Why Private Instagram Accounts Can't Be Downloaded

The most common question we get is whether InDownloader can fetch content from a private account. The answer is no, and it isn’t a limitation we plan to remove — so it’s worth explaining why, and why anyone claiming otherwise should worry you.

How public fetching actually works

When an account is public, Instagram serves its media to anyone who requests the URL. No login, no session, no permission check. That’s what “public” means at a technical level.

A downloader does the same thing your browser does: request the page, read the media URL from the response, fetch the file. There’s nothing clever happening. The content was already available to anyone who asked.

What changes when an account is private

Instagram stops serving that media to unauthenticated requests. Ask for it without a valid session belonging to an approved follower, and you get nothing back — not a smaller version, not a watermarked version, nothing.

There is no gap to exploit here. The check happens on Instagram’s servers before any file is sent. A tool can’t work around it, because the tool never receives the data in the first place.

So how do sites claim to do it?

Three ways, all bad.

1. They ask for your login. The site presents an Instagram-looking form and asks you to sign in “to verify access.” You’ve now handed your credentials to a stranger. This is straightforward phishing, and it’s the leading cause of stolen Instagram accounts. Instagram never requires your password for a third-party tool, and any site asking is compromising you.

2. They ask you to authorise an app. Slightly subtler. You’re asked to connect via OAuth, granting permissions. If the account you’re targeting has approved you as a follower, an app acting with your session can technically read it. But you’ve now given an unknown operator ongoing access to your account — your DMs, your followers, your ability to post.

3. They do nothing at all. You paste a link, watch a fake progress bar, complete a “human verification” step that’s really an ad-network survey, and get either a broken file or nothing. The business model is the ad revenue and the data you entered.

None of these is a technical breakthrough. They’re all social engineering.

The request we can’t fulfil

People sometimes explain that the private account is their ex, or someone they think is talking about them, or an account that blocked them. The specifics vary; the request doesn’t.

We’re not going to build that, and it’s worth saying plainly why rather than hiding behind “it’s not possible.” Someone setting their account to private has made an explicit decision about who sees their content. Circumventing that isn’t a technical problem to solve — it’s the thing the setting exists to prevent. In a fair number of jurisdictions, systematically accessing content someone has restricted from you also has legal exposure attached, particularly where there’s a harassment or stalking context.

If you’ve been blocked by someone, that’s information. The right response isn’t a workaround.

What is legitimately available

For public accounts:

• Reels, feed videos and IGTV
• Photos and every slide of a carousel
• Stories, inside their 24-hour window
• Highlights, indefinitely
• Profile pictures at stored size

For your own account, regardless of privacy setting:

• Everything, via Settings → Accounts Centre → Your information and permissions → Download your information

That export is the correct route for your own private content. It’s authenticated properly, it requires no third party, and it returns more than link-fetching ever could — including archived Stories and posts you’ve since deleted.

If you were asked for a follow

There’s a legitimate version of wanting private content: you want to see it, and the account holder might be fine with that. Send a follow request. If it’s declined, that’s an answer.

For business contexts — you need a creator’s Reel for an approved campaign, say — ask them for the file directly. Creators generally have the original export, which is higher quality than anything a downloader could give you anyway.

How to tell a downloader is safe

Reasonable signals:

• It never asks you to log in
• It never asks you to install a browser extension to “unlock” anything
• It doesn’t gate downloads behind surveys or “verification”
• It’s explicit about what it can’t do
• It doesn’t claim private-account support

Warning signs:

• Any password field
• Requests to authorise an app
• Claims about private accounts, deleted posts, or expired Stories
• Multiple fake download buttons
• Redirect chains before you reach a file

The short version

Public content is fetchable because Instagram serves it publicly. Private content isn’t, because Instagram doesn’t. Anything promising otherwise is after your account, your data, or your ad impressions.

If it’s your own content, use the data export. If it’s someone else’s and they’ve made it private, that’s their call to make.