ngrok alternatives, from the people who build ngrok
Most people look for an ngrok alternative for one of four reasons: they hit a free-plan limit, they need to self-host or run open source, they need UDP, or their stack already lives on Cloudflare. All four are good reasons, and for some of them, the other tool is also the better pick.
The tools below are sorted by the job they do best. For our side of it, skip to where ngrok still wins, and where it doesn't.
Pick by job
Hosted, free, and quick
Cloudflare Tunnel
Cloudflare Tunnel is free and fast if your domain is already on Cloudflare. It's built for HTTP. Other TCP services need cloudflared or the Cloudflare client on the user's machine, except SSH, RDP, and VNC, which can also run in a browser. Quick tunnels need no account but get a new random URL each time. A tunnel on your own domain means adding that domain to Cloudflare. Cloudflare's CDN terms also let them limit free-plan use that serves video or a disproportionate share of pictures, audio, or other large files.
Pick it when your site already lives on Cloudflare and you're exposing web services. Detailed comparison: ngrok vs. Cloudflare Tunnel.
Get started with Cloudflare Tunnel
Tailscale Funnel
If you already run Tailscale, Funnel is one command to put a tailnet service on the internet. It only works on ports 443, 8443, and 10000, and on *.ts.net names, and Tailscale doesn't document a way to require a login before traffic reaches a Funnel.
Pick it when the service is already on your tailnet and a ts.net URL is fine. Detailed comparison: ngrok vs. Tailscale.
Get started with Tailscale Funnel
Pinggy
Pinggy starts a tunnel with a single ssh command, so there's nothing to install. It handles HTTP, TCP, UDP, and TLS. Free tunnels time out after 60 minutes and use random subdomains.
Pick it when you can't or won't install an agent and a short-lived URL is enough.
Get started with Pinggy
localtunnel
localtunnel gives you a quick public HTTP URL from npm. The client is MIT-licensed, and you can self-host the server. It's HTTP only.
Pick it when you're already in a Node project and want a throwaway link in one line.
Get started with localtunnel
LocalXpose
LocalXpose is a tunneling service with a desktop app. The free tier gives you 2 time-limited HTTP tunnels. TCP, TLS, and UDP need Pro, from $8/mo billed annually.
Pick it when you'd rather click than type, and you want UDP on a hosted service.
Get started with LocalXpose
Open source and self-hosted
zrok
zrok is an open-source (Apache-2.0) sharing tool built on OpenZiti. It supports public and private shares over HTTP, TCP, and UDP. You can use the free hosted service (5 GB/day, no card required) or run your own instance.
Pick it when open source and self-hosting are requirements, and you still want a hosted option to start on.
Get started with zrok
frp
frp is the long-standing open-source (Apache-2.0) reverse proxy. You run the server on your own VPS, so you own the whole path and all the ops work. It's very flexible, and you configure it by hand.
Pick it when you already have a VPS, want full control, and don't mind maintaining it.
Get started with frp
Pangolin
Pangolin is a self-hosted alternative to Cloudflare Tunnel with identity-aware access built in, and it has become popular with the self-hosting crowd. Its login only protects HTTP resources, not raw TCP/UDP. The Community Edition is AGPL-3, and there's also a managed Pangolin Cloud.
Pick it when you want Cloudflare Tunnel's model on your own server, with a login page in front of web apps.
Get started with Pangolin
inlets
inlets is a commercial tool for self-hosted tunnels. It includes a Kubernetes operator, and plans start at $25/mo for personal use.
Pick it when you want self-hosted tunnels with commercial support, especially into Kubernetes.
Get started with inlets
When ngrok is the better call
- You need more than HTTP. ngrok supports TCP and TLS endpoints, not only web traffic, and visitors connect without installing anything.
- You want security in the ngrok cloud, not in your app. OAuth, OIDC, JWT validation, mutual TLS, IP restrictions, rate limiting, and header rewrites are all declared in Traffic Policy and enforced before traffic reaches you.
- You want to see what hit your service. Request inspection and replay are built in, which is most of what debugging a webhook or an API integration takes.
- You're past localhost. The same agent that shares your laptop also runs in production: the Kubernetes operator, load balancing across agents, and connectivity into customer networks and devices.
- Someone else's security team has to approve it. ngrok is SOC 2 Type 2 and GDPR compliant. HIPAA is self-serve on Pay-as-you-go: turn on the add-on and sign the BAA yourself in the dashboard, no sales call. You get custom domains, SSO, RBAC, and one outbound connection with no inbound ports. See security.
- Self-hosting isn't the point. If running your own tunnel server sounds like a hobby rather than a requirement, the ngrok cloud is less work.
When it isn't
If you need a fully self-hosted, open-source stack, use zrok, frp, or Pangolin. If your whole world is already Cloudflare, Cloudflare Tunnel is the path of least resistance. If you need UDP, look at zrok, Pinggy, or frp: ngrok doesn't do UDP. And if what you actually want is a private network between your own machines, that isn't a tunnel at all; see ngrok vs. WireGuard.
If you're trying ngrok for the first time, the free plan includes a static domain, and the getting started guide takes about a minute. Most people start by sharing localhost.
Head-to-head comparisons
ngrok alternatives questions
Anything else about ngrok? Ask it below.
Answers come from ngrok.com and the ngrok docs, and can be wrong. Check the linked pages before you rely on one.
Still not sure?
Try it in one command.
Get your app online with a free static domain. No icky DNS migration or worrying about servers.