InstaSave
Paste a public Instagram link, preview it, download it. No account, no private content, no database.
- Kind
- Tool
- Role
- Solo: design and engineering
- Period
- 2026
- Status
- Live
- Stack
- Next.js 14, React 18, TypeScript, Tailwind
How do you let people save public Instagram media without accounts, credentials, or a backend that can be abused?
The narrow, safe version
InstaSave accepts only public post, reel and video links, resolves them through Instagram’s public login-free embeds with no credentials, and answers MEDIA_NOT_FOUND when nothing public exists. A restricted reel is reported as restricted, never mislabelled as something else.
One page, one flow: paste a link, preview the media, download it through a same-origin proxy.
Public content only, by construction
The resolver can only ever see what an anonymous visitor sees, so private accounts and login-required content are out of scope structurally, not just by policy.
A smaller feature set than tools that log in, and no surface that can escalate into account access.
Isolated resolver, narrow attack surface
Media resolution sits behind a single resolveInstagramMedia() interface, so a change in Instagram’s markup means rewriting one module rather than the app; URL validation is pure and shared between client and server, accepting only the known link shapes.
The server is defensive by default: fetches are allowlisted to Instagram hosts (SSRF-safe), the download proxy only accepts Instagram CDN hostnames, filenames are sanitised, internal errors are never exposed, and every request is rate-limited per IP.
Same-origin download proxy
Downloads go through /api/file instead of linking straight to Instagram’s CDN. It fixes cross-origin download behaviour and keeps the host allowlist enforceable in one place.
The server pays the bandwidth, and the allowlist needs maintenance when CDN hostnames change.
In-memory rate limiting
A sliding window of 30 requests per 10 minutes per IP protects the resolver without extra infrastructure; Redis is noted as the upgrade path for multi-instance deployments.
Limits reset with the process and don’t coordinate across instances, acceptable for a single-node tool.
Want something like this built?
Email me