ngrok Alternatives: Expose Localhost to the Internet

What a localhost tunnel does

An app on your computer usually listens on localhost, which only that computer can reach. A localhost tunnel runs a small agent next to the app that opens an outbound connection to a relay server with a public address. Requests sent to the public URL travel down that connection to your local port, so your router never has to accept an incoming connection.

ngrok's own documentation describes a public URL that forwards traffic to your local machine, with authentication and IP restrictions available through its Traffic Policy. The alternatives below differ in who runs the relay, how addresses are assigned and who can reach them by default.

A managed tunneling service runs that relay for you; a self-hosted setup means you run it yourself. Many of these products started as a development tool for demos and webhook testing, so check their limits before you rely on one for something people use every day.

When you need to expose localhost to the internet, and when you don't

A tunnel is worth it when something outside your network must reach your machine:

Webhooks: payment, shipping and chat providers send events to a public HTTPS URL, not to localhost.
Demos: a client or teammate needs to try a build before you deploy it anywhere.
Remote testing: a tester on another network, or your phone on mobile data, needs the real app.

Sometimes you can skip the tunnel. For a phone on the same Wi-Fi, let your dev server listen on your local network and open your computer's local IP address on the phone. Vite's --host option does this, but it also listens on public addresses, so turn it off afterward. If you are testing Stripe webhooks, Stripe's webhook docs show stripe listen --forward-to localhost:4242/webhook for local testing without a public URL.

Security risks of exposing a local app

A tunnel makes your app reachable by anyone who has, guesses or is forwarded the address, and development setups are rarely built for that. Flask's documentation, for example, warns that its built-in debugger allows executing arbitrary Python code from the browser and must not run in production.

Weak or no login: local apps often skip authentication or use a test admin account with a weak password.
More exposed than you think: the tunnel exposes everything the app can reach, such as admin pages, files, internal APIs and its database.
Secret links leak: a hard-to-guess URL is not access control. Links get forwarded, pasted into tickets and saved in browser history.
Forgotten tunnels: a tunnel left running, or a credential that never expires, keeps the door open long after the demo.
Unverified webhooks: Stripe notes that without signature verification, an attacker could send fake events to your endpoint.

Before you share a link, turn debug mode off, use test data, put a login or access rule in front of the app and verify webhook signatures. Afterward, shut the tunnel down and revoke its credential.

Cloudflare Tunnel vs ngrok

Cloudflare Tunnel runs a lightweight daemon, cloudflared, that makes outbound-only connections to Cloudflare, so your origin needs no publicly routable IP address and no inbound listener. Like ngrok, it relies on an agent that dials out. The differences are in setup and access.

Quick Tunnels: cloudflared tunnel --url http://localhost:8080 creates a temporary trycloudflare.com address without a Cloudflare account or domain. The Quick Tunnels page says the hostname changes each time and that they are for testing and development, with a cap of 200 in-flight requests, no Server-Sent Events and no uptime guarantee.
Named tunnels: to publish on your own hostname, add a domain to Cloudflare and create a published application route. Cloudflare's setup guide notes that, without further controls, anyone on the internet can then reach the app.
Access control: adding the app to Cloudflare Access puts a sign-in through an identity provider in front of it. ngrok offers its own controls, such as OAuth and IP restrictions, through Traffic Policy.

Other ngrok alternatives: Microsoft dev tunnels and Tailscale Funnel

Microsoft dev tunnels: the devtunnel command-line tool shares a local port after you sign in with a Microsoft, Microsoft Entra ID or GitHub account (devtunnel host -p 8080). Microsoft's overview says tunnels are accessible only to you by default, and labels the feature a public preview for ad hoc testing and development, not production.
Tailscale Funnel: if your devices already use Tailscale, tailscale funnel 3000 routes traffic from the internet to a local service. Tailscale's Funnel docs require MagicDNS, HTTPS certificates and a policy attribute, allow only ports 443, 8443 and 10000 over TLS, apply bandwidth limits you cannot configure, and use ts.net names. Check that page for its current release status.

Funnel is public to anyone with the address. To share only with your own devices or team, Tailscale points to Tailscale Serve instead.

Self-hosted ngrok alternatives

If you would rather not route traffic through a tunnel company, run the relay yourself on a server with a public address, such as a small cloud virtual machine. Open-source tools cost nothing to download, but updates, TLS certificates, logins and logs become your job.

