Large files
Large file upload testing: the limits you will hit, and files to hit them with
A large upload passes through several layers, and each one has its own size limit. The smallest wins, and it is rarely the one you configured. Here are the defaults, the unit trap that makes limits off by five percent, and exact-size files for testing either side of a limit.
The default limits
Whichever of these sits in front of your code decides the error, unless someone changed it.
| Layer | Default limit | Setting |
|---|---|---|
| Cloudflare (proxied) | 100 MB on Free and Pro, 200 MB Business, 500 MB Enterprise | Plan limit; returns 413 at the edge |
| nginx | 1 MB | client_max_body_size |
| Apache httpd | 1 GiB (since 2.4.54; unlimited before) | LimitRequestBody |
| IIS | 30,000,000 bytes | maxAllowedContentLength |
| ASP.NET Core | 30,000,000 bytes | MaxRequestBodySize |
| PHP | 2 MB per file, 8 MB per request | upload_max_filesize, post_max_size |
| AWS API Gateway | 10 MB | Hard limit for the payload |
| AWS Lambda | 6 MB | Synchronous invocation payload |
Two limits usually apply at once. PHP's per-request limit (8 MB) is smaller than many teams expect once form fields are added, and IIS still enforces its 30,000,000 bytes after ASP.NET Core's limit is raised. Raise one, test again, and find the next.
The unit trap: MB or MiB
A "10 MB" limit is 10,000,000 bytes in some software and 10,485,760 in others.
A limit stated in megabytes can be off by almost five percent depending on who wrote it, and the user sees a file their operating system calls 9.8 MB rejected as too big. Test with exact byte counts on both sides of both readings. Each link below is generated on demand at exactly that size:
| If the limit is 10,000,000 bytes | If the limit is 10,485,760 bytes (10 MiB) |
|---|---|
| 9,999,999 bytes: accepted | 10,485,759 bytes: accepted |
| 10,000,000 bytes: the limit itself | 10,485,760 bytes: the limit itself |
| 10,000,001 bytes: rejected | 10,485,761 bytes: rejected |
Change the number in the link for any other limit: gen.hexaqa.com/gen?type=bin&size=<bytes>
works up to 2 GB. Whether "the limit itself" is accepted is a decision, not a bug. Write it down, then test that
the code agrees.
What a correct implementation does
Rejects early
An oversized upload is refused from its Content-Length, before the body is read. A server that buffers 2 GB and then says no has already paid the cost.
Says so clearly
Browsers often report a server that closes mid-upload as a network error. Check what your user actually sees: it should name the limit, not "something went wrong".
Checks before sending
The client knows the file size before it starts. Refusing in the page saves the user minutes of uploading a file that was never going to be accepted.
Survives slow networks
A 1 GB upload on a slow connection outlives many idle timeouts. Large files should go in chunks that can be retried, or straight to object storage.
Reports real progress
The bar reaches 100% when the server confirms, not when the last byte leaves the browser, and cancel actually stops the transfer.
Refuses empty files
A 0-byte file is the other boundary. The 0-byte test file finds validators that check type but not size.
Files for every size
| You need | Where |
|---|---|
| 0 bytes to 250 MB, stored, resumable | Size ladder |
| 500 MB, 1 GB, 2 GB with published SHA-256 | 1 GB test file |
| Any exact byte count up to 2 GB | gen.hexaqa.com/gen?type=bin&size=<bytes> |
| Larger than 2 GB | Make one locally |
| Files that are the wrong type, not the wrong size | Upload validation checklist |
Questions
Why does my upload fail with 413?
A layer in front of your code has a smaller limit: 1 MB in nginx, 100 MB at Cloudflare Free and Pro, 30,000,000 bytes in IIS and ASP.NET Core, 8 MB per request in PHP.
What is the maximum upload size through Cloudflare?
100 MB on Free and Pro, 200 MB on Business, 500 MB on Enterprise, rejected at the edge with a 413.
Is a 10 MB limit 10,000,000 or 10,485,760 bytes?
It depends on the software. Test both with the exact-size files above.
How do I test an upload limit?
Upload files just under, at and just over it, in bytes, and check the rejection is early, quick and clearly explained.
Where can I get large test files?
Stored files from 0 bytes to 250 MB, and any size up to 2 GB generated on demand, here, free.
Keep going
Upload validation checklist 1 GB test file → Size ladder →
More from Learning
Guides and references for test data, file handling and AI evals. All free, no sign-up. See the full hub.