ASL Tunnel — Source library
Public documentation snapshot: 2026-09-08
Share your local app. Open no ports.
Reach an app running on your own machine from anywhere, without opening a port in your firewall.
Share your local app. Open no ports.
Built for: A developer who needs a client to look at a build running on their laptop this afternoon · A small team catching webhooks from a payment or shipping provider on a machine behind an office router · An agency showing work in progress to a customer without deploying it anywhere first · Anyone running a dashboard, camera feed, or internal tool on a small computer at home or in a back room
ASL Tunnel exists because of this.
You have something running on a machine you control. A build a client wants to look at. A webhook that a payment provider needs to reach. A dashboard on a small computer in the back room. A camera feed, a print queue, an internal tool nobody wants to move to the cloud. It works perfectly on that machine. The moment somebody else needs to see it, everything gets hard. Every answer costs you something. Forwarding a port on your router puts a permanently open door on the public internet, and from that moment you own defending it. A fixed public address means a call to your provider and another line on the bill, and plenty of connections share addresses in a way that makes it impossible anyway. A private network means everyone who wants a look installs software and gets an account first. Free sharing tools hand you a random address that changes on every restart, no list of who connected, no way to cut one person off, and no record afterward. Then there is the part nobody writes down: the temporary hole stays open. The demo link gets forwarded to three people you did not pick. The credential that was supposed to last an afternoon is still working in March. The person who set it up moved on, and now nobody can say which of these things exist or how to switch one off. You find out when somebody shows you an address you do not recognize, and you cannot tell whether it is yours.
ASL Tunnel exists because of this.
Named, reserved tunnels instead of a random address that changes on restart — a link you shared last year still means what it meant then, and never points at somebody else's app.
ASL Tunnel exists because of this.
Control that takes effect while the connection is live: revoking or pausing drops the open connection immediately rather than waiting for a credential to age out.
ASL Tunnel exists because of this.
A tamper-evident record of every administrative action, exportable as a spreadsheet, in a category of tool that usually keeps none.
ASL Tunnel exists because of this.
Traffic inspection that structurally cannot capture request or response contents — it is not a filter that could be misconfigured, the content is never read in the first place.
ASL Tunnel exists because of this.
Per-person permissions with a deliberate, expiring, audited path for outside support access, rather than one shared admin password.
ASL Tunnel exists because of this.
Payment trouble is handled without silently killing your service: once an account has paid successfully at least once, a later failed payment buys a full day of grace, the owner is told exactly what failed and by when, and a visitor to the address is told only that it is temporarily unavailable.
ASL Tunnel exists because of this.
Set up a new machine by redeeming a one-time code that expires in ten minutes, instead of pasting a long-lived credential through chat or email.
How ASL Tunnel works, start to finish.
