no protocol-level limit — it's whatever your PDS operator sets.

• bluesky's PDS: per-blob default 5 MB (PDS_BLOB_UPLOAD_LIMIT to override). the self-host distro doesn't set it, so stock self-hosts get 5 MB. what bsky.social actually runs isn't public.
• zds (zig, behind pds.zat.dev): default 100 MB (ZDS_BLOB_UPLOAD_LIMIT).
• no aggregate account quota exists in either — only per-blob caps.

just recently, they allowed 10-min videos on bluesky: they upload to a separate service, video.bsky.app, which returns a blob ref. those bytes never hit uploadBlob on your PDS.

for encrypted media: com.atproto.sync.getBlob is unauthenticated — anyone with the DID + CID gets the bytes. so encrypt client-side; the PDS gives you storage, not access control.

want different limits? run your own — ~17 implementations here.