Cloudflare Tunnel vs ngrok vs Tailscale Funnel
Which one fits which job, and when qURL™ fits better because nobody else should reach the app.
All three give your app a public address. Cloudflare Tunnel puts it on your own domain and can add Cloudflare Access in front; ngrok gives you a free dev domain once you add an authtoken; Tailscale Funnel publishes a ts.net name anyone can reach. If one person or agent needs one private app for a while, qURL sends them an expiring link and gives the app no public address.
Facts checked October 1, 2026 against each vendor’s documentation or our tests. Download the data
Which one to use
| If you need | Use | Why |
|---|---|---|
| Webhooks, or a public API anyone can call | ngrok | A stable public dev domain on the free plan, and Traffic Policy for OAuth, OIDC, or IP rules when you need them. |
| A lasting hostname on your own domain, behind your company sign-in | Cloudflare Tunnel with Cloudflare Access | The hostname lives on your Cloudflare domain, and Access policies decide who gets through. |
| A public demo from a device already on your tailnet | Tailscale Funnel | One command on a tailnet device, on ports 443, 8443, or 10000. Anyone on the internet can open it. |
| Teammates who are already on your tailnet | Tailscale Serve, not Funnel | Serve keeps access private to authorized Tailscale users and passes viewer identity to the app. |
| Give an agent access to a private app that needs an Authorization header | qURL | qURL can add the app’s credential to requests, so you do not need to build a separate proxy. Requires an advanced CLI setup; see the reference. |
| One person or agent needs one private app, for a while | qURL | No account and no public address. Each recipient gets a link that is single-use by default and expires within 24 hours. |
The command to a first shareable URL
| Tool | What you install | Command to the first shareable URL |
|---|---|---|
| Cloudflare Tunnel (named) | cloudflared | Create the tunnel in the dashboard, run the cloudflared install command it shows, then add a published application route |
| ngrok (free plan) | ngrok agent | ngrok config add-authtoken <TOKEN>
ngrok http 8080 |
| Tailscale Funnel | Tailscale client 1.38.3 or later (an open-source variant on macOS) | tailscale funnel 3000 |
| qURL CLI | qurl CLI (Homebrew or release download) | qurl publish http://127.0.0.1:3000
qurl share <CRID> |
All four, side by side
| Question | Cloudflare Tunnel (named) | ngrok (free plan) | Tailscale Funnel | qURL CLI |
|---|---|---|---|---|
| Account needed before the first URL | Yes: account plus a domain on Cloudflare developers.cloudflare.com | Yes: account and authtoken ngrok.com | Yes: a tailnet with MagicDNS, HTTPS certificates, and the funnel node attribute tailscale.com | No. The first publish creates the device identity our test |
| What the URL looks like | Stable hostname on your own domain developers.cloudflare.com | One assigned dev domain per account (ngrok-free.app / ngrok-free.dev), stable ngrok.com | Stable machine-name.tailnet-name.ts.net; machine names are published in Certificate Transparency logs tailscale.com | A qurl.link access link per recipient; the app answers at r_<id>.qurl.site, a name absent from Certificate Transparency logs our test |
| Who can reach it | Public unless you add a Cloudflare Access application developers.cloudflare.com | Public: anyone with the URL ngrok.com | Public: anyone on the internet tailscale.com | No one until a link is opened; then the opener’s public IP for that session, including other devices behind that IP layerv.ai |
| Warning page shown to visitors | Not documented developers.cloudflare.com | Yes, on free-plan browser traffic (ERR_NGROK_6024) ngrok.com | Not documented tailscale.com | None our test |
| Visitor access control | Cloudflare Access policies; service tokens for machines developers.cloudflare.com | Traffic Policy: OAuth, OIDC, basic auth, IP restrictions (free plan: 3 OAuth/OIDC users a month) ngrok.com | None on Funnel traffic; Funnel requests carry no Tailscale identity headers tailscale.com | Single-use access link by default; link and session lifetimes. IP allow and deny lists and other rules can gate links through the API, not the CLI layerv.ai |
| Link expiry | No per-link expiry; Access session settings apply developers.cloudflare.com | No built-in expiry; free endpoints have no timeout and stay up while the agent runs ngrok.com | No; runs until you turn it off tailscale.com | Yes. qurl share returned a 24-hour link in our no-account test; no-account links are capped at 24 hours our test |
| