diff --git a/scripts/wtresolve b/scripts/wtresolve
new file mode 100755
index 0000000..af07738
--- /dev/null
+++ b/scripts/wtresolve
@@ -0,0 +1,48 @@
+#!/bin/sh
+
+if test $# -ne 1; then
+  printf "Resolves a wetransfer.com link to a direct download one\n"
+  printf "Usage: %s URL\n" "$0"
+  exit 1
+fi
+
+download_url=$1
+main_url=https://wetransfer.com/
+api_url=https://wetransfer.com/api/v4/transfers
+
+# resolve short URL
+case $download_url in
+  https://we.tl/*) download_url=$(curl -I "$download_url" | sed -n 's/Location: \(.*\)/\1/p')
+esac
+
+# grab a CSRF token
+token=$(curl -s "$main_url" | sed -n 's/.*name="csrf-token" content="\([^"]\+\)".*/\1/p' )
+
+# unpack the URL components
+set -- $(echo "$download_url" | sed 's@.*downloads@@; s@/@ @g')
+if test $# -eq 3; then
+  transfer_id=$1; recipient_id=$2; security_hash=$3
+elif test $# -eq 2; then
+  transfer_id=$1; security_hash=$2
+else
+  echo "unknown URL format"
+  exit 1
+fi
+
+# build the request payload
+data=$(cat <<EOF
+{ "intent": "entire_transfer",
+  "security_hash": "${security_hash}",
+  "recipient_id": "${recipient_id}"
+}
+EOF
+)
+
+# do a fake AJAX and extract the direct link
+curl -s "${api_url}/${transfer_id}/download"         \
+  -X POST                                            \
+  -H "Content-Type: application/json; charset=utf-8" \
+  -H "x-requested-with: XMLHttpRequest"              \
+  -H "x-csrf-token: ${token}"                        \
+  -d "$data"                                         \
+  | sed -n 's/.*"direct_link": "\([^"]\+\)".*/\1/p'