Docs

Limits

Free: 5 MB per file, about 25 live pages, unlisted, kept forever. Pro: 25 MB per file, about 1,000 pages, private pages, custom names, publish to search. Uploads: 5 a minute per IP, 30 a day anonymous.

Size

A page counts as live while its status is active or held. Deleted pages do not count. Inline images as data URIs count toward the size.

Rate limits

• 5 uploads a minute per IP, on every call, signed in or not.
• Anonymous, with a Turnstile token from the browser: 30 uploads a day per IP.
• Anonymous, without one (curl, scripts, agents): 10 uploads a day per IP.
• Sign-in attempts: 10 a minute per IP.

Over a limit you get 429 with rate_limited or quota_exceeded, and Retry-After when we know it. Pro removes the daily cap; the per-minute limit stays.

What "unlisted" means

• The address is a random 7-character name. Nobody can guess it.
• Anyone who has the link can open it. There is no sign-in wall.
• The page is served with X-Robots-Tag: noindex, nofollow, so search engines that see it do not list it.
• It is not in any sitemap or directory we publish.
• Nothing stops a recipient from forwarding the link. For that, Pro has password and owner-only pages.

Pro "publish to search" removes the header, adds the page to our published sitemap and pings IndexNow. Turning it off does the reverse.

Retention

• Pages are kept forever. There is no expiry on any tier, and no inactivity sweep.
• Deleting a page removes its bytes and every version. The slug stays reserved, so a link you once shared can never be re-registered by someone else.
• We store a keyed hash of the uploader's IP address, the country and a hash of the user-agent with every upload. The IP hash is nulled after 180 days. For pages that were taken down, the 180 days count from the takedown.
• Raw IP addresses are never logged.
• Account deletion removes your profile, sessions and tokens. Your pages are deleted with it.

Takedown policy

• Uploads are scored by heuristics. Pages that look like phishing, droppers, hidden redirects or ClickFix pages are held for review (status held, served as 403) or rejected.
• Anyone can report a page at /report; the address is also in the X-Report-Abuse header of every page.
• Pages removed for abuse serve 410 Gone, and their content hash is blocked from re-upload.
• Pages blocked by a legal order serve 451.
• Timelines, the grievance officer, DMCA and the EU point of contact are on legal.

Slugs

• Generated: 7 characters, lowercase letters and digits.
• Custom (Pro): 2-63 characters, lowercase letters, digits and hyphens, not starting or ending with a hyphen.
• Reserved: infrastructure names such as www, api, docs, mail, and brand or credential words such as login, verify, paypal.

Headers on your page

Your page is served as text/html with nosniff, a strict referrer policy and its own agent cluster. No content security policy, no frame restrictions, no cookies of ours. See the API reference for the list.