Introduction

maxRequestLength is an ASP.NET setting on httpRuntime that limits request size in kilobytes. The maximum allowed value is not arbitrary; it is constrained by the configuration property's range. In classic ASP.NET configuration, the documented maximum is 2097151, which is just under 2 GB when interpreted as kilobytes. The more practical answer, though, is that upload limits are usually controlled by more than one setting, so raising only maxRequestLength is rarely enough.

What maxRequestLength actually means

The setting lives in web.config under system.web:

1<configuration>
2  <system.web>
3    <httpRuntime maxRequestLength="51200" executionTimeout="3600" />
4  </system.web>
5</configuration>

The value is in kilobytes, not bytes. So 51200 means roughly 50 MB.

According to the ASP.NET configuration metadata, the allowed range tops out at 2097151. That is the maximum configuration value for the property itself.

Why that is not the whole upload story

A larger request still has to pass through the rest of the hosting stack. In IIS-hosted applications, requestFiltering also matters, especially maxAllowedContentLength, which is measured in bytes and can block the request before ASP.NET sees it.

A common pairing looks like this:

1<configuration>
2  <system.web>
3    <httpRuntime maxRequestLength="51200" executionTimeout="3600" />
4  </system.web>
5  <system.webServer>
6    <security>
7      <requestFiltering>
8        <requestLimits maxAllowedContentLength="52428800" />
9      </requestFiltering>
10    </security>
11  </system.webServer>
12</configuration>

If these two settings disagree, the lower effective limit usually wins.

In practice, that means upload debugging often has two layers:

• ASP.NET rejects the request because maxRequestLength is too low
• IIS rejects the request before ASP.NET runs because maxAllowedContentLength is too low

Those failures can look similar from the browser side, so checking both settings saves time.

Pick a realistic value instead of the theoretical maximum

Even though 2097151 is the documented ceiling for maxRequestLength, using the maximum is usually a bad default. Very large requests increase:

• memory pressure
• upload time
• timeout risk
• denial-of-service exposure

So the right value is not "the biggest possible number." It is the smallest value that still supports the legitimate payload sizes your application expects.

Understand the stack you are configuring

This setting belongs to classic ASP.NET on System.Web. If you are working in ASP.NET Core, maxRequestLength is not the setting you should be tuning. That is one reason this question often causes confusion in mixed or migrated applications.

Before changing the configuration, make sure you know:

• whether the app is classic ASP.NET or ASP.NET Core
• whether IIS, a reverse proxy, or both enforce upload limits
• whether the request is buffered or streamed

Large uploads are often better handled with streaming or chunked designs instead of simply raising every limit.

Common Pitfalls

The biggest mistake is increasing maxRequestLength alone and wondering why uploads still fail. IIS request filtering may reject the request first.

Another issue is treating the documented maximum as a recommended value. A near-2-GB request limit is rarely a sensible operational default.

Developers also forget timeouts. Even if the size limit is high enough, a slow upload can still fail because request execution time is too short.

Finally, be careful about framework generation. maxRequestLength is a classic ASP.NET setting, not the upload limit mechanism for ASP.NET Core.

Summary

• The documented maximum value of maxRequestLength is 2097151.
• The setting is measured in kilobytes, not bytes.
• Upload behavior is also constrained by IIS settings such as maxAllowedContentLength.
• The best production value is usually much smaller than the theoretical maximum.
• Check whether you are configuring classic ASP.NET or ASP.NET Core before changing upload settings.