ASL Tunnel gives one app on one machine a fixed web address, without that machine ever accepting an incoming connection. You install a small program on the computer that runs your app and tell it which local port to use. It dials out to ASL Tunnel and holds that line open. From then on, anyone you allow can open a normal web address in a normal browser and land on your app. Your router keeps every door shut. Nothing on your machine is listening for strangers, so there is no port to scan and no inbound rule to write. The same setup works on a connection that has no fixed public address at all. What travels down that line is a full app experience, not a preview. Pages, forms, file uploads and downloads, large responses that stream as they arrive, and live two-way connections all work, so chat, live-updating dashboards, and progress bars behave the way they do on your desk. Several people can use it at once over the same connection. If the network hiccups, the program reconnects on its own and the address stays the same. Your app is published beneath a path of its own on a shared address rather than on a hostname of its own, so the one real piece of setup work is telling your app that it lives under that path. Redirects that point at a path on your own app, and the paths on cookies your app sets, are corrected for you as they pass through. Links written directly inside your pages, scripts and stylesheets are deliberately left alone, and so is a redirect your app writes as a full address pointing back at its own machine. Most frameworks settle all of this with a single base-path setting. By default nobody can see it. A new tunnel is private: a visitor needs the access link you hand out, and once they use it their browser holds a signed pass scoped to that one address, so the secret never sits in the visible part of the URL and never lands in the stored request record. If you want something genuinely open to the world, you say so explicitly when you create it, which is what a webhook provider that cannot carry a key needs. Every tunnel is a named thing you manage rather than a disposable link. You reserve the name, and it stays yours; it is never handed to anybody else, even after you close the account. From a dashboard or a command line you can pause a tunnel, wake it back up, replace its credential without changing the name, revoke it outright, pause every tunnel on one machine, or throw one switch that stops all traffic while you keep control. Changes take effect immediately: revoking a credential drops the live connection, it does not wait for a page reload. Underneath that, the service keeps the record you will eventually be asked for. Who created what, who turned what off, when. That history is written so a later change cannot quietly rewrite an earlier line, and you can export the tunnel list and the history as spreadsheet files. You can have a message sent by email or into your team chat when a tunnel drops unexpectedly, and deliberate shutdowns you performed yourself never fire a false alarm. If you want to see traffic for one specific tunnel, you can switch on a per-request view that records method, path, result, timing, size and the visitor's network address. It never captures the contents of a request or a response, and credential-carrying headers are stored with the value replaced, so you can see that a request was authenticated without storing the thing that authenticated it.
Everything in the current release.
Each of these is built and working today. Nothing on this list is a roadmap item.
Nothing on your machine listens
The program you install dials out and keeps that line open. Your router never needs a forwarded port and your firewall never needs an inbound rule. There is no open door for anyone to find by scanning, because there is no open door. It works the same on a home or mobile connection that has no fixed public address.
One address that does not change
Your tunnel lives at a stable web address you can put in a document, a webhook field, or an email. Restart your machine, move to a different network, or reconnect after an outage and the address is the same. You are not chasing a new random link every morning.
A name you pick, reserved for good
You choose the name in the address rather than being handed a random string. That name is yours from the moment you reserve it and is never reissued to anyone else, so a link you shared last year can never quietly start pointing at a stranger's app. This holds even if you close the tunnel or the account.
Private unless you say otherwise
A new tunnel is closed to the public. A visitor needs the access link you give them, and their browser then holds a signed pass scoped to that one address, valid for up to eight hours, so the secret does not stay in the visible URL. The key is kept out of the stored request record too, which keeps the path only. Automated callers can present the same key as a header instead. If you actually want something open, you have to ask for it explicitly.
Real apps, not just simple pages
File uploads and downloads, large responses that stream as they arrive, and live two-way connections all pass through, so chat features, live-updating dashboards, and progress indicators keep working. Several people can use the same tunnel at once. Your app does not need to be rewritten to sit behind it.
Switch it off in one action
Pause a tunnel, wake it up, replace its credential while keeping the same name, or revoke it outright. Pause every tunnel belonging to one machine at once when a laptop goes missing. One master switch stops all traffic while leaving you signed in to fix things. Every one of these drops the live connection at the moment you do it, rather than waiting for a credential to time out.
Set up a new machine by scanning a code
Instead of pasting a long-lived credential into a chat window or an email, you can issue a short one-time code for a machine. From the command line it is printed as a square you can scan, and the new machine redeems the code itself to collect its own credential. The code works once, expires ten minutes after it is issued, and stops working the moment you rotate or revoke the tunnel it belongs to.
Know when something drops
Have a message sent by email or into your team chat when a tunnel goes offline unexpectedly, for one tunnel or for everything you own. A shutdown you performed on purpose never sends an alarm, so a routine pause does not wake anybody. A tunnel that flaps in and out only notifies once per five-minute window instead of flooding you.
