Puffbin
- Free allowance
- Upload files up to 10GB each.
- Verdict
- caveatusable, with a named limit or an unprobed read path
- Cost
- free tier
- Identity
- anonymousno card, no phone
- Binding limit
- pull-count1 when burn-after-reading is set
- Evidence
- documented6 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-12-04checked 2026-11-03 (live); stale on 2026-12-04
| Free tier | Upload files up to 10GB each. Password protect, burn after reading, or just share. No account needed. unit GB; metered on none |
|---|---|
| Price | USD 0 |
| Limits | Retention is a timer the uploader selects at upload, and early deletion is not offered; the selectable timer values and any rate limit are not published. Whether a datacenter address is accepted: not published. |
| Binding | pull-count The pull count breaks before the size does. |
| Identity | anonymous 'No account needed' on the page and the FAQ says no registration or personal details are required; request IP addresses are logged temporarily to prevent abuse. No upload was attempted. |
| Egress | No byte allowance stated; a burn-after-reading option makes the first read the last. free allowance: none published |
| Per-object cap | Upload files up to 10GB each (10000000000 bytes) |
| Retention | The uploader chooses how long a file exists, and when the timer runs out the file is permanently deleted; there is no early delete, only the chosen timer. unverified: the selectable timer values and their maximum are not listed on the page. |
| Interface | unknown Browser drop zone. /api/upload returned 400 (a validation answer) so a JSON endpoint answers, but no contract is published. |
| Tooling | Browser only as observed; the 400 on /api/upload is the opening for a wrapper. |
| Composes with | Burn-after-read is the right primitive for handing a credential or a one-shot dataset to a reader without leaving a copy; it is the opposite of an archive. |
| Reliability | A single-screen drop zone with an FAQ; no rate limit, maximum timer or datacenter-address policy is published, and request IP addresses are logged temporarily to prevent abuse. |
| Notes | Named for the burn-after-read primitive; the number that matters (retention) is still missing. |
| Evidence note | documented The offer sentence and the FAQ are quoted from the vendor page. Retention is a timer chosen at upload whose selectable values are not published, and the upload path contract is not published; no upload was attempted. |
| Parsed numbers |
|
Evidence 6
| date | source | what it proved |
|---|---|---|
| 2026-10-23 | puffbin.com/ | 'Upload files up to 10GB each', 'Password protect, burn after reading, or just share', 'No account needed' |
| 2026-10-23 | probe: https://puffbin.com/api/upload | HTTP 400 from /api/upload, 404 from /upload, /api/files, /v1/upload |
| 2026-11-03 | puffbin.com/ | the uploader picks a lifetime and the file is permanently deleted when the timer ends |
| 2026-11-03 | puffbin.com/ | no registration or personal details; request IP addresses are logged temporarily |
| 2026-11-03 | puffbin.com/ | no early deletion; expiry is by the chosen timer only |
| 2026-11-03 | puffbin.com/ | 10 GB per file, no account, password and burn-after-reading options |
More fields 1
| api shapes tried | ["/api/upload","/upload","/api/files","/v1/upload"] |
|---|
Unknown values 1
- interface: the access interface was not established