Zippy, the lightning-bolt mascotZIPPY BLOG
← all posts
The Zippy Team

Upload Your Social Preview Image — Don't Just Paste A URL

The card WhatsApp, X and Slack show when your link gets pasted used to need an image URL — which meant hosting the picture somewhere first. Now you can upload one straight from your device. Also: why an og:image can't be an SVG.

linkssocialog imagecreatorsproduct
Zippy the limbless lightning-bolt mascot dragging an image file into a social-share preview card that shows a title, description and picture, replacing an empty image slot
Zippy, the lightning-bolt mascot

⚡ Zippy: "paste the image URL" is a great instruction if you happen to run a CDN.

The small gap that made you go host a file

Every Zippy link has a social preview — the card that shows up when you paste the link into WhatsApp, X, Slack, iMessage, anywhere. You could already edit the title, the description and the image, or re-scrape them from the destination.

But the image was a URL field. To use your own picture you first had to put it somewhere public — a bucket, a CDN, some image host — copy the URL, and paste it in. For a card that's supposed to take ten seconds, that's a detour through infrastructure most people don't have.

Now you upload it

Open a link's Social preview, and under the image field there's an upload option. Pick a file off your device and that's it — Zippy hosts it and sets it as the card image. The paste-a-URL field is still there for when you already have one.

PNG, JPEG or WebP, under 2 MB. The picture is stored on Zippy's own object storage and served from a real public https URL, because that's what an og:image has to be: a social crawler on some other company's server is going to fetch it when your link gets unfurled. It also rides the redirect path the same way the rest of your preview does, so a pasted link shows the card with no extra round-trip.

Available on every plan. Editing your link's preview is a basic, not a paywall.

Why your og:image can't be an SVG

The natural file to upload is often an SVG — it's what's in every brand kit. We refuse it, on purpose, for the same reason we refuse it for QR logos.

An SVG isn't a picture. It's markup — a document, in the same family as HTML, that can carry <script> tags and references to other files. An og:image is fetched and rendered by other people's servers. "Accept an uploaded SVG" would mean taking a stranger's markup and handing it to every platform that unfurls the link. So it's an allow-list — PNG, JPEG, WebP — checked on the way in, with the size measured on the decoded image, not the upload string.

If an upload doesn't match exactly what's allowed, it isn't quietly "cleaned up" and let through. It's refused, you're told why, and your preview is left untouched. A sanitised attack is still an attack that got halfway in.

Practical version: export your card as a PNG. At preview size it's identical, and nothing about your link is ever a security incident.

Read more