Can I screenshot a page behind a login?

No. The renderer starts with no session and no cookies of yours, so it sees the page as a logged-out visitor would. Pasting the rendered HTML directly is the way around this.

Why was my URL refused?

It resolved to an address inside a private network, or used a scheme other than http/https. That guard cannot distinguish a mistake from an attack, so it refuses both — and the refusal does not spend your allowance.

Can I capture the whole page, not just the top?

Yes. Full-page capture scrolls and stitches the entire document, bounded by a maximum edge length so a very long page cannot exhaust the renderer.

Screenshotting a web page without becoming an open proxy

A real browser renders the page, and a guard decides what it is allowed to reach — the hardest part of this tool is the second half.

Updated 20 August 20263 min read

A real browser, in a container of its own

Turning a page into a picture properly means running the page: fonts load, layout settles, JavaScript executes. Anything less produces a screenshot of a half-drawn document. So this tool drives an actual Chromium, in a separate container from the rest of the service, with its own memory limit.

You can give it a URL or paste raw HTML. Either way you choose the viewport, whether to capture the full scrolling page or just the visible area, and whether to render at 2× for a retina-quality result. You can also inject your own CSS, which is the practical way to hide a cookie banner before the shot.

The part that matters: what it is allowed to fetch

A service that fetches any URL you hand it, from inside a server, is a Server-Side Request Forgery vulnerability by default. Point it at an address only reachable from within the network and it will happily fetch it and send you a picture of the result. On a cloud host that includes the metadata endpoint, which can hand out credentials.

So every address is checked before the browser is allowed near it, and the checks account for the ways the naive version is bypassed.

Scheme: Only http and https. A file:// URL cannot read the server disk.
Private ranges: Loopback, link-local, and private address blocks are refused, in IPv4 and IPv6 — including IPv4 addresses written in IPv6 form.
Cloud metadata: The well-known metadata address is blocked outright.
DNS rebinding: A public hostname that resolves to a private address is refused, because resolution is checked rather than the name trusted.
Redirects: Followed and re-checked, so a public URL cannot redirect its way inside.

Why a refusal costs you nothing

The address check runs before your daily allowance is charged. A typo in a URL, or a link that turns out to point somewhere private, is refused and does not count against you — you only spend an allowance on work that actually runs.

Frequently asked questions

Can I screenshot a page behind a login?: No. The renderer starts with no session and no cookies of yours, so it sees the page as a logged-out visitor would. Pasting the rendered HTML directly is the way around this.
Why was my URL refused?: It resolved to an address inside a private network, or used a scheme other than http/https. That guard cannot distinguish a mistake from an attack, so it refuses both — and the refusal does not spend your allowance.
Can I capture the whole page, not just the top?: Yes. Full-page capture scrolls and stitches the entire document, bounded by a maximum edge length so a very long page cannot exhaust the renderer.