See what went through, without storing what was in it
Turn on a detailed view for one tunnel and every request through it is recorded: method, path, result, how long it took, how big it was, and the visitor's network address. The contents of requests and responses are never captured at all, because nothing on the relay path ever reads a body into that record. Headers that carry credentials keep the header name but not the value, so you can confirm a request was authenticated without holding the credential. It is off for every tunnel until you switch it on, and old entries are cleared after thirty days.
A history you can hand to someone
Every administrative action is recorded with who did it and when. The record is written so that altering an old entry breaks the chain and shows up as tampering rather than passing silently. You can download the tunnel list and the history as spreadsheet files, and the export is written so a formula hidden inside a field cannot execute when the file is opened.
Roles that fit how a team actually works
An owner can hand out the ability to manage tunnels, alerts, billing or people as four separate permissions, and can take one of those back from a specific person without changing their role. Anyone active on the team can look at what exists; changing something requires the matching permission. Support access from outside your team is granted deliberately, carries a reason and an expiry, and is written into your history the first time it is used.
Limits that keep one tunnel from eating everything
Each tunnel carries its own caps on how many requests can run at once and how large a request or a response may be, and you can edit them per tunnel from the dashboard. There is also a cap on how many tunnels an account can hold, so an automated mistake cannot quietly claim hundreds of names. Default caps are generous: fifty simultaneous requests, twenty-five megabyte uploads, hundred megabyte responses.
Runs on the small stuff
Windows, Linux, and a Raspberry Pi are all supported. On Linux and a Pi it installs as a background service that starts on boot and restarts itself if it stops. On Windows a setup command runs the full check suite against the new copy before swapping it in, and keeps the previous copy so you can go back if an update misbehaves. The program itself is small, with only three outside components bundled into it.
Close your own account, on your own
You can delete your account and shut down your organization yourself, from the app or from the dashboard, without emailing anyone. Doing so takes every tunnel offline, revokes every credential, disconnects live connections and erases your profile. If an organization you own still has other active people in it, deletion is refused with instructions rather than quietly destroying a shared team's service.
Numbers we can stand behind.
Every figure below comes from the product's own release record or test suite, not from a marketing estimate.
Numbers we can stand behind.
Deliberately not a general private network: web and app traffic only, no remote desktop, no direct database exposure, no public list of who is running what.
Surfaces and status.
Status as of 2026-09-02. The relay has run in production continuously since 26 July 2026 and answered live on 2026-09-02 carrying 11 managed tunnels, 4 of them online, across 8 registered machines with traffic enabled. The public service page and the private dashboard both responded the same day, and every change is gated by 167 automated checks. It is early access rather than open enrollment because onboarding is still done by hand: the last fix to the self-serve signup path is staged rather than deployed -- 's 2026-08-18 audit entry records it as "staged and green, awaiting the go to deploy" -- no outside customer account has yet been created through it, subscription plans are not on sale, and neither mobile app is in an app store.
Worth more together.
Products on this platform share one sign-in, one support queue, and one engineering standard. These pair naturally with ASL Tunnel.
Network Sentinel
Watches a network or a set of machines and shows you what changed. It already runs behind an ASL Tunnel connection in practice, so if you want a monitoring console on a box you do not want exposed, the two fit together directly.
ASL Scan
Before you make anything reachable from outside, it is worth knowing what is actually in it. ASL Scan looks for weaknesses in the app you are about to publish, so the thing on the other end of the tunnel is worth defending.
ASL Vault
Tunnel access keys and machine credentials have to live somewhere that is not a chat message or a sticky note. Vault gives them a controlled home with a record of who took one out.
Repo Runner
If you are tunneling a build so a client can look at it, Repo Runner is what produces that build. Automated jobs can hold their own machine credential for the tunnel, separate from any person's login.
ASL Files
Sometimes what you actually need to share is a set of documents, not a running app. Files handles that case directly instead of putting a whole application on the internet to move one folder.
Recent progress.
This product ships often. The most recent verified changes, newest first.
Recent progress.
