How YouTube thumbnail URLs are structured
Every YouTube video has an eleven-character identifier made up of letters, digits, hyphens and underscores, and its thumbnails are served from predictable addresses built from that identifier. The pattern is https://i.ytimg.com/vi/VIDEO_ID/QUALITY.jpg, so for the identifier dQw4w9WgXcQ the highest resolution image is at https://i.ytimg.com/vi/dQw4w9WgXcQ/maxresdefault.jpg.
The quality names are fixed. maxresdefault is up to 1280 by 720, sddefault is 640 by 480, hqdefault is 480 by 360 and mqdefault is 320 by 180. There is no API key and no authentication involved: these are ordinary public image files on YouTube's image host, which is why a tool like this needs nothing more than the identifier.
This tool extracts that identifier from whatever you paste. It recognises the watch URL form with v= in the query, the youtu.be short link, the shorts, embed, v and live path forms, and a bare eleven-character identifier typed on its own. Anything else is reported as invalid rather than guessed at.
Why the highest quality is sometimes missing
maxresdefault is generated only for videos uploaded at 720p or above, so an older video, a low resolution upload or some live streams simply have no such file. The request returns a 404 and the preview appears faded. The lower qualities are generated for every video, so sddefault, hqdefault and mqdefault are reliable fallbacks.
Aspect ratio differs between them in a way that catches people out. maxresdefault and mqdefault are 16:9, matching the video frame. hqdefault and sddefault are 4:3, which means YouTube pads the 16:9 frame with black bars at the top and bottom to fill the taller shape. If you need a clean widescreen image, use maxresdefault or mqdefault, or crop the bars off.
Thumbnails also change. When a creator sets a new custom thumbnail the same URL serves the new image, so these addresses are not stable references to a specific picture. Anything you want to keep should be downloaded rather than hotlinked.
How the download works
A plain link with a download attribute does not save a cross-origin image; browsers ignore the attribute in that case and simply open the file in a new tab. This tool therefore fetches the image, turns the response into a blob, creates a temporary object URL for it and triggers a save from that same-origin URL, which the browser does honour. The file is named after the video identifier and the quality, as in dQw4w9WgXcQ-maxresdefault.jpg.
That works because YouTube's image host serves an Access-Control-Allow-Origin header permitting cross-origin reads. If the fetch fails for any reason, the tool falls back to opening the image in a new tab so you can save it manually with a right click.
The images are fetched directly from YouTube by your browser, which means no server of ours sees the request and there is no rate limit imposed here beyond whatever YouTube applies. It also means the previews reflect what YouTube is serving right now.
Copyright and acceptable use
A thumbnail is a creative work and is protected by copyright in the same way the video is. The rights normally belong to the video's creator or their rights holder, and the fact that the file is publicly accessible does not place it in the public domain or grant a licence to reuse it.
Uses that are generally uncontroversial include your own videos' thumbnails, checking how a thumbnail renders at different sizes, archiving your own channel's artwork, and small-scale reference or commentary where a fair use or fair dealing argument applies in your jurisdiction. The safest position for someone else's thumbnail is to link to the video rather than republish the image.
Uses that are likely to be infringing include putting another creator's thumbnail on your own video or channel art, reproducing it in a commercial product or advertisement, or redistributing it as your own work. YouTube's terms of service also restrict automated access to its content, so bulk collection across many videos is a separate concern from the copyright question. When in doubt, ask the creator, since permission is usually easy to obtain and removes the question entirely.