The hidden information in an Instagram address

Open-source intelligence usually means reading what people published; sometimes it means reading the address they published it at, which on Instagram carries the second the post was started, the database shard it landed on and its place in the queue

The address of an Instagram post is not a name and it is not a hash. It is a number, written in a notation that fits in a web address, and it has always been readable if you knew what you were looking at.

How do Instagram posts get their web addresses? I wondered about that one day and found that every post starts the same way - instagram.com/p, as in post - and after that the system hands each item a string of letters and numbers. But what happens if you type A after the "/p/"? Then B, then C?

In the beginning the number was a plain counter. Instagram gave every upload a sequential id - post one, post two, post three - the way any database hands out a primary key, and the address is that integer re-expressed in base 64. The standard URL-safe alphabet for base 64 runs A-Z, then a-z, then 0-9, then - and _, so post 2 is C, post 15 is P, post 20 is U.

Then the counter ran out of room, and what replaced it carries considerably more.

What the address carries now

A modern address is eleven characters rather than one, and the number behind it is no longer a plain counter. Instagram moved to sharded ids in 2011 and published the scheme: 41 bits of milliseconds since a custom epoch, 13 bits of shard, 10 bits of a per-shard sequence.¹

So an eleven-character address unpacks into three facts. I decoded eight posts from Mike Krieger's account and checked each against the time the page itself shows:

• Br-mOTjFfLL decodes to 29 December 2018, 16:33:06 UTC. The page says 16:33:07. Shard 1404
• Cbt5yfzu8tX decodes to 30 March 2022, 06:03:54. The page says 06:03:55. Shard 3826
• CGAo-RJjYpw decodes to 6 October 2020, 17:11:52. The page says 17:11:53. Shard 866
• DK2DgZao8Jy decodes to 13 June 2025, 14:38:16. The page says 14:38:18. Shard 2288
• BxEfIu8DpHy decodes to 5 May 2019, 06:03:36. The page says 06:12:38. Shard 932

Five of the eight land within two seconds. Three are minutes early, and here is the part worth keeping: every single one is early, never late. The id is stamped when the upload begins; the timestamp on the page is written when the post goes live. The gap between them is the time somebody spent choosing a filter and typing a caption, or the time a post sat in a scheduler.

What that is good for

• The exact second a post went up, when the interface will only tell you "2 days ago"
• Two posts seconds apart from the same account, which is the signature of a scheduler rather than a person
• Proof that a post existed at a given moment, and a way to catch a date claimed after the fact

None of it needs an API key, a login or a scraper. It is arithmetic on a string that anybody can copy out of the address bar, which is what makes it open-source intelligence rather than access.

One caution, because the obvious reading is wrong. Instagram's own worked example shards by user id, so it is tempting to treat the shard field as an account fingerprint. My eight posts come from one account and carry eight different shards - 814, 866, 932, 942, 1404, 2288, 3826, 4058. Whatever the media table buckets on, it is not the poster. Do not use the shard to link accounts.

Glossary

OSINT, open-source intelligence. Anything you can establish from sources open to everybody: published pages, public records, archives, and the structure of a web address. It stops being open-source the moment it needs a login, a key or a subpoena.

Timestamp. A moment stored as a single number, usually milliseconds counted from an agreed starting point. Instagram counts from its own custom epoch rather than the usual 1970, which is why a raw id looks like nothing until you add 1314220021721 back on.

Base 64. A way of writing a large number using sixty-four symbols instead of ten, so it comes out short enough for a web address. The URL-safe alphabet runs A-Z, a-z, 0-9, then - and _. Eleven of those symbols hold a 64-bit number.

The first twenty-six addresses

Because the early number was a plain counter, the platform's whole prehistory sits on the twenty-six capital letters and nowhere else. Nothing can ever occupy those addresses again.

I first walked them in 2019.² Instagram has closed the door since - they resolve, but a logged-out visitor gets nothing back - so what follows leans on the Internet Archive's 2014 copies of the same pages, from the years when the platform still printed each post's media id, owner and timestamp into the page source.³ Eight of those copies survive with both the id and the address intact, and the encoding holds in all eight: C is 2, D is 3, E is 4, G is 6, H is 7, P is 15, S is 18, U is 20.

Ten of the twenty-six are empty today. B - number 1, the first upload the platform ever recorded - was already a 404 when the Internet Archive first reached it on 6 March 2011, eight months in. A has nothing archived before 2013. Whatever went up first, nobody outside the company has seen it since.