2026-08-15 , together with the first per-account cap on how many tunnels can be created: reviewing that work turned up a real abuse route, since there had until then been no cap or rate limit on creating tunnels at all, which would have let one account permanently claim desirable names. The plan-by-plan quota numbers were set on.
Recent progress.
2026-08-18 following a pricing decision. Google sign-in landed on.
Recent progress.
2026-08-15 as a third way in alongside email verification and a text-message channel that is built but still not switched on, with one free trial per verified contact so the trial cannot be farmed. Card subscription handling was completed and verified against real renewal and failed-payment events, including a genuine defect caught in that testing where a customer who failed a payment, paid, then failed again would have had their second grace period silently never start. Subscription handling for the phone app followed on.
Recent progress.
2026-08-17 , together with renewal and cancellation notices that arrive even when the customer never opens the app, and a real-device QA pass the same day found and fixed three interface bugs. Self-serve account and organization closure shipped on.
Recent progress.
2026-08-17 , and a bilingual public deletion page with it. A full line-by-line audit on.
Recent progress.
2026-08-18 found a blocker before any customer met it: self-serve signup created an account but never granted the person membership of it, so a real customer would have been locked out of every screen. The fix is written and green against the full check suite but is staged rather than deployed, which is why accounts are still set up by hand. The most recent change, on.
Recent progress.
2026-08-22 , recorded the rewritten native phone client and its tested builds.
Recent progress.
Pricing for ASL Tunnel is quoted after a short conversation about your situation, because the right scope differs from one team to the next. There is no charge for that conversation.
What does it cost?
Pricing is not published, and no plan is on sale yet, so we set accounts up directly rather than through a checkout page. The subscription machinery is built and was verified against real renewal and failed-payment events, and plans differ by how many named tunnels you can hold at once. Tell us roughly how many tunnels you need and we will give you a straight number.
We already use a free tunnel tool. Why change?
The free tools are genuinely good at getting one link working in thirty seconds, and if that is all you need, keep using one. What they generally do not give you is a name you keep, a list of every tunnel your team has open, the ability to cut one person off mid-session, a record of who did what, or an alert when something drops. If you have reached the point where somebody asks 'which of these exist and who can reach them', that is the gap this fills.
How hard is it to move something over?
You install a small program on the machine and tell it which local port to use, which takes a couple of minutes. The one real piece of work is telling your app that it lives under a sub-path rather than at the root of a site, usually one line in its configuration. Redirects that point at a path, and cookie paths, are corrected for you. Links written directly inside your own pages are not, and neither is a redirect your app writes as a full address back to its own machine, so a hand-built app with hard-coded absolute links needs a look first.
Can you see my traffic?
The service relays your traffic, so it necessarily passes through. What is stored is deliberately narrow: request and response contents are never captured, not even when you turn on the detailed per-request view. That view records method, path, result, timing, size and the visitor's network address, and stores credential-carrying headers with the value replaced. It is off unless you switch it on for a specific tunnel, and it clears after thirty days. Access keys are kept out of the stored path. If that boundary is not tight enough for what you are moving, tell us before you start rather than after.
What happens to my tunnels if I stop paying?
Nothing switches off the same day, provided the account has paid successfully at least once before. In that case a failed payment starts a full day of grace and a message telling you exactly what failed and the deadline. If it is still unpaid then, the tunnel stops serving and anyone visiting sees only that it is temporarily unavailable and the owner has been notified, with no billing details shown to your visitors. Paying restores service, and your tunnel names are never released to anyone else. An account whose very first payment fails gets no grace period at all, by design.
Is this actually ready to use?
The relay has run in production continuously since late July 2026 and was carrying live tunnels on the day this page was written, and every change is gated by 167 automated checks including full runs with a real agent connected end to end. What is not finished is the commercial front door: the last fix to self-serve signup is staged rather than deployed, so we still create accounts by hand; no plan is on sale; and the phone apps have passed on real hardware but are not in the app stores. The plumbing is proven and the storefront is not, which is why access is arranged directly for now.
