke it.¹ It is the consent half of the pair. The share code is only the starting point.

That design is behind two familiar support questions. A tracker cannot see matches older than the code you gave it, because the chain runs forward. And if the known code is mistyped or belongs to someone else, the API returns 412 and the documentation tells the site to stop calling until you supply a good one.¹ A wrong code does not degrade the sync. It halts it.

Reading a failure

When a code will not load, the cause is usually one of three, and they are cheap to tell apart.

Check the age first. Past a month, assume the demo is gone and stop there.

Then check the characters. Any 0, 1, I, l or g after the prefix means the code was retyped or damaged, since none of the five is in the alphabet.

If both pass, decode it. A code that came from the crosshair menu will decode into three meaningless numbers, and the giveaway is that it also satisfies the crosshair checksum, which a real match code does about once in 256 tries.

Once the demo is open, the tick calculator gets you from a tick to a timestamp and a demo_gototick line, and the tick guide covers the argument order that trips people up.