NFT storage: on-chain, IPFS, Arweave, and HTTPS

Which NFT storage method is strongest?

There is no single storage label that answers every risk. Evaluate three properties separately: whether the address identifies fixed bytes, whether those bytes remain retrievable, and who can change the pointer used by the token.

Inline on-chain data

Metadata or media returned directly from contract state has the fewest external retrieval dependencies. It commonly appears as a data: URI or as content assembled by contract code. Availability then follows the chain and the software needed to call it.

On-chain location does not guarantee immutability. Upgradeable logic, editable storage, privileged roles, or dependencies on another contract can still change the output.

IPFS and IPNS

An IPFS CID is content-addressed: changing the bytes produces a different identifier. That protects integrity, but it does not guarantee that a node continues to store and provide the content. Important assets should be pinned by more than one independent operator.

IPNS adds a mutable name that can point to different IPFS content. It is useful when updates are intentional, but the name controller becomes another trust dependency. An HTTPS IPFS gateway adds a gateway-specific availability dependency even when the path still contains a valid CID.

Arweave

An ar:// URI identifies data recorded for long-term storage on Arweave. It avoids a project-owned web server and is designed around durable availability. Rendering still relies on the Arweave network and on gateways or clients that can retrieve the transaction.

HTTPS hosting

A normal web URL is straightforward to serve, but the domain and server operator can replace or remove the response. DNS, hosting accounts, application databases, and certificates become part of the NFT’s practical dependency chain. The same URL can return different bytes without any on-chain event.

Gateway URLs and nested assets

Always inspect the complete reference graph. Metadata at an immutable CID may point to an HTTPS image. An inline SVG may load a font or image from a centralized host. A gateway URL may expose a recoverable CID but still fail in clients that do not rewrite gateways. The weakest critical dependency can determine whether the NFT renders.