Can I run this on my own hardware instead?
The part that runs on your machine is already yours — it is a small program you install and can stop at any time. The relay that gives you the public address is run by us. If you need the entire path inside your own network with nothing crossing to us, this is not the right product, and we would rather tell you that now than sell you something that does not fit.
What if my internet drops or the machine reboots?
The program reconnects on its own and your address does not change, so links you have already handed out keep working once the machine is back. On Linux and Raspberry Pi it starts on boot and restarts itself if it stops. You can also have a message sent by email or into your team chat when a tunnel goes offline unexpectedly, so you find out from us instead of from a customer.
How do I stop someone who should no longer have access?
Revoke that tunnel's credential, or replace it while keeping the same name so your own links keep working and theirs stop. Either one drops the live connection immediately rather than waiting for anything to expire. If a whole laptop is missing, you can pause every tunnel belonging to that machine in one action, and there is a single switch that stops all traffic at once while you still stay signed in.
Do the people I share a link with need an account?
No. You hand out an access link and they open it in a normal browser. Their browser then holds a signed pass scoped to that one address, valid for up to eight hours, so the secret does not stay sitting in the visible URL. Automated callers such as a webhook provider can present the same key as a header instead, or you can mark a tunnel openly public if the provider cannot carry a key at all.
How do I actually get set up right now?
You talk to us and we provision the account, the organization and the first tunnel name for you, then hand you the credential for your machine. Self-serve signup is built but its final fix is not deployed, so we do not point people at it yet. Setting up further machines afterwards is self-service: you issue a one-time code from the command line and the new machine redeems it itself.
What should I know before I rely on it?
We would rather you hear this from us than discover it later. As of 2026-09-02:
What should I know before I rely on it?
This carries web and app traffic only. It is not a general private network: no remote desktop, no direct database exposure, and no raw network protocols. If you need a machine-to-machine private network, this is the wrong tool.
What should I know before I rely on it?
Signing up is not self-service yet. The signup endpoints answer, but the change that gives a newly created account its owner is staged rather than deployed, so an account created that way today would exist with nobody able to use it. Until that ships we set accounts up by hand, which is why access is arranged directly with us.
What should I know before I rely on it?
Your app has to know it is living under a sub-path rather than at the root of a site. Redirects that point at a path, and cookie paths, are corrected for you. Links written directly inside your own pages, scripts and stylesheets are not, and neither is a redirect your app writes as a full address pointing back at its own machine. Most frameworks handle this with a single base-path setting; a few hand-built apps will need edits.
What should I know before I rely on it?
Alerts when a tunnel drops are built and delivered. Alerts for a credential that is about to expire are not: the event type exists but nothing sends it, so the dashboard flags upcoming expiry seven days ahead visually instead and you have to look.
What should I know before I rely on it?
Tunnel names are permanent by design. Once you reserve one it is never released, even after you delete the tunnel or close your account. That protects your old links, but it also means a name you regret is gone for good.
What should I know before I rely on it?
Subscription plans are not on sale. The card and in-app subscription machinery is built and was verified against real renewal and failed-payment events, but no purchasable plan has been set up on either side, so nothing can be bought today and no price is published.
What should I know before I rely on it?
The Android and iPhone apps are built, and the two Android apps passed a credential-gated journey on a real phone, but neither is in a public app store. Day-to-day management today happens in a browser or from a command line.
What should I know before I rely on it?
Signing up by text message is not switched on; that channel returns a clear message saying so rather than failing silently. The email and Google sign-in channels are provisioned.
What should I know before I rely on it?
The one-time pairing code, and the scannable square that carries it, are a command-line feature. The dashboard does not issue pairing codes.
What should I know before I rely on it?
The service runs from one location. If that location has an outage your tunnels are down until it returns; there is no automatic switch to a second site.
Share your local app. Open no ports.
Prefer email? contact@autosecurelogin.com