A

Not preserved

B

Not preserved

C

Kevin Systrom photographs somebody else's dog and the flip-flopped foot of his girlfriend Nicole. The caption is one word: "test". Asked about this picture years later, he said:⁴

Had I known it would have been the first photo posted on Instagram as it is today, I think I would have tried a little harder.

The scene is Todos Santos, a Mexican town popular with surfers, a day's drive from San Francisco.

D

Deleted

Five minutes after the dog, Kevin posted a shot from a Todos Santos diner called Tacos Chilakos, now closed. A filling burrito cost 16 pesos there - about $1.25 at the time.

I am describing that photograph from memory and from the 2014 archive record, because the post itself is no longer at its address. It was there when I first ran this walk.

Kevin couldn't afford an expensive holiday back then. A year earlier he'd left the marketing department of an American transit project and walked into total uncertainty. He'd found a little investment for his project, but the startup still wasn't taking off. Users of the first version of Instagram simply couldn't work out what it was for.

E

A bit later Kevin posts his girlfriend Nicole drinking a cocktail in a dive bar. The alcohol isn't there by accident: not long before, the future Instagram was called Scotch, and before that Burbn.

At the exact moment of this shot the app is going by the working title Codename. The idea of crossing "instant camera" (the Polaroid kind) with "gram" (as in telegram, the wire message) arrives a month later.

F

Deleted

G

And here is the real number one. What threw everybody off is that the order of the posts doesn't quite match the alphabet. But the timestamp in the code says it plainly: this is the very first post on Instagram.

The photo of the yacht moorings at South Beach Harbor is taken by Mike Krieger, Instagram's co-founder. The guys had no money for yachts - this is the view out of the window of Dogpatch Labs, the business incubator where they rented an office on the cheap. You can even pin down the exact spot: Pier 38.

H

Mike shoots Kevin grinding away at building Instagram. Same startup incubator, the one with the odd name that sounds like a laboratory for patching up dogs. It later moved out of America to Dublin, where the taxes are much lower.

Mike and Kevin studied together at Stanford: Kevin as an engineer, Mike as a semiotician. Much later, when Kevin Systrom falls out with Mark Zuckerberg, Mike leaves the company with him.

I

A portrait of Kevin and Nicole, posted by a new character: Bruce Abbott. He didn't work at the startup - he'd just dropped by to see his friends - which officially makes him the first member of the public to post on Instagram.

After the network exploded, Bruce didn't go asking his friends for a cushy job. He went off to work as a designer at Disney.

J

Deleted

K

Nicole photographs the view out of the office window too. Her role in the project wasn't the most prominent one: she simply kept the guys going. Five years later she'd marry Kevin Systrom, have his children and take a seat on Instagram's board.

L

Image gone

M

Back then post text showed up as a comment under the photo, which makes it hard to find now. Kevin captioned this one "Amazing pins", though today it's completely unclear what those pins are and what's so amazing about them.

N

The first post with a location tag. The feature was in the app from the very beginning - before hashtags, before everything else - because the plan at first was to compete with Foursquare.

O

The first proper food photo. Sadly this particular sushi place is no longer at that pin: it moved a couple of blocks away and changed nothing else. It's known for huge tuna rolls at prices that count as cheap for California.

P

This post could win a contest for the most revolting food photograph in human history. Mike is having lunch at a Chinese hole in the wall, an Asian lager, Shandong Hande, on the table. Nicole Systrom asks in the comments: "When did you order all that food?"

Q

Unavailable

R

It might look like Nicole drinks hard liquor from morning to night, but let me say it again: back then the platform's founders thought people would use Instagram to share the intimate moments of a boozy party with close friends.

If only they'd known what it would all turn into - a parade of fake smiles, Photoshopped sober calculation and an industry of forced poses.

S

Now we get Kevin's lunch: he seems to be about to eat borscht with a fork.

T

Not preserved

U

Mike Krieger has turned up at a cinema for a preview screening of Inception. It was a Friday - but still the middle of a working day. It's unlikely the guys were having this much carefree fun all the time.

More likely they wanted to act out the way ordinary people spend their free time, and agreed that one of them would go to a bar, one to lunch, one to the cinema - and document all of it in the new app.

V

Image gone

W

Nicole went out to lunch too: the pizzeria Gialina. The most expensive pizza here, the one with figs, costs $23. And what terrifying thing did Nicole photograph? A poster of the Leaning Tower of Pisa.

X

Not preserved

Y

Not preserved

Z

Not preserved