no protocol-level limit — it's whatever your PDS operator sets.

- [bluesky's PDS](https://github.com/bluesky-social/atproto/blob/main/packages/pds/src/config/config.ts): per-blob default **5 MB** (`PDS_BLOB_UPLOAD_LIMIT` to override). the [self-host distro](https://github.com/bluesky-social/pds) doesn't set it, so stock self-hosts get 5 MB. what bsky.social actually runs isn't public.
- [zds](https://tangled.org/zat.dev/zds) (zig, behind pds.zat.dev): default **100 MB** (`ZDS_BLOB_UPLOAD_LIMIT`).
- no aggregate account quota exists in either — only per-blob caps.

just recently, they allowed 10-min videos on bluesky: they upload to a separate service, [video.bsky.app](https://github.com/bluesky-social/social-app/blob/main/src/lib/constants.ts), which returns a blob ref. those bytes never hit `uploadBlob` on your PDS.

for encrypted media: [`com.atproto.sync.getBlob`](https://docs.bsky.app/docs/api/com-atproto-sync-get-blob) is unauthenticated — anyone with the DID + CID gets the bytes. so encrypt client-side; the PDS gives you storage, not access control.

want different limits? run your own — [~17 implementations here](https://github.com/threddyrex/atproto-links#pds-implementations).