Insacret: Does It Still Work, and Is It Safe?

Insacret did not show us any stories. In two tests on 24 September 2026, about an hour apart, its page for a public Instagram account stayed on grey loading placeholders, waiting on a bot check that never cleared in our automated browser. What it did do on every visit was install a push-notification service worker: code that can send notifications to your device after you leave the site, if you click Allow.

Below is what we tested, what that worker does, who else sees your visit, and how to keep your own account away from sites like this one.

The short answer

• Does Insacret still work? Not in our tests. Both attempts stopped at a bot check before any story loaded. A person may get further than our automated browser did.
• Is it safe? It asked for no password and opened no pop-ups. But it installs a push-notification worker tied to a third-party domain, names no company behind it, and publishes no privacy policy that we could find.
• Does the account owner find out? No. Insacret does not use your Instagram account, so nothing ties the view to you on Instagram.
• Can it show private accounts? No. It says itself that it works with public accounts.
• Is it allowed? No. It works against Instagram’s Terms of Use.

How we tested

On 24 September 2026 we opened insacret.org twice in a separate browser with no Instagram account signed in and asked it for the stories of natgeo, National Geographic’s public account. We recorded every request the pages made, decoded the service worker the site installed, and looked for its privacy policy, terms and contact details. We did not allow notifications or get past any security check. Our editorial policy explains how pages like this one are made and corrected.

What happened when we used it

• The home page loaded. insacret.org forwards to insacret.org/en, which shows a username box under a block of Google ads.
• The stories page never filled in. Entering natgeo opened insacret.org/en/stories/natgeo, which showed grey placeholders. The page loaded Cloudflare’s Turnstile bot check and made no request for story data while it waited. After more than 20 seconds, in both attempts, nothing had loaded.
• Nothing was asked of us. There was no password field, and no new tab opened.

The notification worker

A service worker is a script your browser keeps for a website so it can work in the background, including receiving push notifications after the page is closed. Insacret installs one as soon as a page loads.

• Its code is scrambled with a simple letter-rotation cipher. Decoded, it handles four kinds of events: incoming push messages, clicks on a notification, closed notifications, and changes to the push subscription.
• It carries a zone number, 9474884, is set to re-subscribe when it is installed again, and loads the rest of its code from a third-party domain, aiharsoreersu.net.
• The same pages load scripts from eechicha.com and my.rtmark.net, and the eechicha.com script carries the same zone number.

This matches how push-advertising networks work. If you click Allow on the site’s notification prompt, whoever runs those domains can send notifications to your device after you leave, and they appear like system alerts. Our test browser blocks notification requests, so we did not see the prompt itself.

If you already allowed Insacret’s notifications, remove the permission. In Chrome on a computer, open Settings, then Privacy and security, then Site settings, then Notifications. On Android, open Chrome’s Settings, then Site settings, then Notifications. Deleting the site’s stored data in the same area removes the worker too.

Who else sees your visit

On the home page Insacret made 62 requests, 13 of them to outside servers: Google’s advertising, consent and analytics services and reCAPTCHA, Cloudflare’s bot check and web analytics, and the eechicha.com and my.rtmark.net scripts tied to the notification worker. Imginn, tested the same day, shares more with advertisers but installs no worker at all.

What Insacret says about itself

• Its FAQ answers “Is Insacret safe to use?” with “Yes. We always care about user’s privacy.”
• We found no privacy policy or terms of use. The site links none, and the usual addresses for them return “not found”.
• Its contact page names no company. It gives a Proton Mail address made of random letters and a street address in Sweden, with no business name attached.
• Its About Us page describes an Instagram downloader, not the people behind it. The domain was registered in May 2024, and its owner’s details are hidden.

Is Insacret allowed?

Instagram’s Terms of Use forbid “accessing or collecting information in an automated way without our express permission”, which is how every viewer site gets its content, and Instagram has taken viewer domains away from their operators through formal disputes; our Picuki check lists two of those cases. Downloading and reposting someone else’s photos or videos can also infringe their copyright.

If you do not want your account on Insacret

• Make your account private. Viewer sites can only reach public accounts. In the Instagram app, go to your profile, tap the menu in the top right, then tap Account privacy under Who can see your content and turn on Private account (Instagram’s steps). Business profiles have to switch back to a personal account first.
• Share sensitive stories with Close Friends only. Those stories are not public, so viewer sites cannot show them.
• Do not expect a removal form. We found none on Insacret; its contact page offers only an email address.

Frequently asked questions

Is Insacret safe to use?

It asked for no password and opened no pop-ups in our test, but it installs a service worker built to receive push notifications from a third-party domain, and it publishes no privacy policy that we could find. Do not allow its notifications.

Does Insacret still work?

Not in our tests on 24 September 2026. Its stories page waited on a Cloudflare bot check that never cleared in our automated browser, so a person may get further than we did.

Does Insacret notify the person whose stories I view?

Insacret does not use your Instagram account, so a story you open there cannot appear under your name in the owner’s list of viewers.

Is it legal to use Insacret?

It works against Instagram’s Terms of Use, which forbid collecting information in an automated way without permission. Downloading and reposting someone else’s photos or videos can also infringe their copyright. This is general information, not legal advice.

We will re-test Insacret if its behaviour changes. If you see something different, tell us through the contact form.