Introduction

You can download NuGet packages without nuget.exe or Visual Studio by using the NuGet HTTP feeds directly. This is useful in locked-down environments, minimal build agents, or custom toolchains where only basic shell tools are available. This guide shows reliable manual methods using browser, curl, and PowerShell.

Core Topic Sections

Understand package formats and feed endpoints

A NuGet package file is a .nupkg archive. It is essentially a zip file containing metadata and binaries.

Two common feed styles:

1. Legacy v2 endpoint using package id and version.
2. v3 flat container endpoint with lower-case package paths.

Knowing both matters because some internal registries mirror one style more easily.

Method 1: download from NuGet web page

For quick one-off use:

1. Open package page on nuget.org.
2. Pick required version.
3. Use the download link to save .nupkg.

This is simple, but hard to automate in CI and error-prone when exact version pinning matters.

Method 2: direct v2 URL with curl

The v2 endpoint pattern is straightforward.

1PACKAGE_ID="Newtonsoft.Json"
2VERSION="13.0.3"
3OUT="${PACKAGE_ID}.${VERSION}.nupkg"
4
5curl -L "https://www.nuget.org/api/v2/package/${PACKAGE_ID}/${VERSION}" -o "$OUT"
6ls -lh "$OUT"

The -L flag follows redirect responses used by package hosting.

Method 3: v3 flat container API

For scripted workflows, v3 is often clearer because it has a predictable structure and metadata endpoint.

1PACKAGE_ID="newtonsoft.json"
2VERSION="13.0.3"
3
4curl -L "https://api.nuget.org/v3-flatcontainer/${PACKAGE_ID}/${VERSION}/${PACKAGE_ID}.${VERSION}.nupkg" \
5  -o "${PACKAGE_ID}.${VERSION}.nupkg"

Important details:

1. Package id in URL must be lower-case.
2. Version should match exact normalized package version.

Discover versions before download

If you need available versions programmatically, query index JSON first.

PACKAGE_ID="newtonsoft.json"

curl -s "https://api.nuget.org/v3-flatcontainer/${PACKAGE_ID}/index.json"

This helps avoid guessing versions and failing builds due to typo or missing patch numbers.

PowerShell download without NuGet client

On Windows hosts, this is a clean alternative.

1$package = "newtonsoft.json"
2$version = "13.0.3"
3$url = "https://api.nuget.org/v3-flatcontainer/$package/$version/$package.$version.nupkg"
4$out = "$package.$version.nupkg"
5
6Invoke-WebRequest -Uri $url -OutFile $out
7Get-Item $out

This works well in restricted environments where only PowerShell is allowed.

Extract and use package contents

After download, inspect package contents with unzip tooling.

mkdir -p pkg && unzip -o newtonsoft.json.13.0.3.nupkg -d pkg
find pkg -maxdepth 3 -type f | head

Common directories include lib, ref, build, and package metadata files.

Use local feed path for offline restore

If you need multiple packages offline:

1. Store .nupkg files in a local directory.
2. Point restore tools to that directory as a source.

Example nuget.config source entry:

1<?xml version="1.0" encoding="utf-8"?>
2<configuration>
3  <packageSources>
4    <add key="local-offline" value="/opt/nuget-offline" />
5  </packageSources>
6</configuration>

This approach is useful for air-gapped build environments.

Security and integrity checks

Manual download paths should include verification:

1. Confirm package id and version exactly.
2. Validate checksum from trusted process.
3. Prefer HTTPS endpoints only.
4. Restrict source hosts in enterprise pipelines.

Supply chain hygiene matters even for simple manual package pulls.

Common Pitfalls

• Using v3 flat container URL without lower-casing package id.
• Forgetting redirect support and omitting curl -L.
• Downloading latest version manually instead of pinning a required version.
• Treating .nupkg as binary blob without checking target framework folders.
• Skipping package source controls in offline or enterprise environments.

Summary

• You can download NuGet packages directly via HTTP without NuGet client tools.
• v2 and v3 endpoints both work, with v3 better for scripted use.
• 'curl and PowerShell methods are enough for most manual workflows.'
• Extract package contents to verify framework compatibility.
• Add version pinning and source validation for reliable, secure builds.