prnt.li is an inbox.li project. It runs on one machine in Norway, on a small server, and it is configured for a specific threat model: a public anonymous file host on a box that also hosts a mail service. This page describes what that actually means, including the parts that are not reassuring.
| Operator | inbox.li — see Terms |
| Hosting country | Norway (NO) |
| Application server | 127.0.0.1, loopback only |
| Public entry point | nginx, TLS terminated |
| Storage | local disk, unencrypted at rest |
The application process binds loopback and is unreachable from the internet. The only thing that speaks to the outside is a reverse proxy holding a TLS certificate for this hostname.
TLS 1.2 or newer is required. HTTP is redirected to HTTPS without consulting the application. HSTS is set with a one-year max-age, so a browser that has seen this site once will refuse to talk to it in cleartext afterwards. No page on this origin is framed by another site, and every response carries X-Content-Type-Options: nosniff.
A Content-Security-Policy is set on every page: same-origin only for scripts, styles and frames, no plugins, no external images, no base tag, and form submissions restricted to this origin. An uploaded file cannot become script on this origin — see section 05.
The application never handles file bytes on the way out. A download is answered with an internal redirect naming a protected location, and the web server sends the file directly from disk. This is what makes the anonymous speed limit possible at all, and it means a large transfer consumes no application memory.
Anonymous downloads over 100 MB are throttled to 100.0 Mbit/s. Signed-in requests are served at full speed, and that decision is made by a real authentication subrequest — not by testing whether a cookie is present, so a forged cookie cannot buy the exemption.
Anonymous callers get 20 uploads per hour and 20 GB per hour, counted per IP address over a rolling window. A caller presenting an API key gets 200 — the key raises a ceiling, it does not grant access to anything. Total stored bytes are capped at 3 GB, and uploads are refused outright if free disk drops below 512 MB.
Concurrent uploads are capped at 2, and requests past that limit are refused rather than queued. A queue would convert "refused" into "refused eventually, after the disk is full".
Files are stored under an unguessable token with no extension on disk. The display name you gave it is kept in the database and never reaches the filesystem, so no user-controlled name can influence how the server types a response. The stored Content-Type is what the application decided, not what a filename suggested.
Types that can execute in a browser context — SVG above all — are forced to download rather than render, precisely so that an uploaded file cannot run script on the origin that holds the admin session.
This service is not log-free, and it is not anonymous to the operator. For each file the service records the uploader's IP address, user agent and upload time. For each download it records the requesting IP address, user agent, timestamp, and whether the request was throttled. Password-protected files store a salted hash; the password itself is never stored and never logged.
Raw request records are retained for 90 days, then folded into daily totals and deleted. Lifetime counters on each file survive. Files expire on the schedule chosen at upload (default 7 days); burn-after-view files have their bytes removed shortly after the single permitted view.
An honest section, because a security page that only lists strengths is marketing.
The operator can read your files. They are on a disk, not in a sealed envelope. Anyone who compromises this host — or lawfully compels its operator — can read stored content. There is no end-to-end encryption and no key that lives anywhere the operator does not reach.
A file link is a secret, not an access control. The token is unguessable, which is the same property as a long password. Anyone you send the link to can fetch the file, and so can anyone who obtains the link. Do not treat a prnt.li URL as suitable for material you could not tolerate being forwarded.
There is no account system. There is no way to revoke a link before it expires other than deleting the file, and no way to prove to a recipient who uploaded it. If you need revocation or attribution, use a service built for that.
Traffic analysis is possible. A party who can observe the connection learns that this host was contacted and roughly how much was transferred, regardless of content.
Abuse, illegal content and law-enforcement requests: abuse@abuse.li. Include the file link if the report concerns a specific upload. See Terms for the disclosure process and what this service is not for.