SSH remote forwarding: ssh -R 8080:localhost:3000 you@your-server makes port 8080 on the server forward to port 3000 on your machine. The OpenSSH manual notes the server binds that port to loopback only by default, so add a reverse proxy on the server for HTTPS.
frp: the open-source frp project (Apache-2.0) is a reverse proxy for exposing a local server behind NAT or a firewall: its server (frps) runs on the public machine, its client (frpc) connects out from yours, and it supports TCP, UDP, HTTP and HTTPS.
A VPN back to your network: if only known people need access, a private VPN avoids public exposure but needs software on each device.

If you want a hosted relay with named, private-by-default tunnels instead, ASL Tunnel is described at the end of this guide.

Port forwarding vs a tunnel

Port forwarding is a router rule that sends incoming traffic on one port straight to your computer, which becomes reachable at your public IP address. Nothing sits in the middle, so HTTPS, logins and updates are all up to you, and that address can change.

Many mobile and some home connections use carrier-grade NAT, sharing one public address among many customers. If your router's WAN address is in 100.64.0.0/10, the shared address space defined in RFC 6598 for that purpose, a port forward will not make you reachable from the internet. A tunnel works either way because it connects from your side.

The trade-off is trust: a hosted tunnel's relay carries your traffic, so check what each provider stores and for how long.

Checklist for choosing an ngrok alternative

Traffic type: web only, or also TCP, UDP, WebSockets or Server-Sent Events? If you need UDP, confirm the service supports UDP, and check whether it offers TLS tunnels that pass encrypted traffic through untouched.
Address: random and temporary, or stable and on your own domain? Webhooks and shared links need a stable one.
Default access: is a new tunnel public or private, and what sign-in, key or IP rules can sit in front of it?
Control: can you pause or revoke access at once, and is there a record of who changed what?
Data handling: who runs the relay, what it logs and where it runs.
Published limits: request caps, bandwidth limits, uptime commitments and release status.
Your app: does it need its own hostname, or can it run under a sub-path?
Cost: read each vendor's current pricing page yourself, because plans change.
Free tier and paid plan: what does the free tier limit, such as bandwidth, connections or custom domains, and what does a paid plan add? Check the vendor's current pricing page, because plans change.
Private access: can you require a sign-in, or keep the app off the public internet and reachable only from your own devices, for example with the Tailscale client installed on each one?

Where ASL Tunnel fits

ASL Tunnel is an early-access service for reaching an app on your own machine without opening a port in your firewall. A small program (Windows, Linux or Raspberry Pi) dials out and holds the connection, and your app gets a stable address under a name you reserve, never reissued to anyone else.

New tunnels are private: visitors need the access link you hand out, after which their browser holds a signed pass for that address, valid for up to eight hours. You can make a tunnel public on purpose, for example for a webhook provider that cannot carry a key. Pausing or revoking a tunnel drops the live connection at once.

The product page states its limits: web and app traffic only (no remote desktop, direct database access or raw network protocols), apps served under a sub-path of a shared address, a relay run by ASL rather than self-hosted, and one location without automatic failover. Accounts are set up directly with ASL, not through self-serve signup, and pricing is quoted after a conversation. See how ASL Tunnel works and its full list of limits.

Frequently asked questions

Which ngrok alternative should I use?

It depends on the job: a quick temporary demo, access limited to your own account, sharing within an existing Tailscale network, or full control on your own server. Use the checklist above to compare the options in this guide.

Is there a free ngrok alternative?

Cloudflare says its Quick Tunnels need no account or domain, and open-source tools such as OpenSSH and frp cost nothing to download, though self-hosting needs a server with a public address. Prices change, so check each vendor's own pricing page.

Is it safe to expose localhost to the internet?

It can be, briefly and with care. Turn off debug modes, use test data, require a login or access rule, verify webhook signatures and close the tunnel when you are done.

What is the difference between Cloudflare Tunnel and ngrok?

Both use an agent that connects outward, so no inbound port is needed. Cloudflare offers account-free Quick Tunnels and named tunnels on your own domain, which you can protect with Cloudflare Access; ngrok gives a public URL with Traffic Policy controls.

Can I self-host an ngrok alternative?

Yes. Use SSH remote forwarding or frp with a server that has a public address, plus a reverse proxy for HTTPS. You then maintain the server, certificates, logins and logs yourself.

How do I expose a local server to the internet without a tunnel?

Port forwarding on your router works if your connection has its own public IP address, but it exposes your machine directly and fails behind carrier-grade NAT. For a phone on the same Wi-Fi, a dev server listening on your local network is usually enough.

Related guides

Explore the complete product

Read features, current access and limitations

ngrok Alternatives: How to Expose Localhost to the Internet Safely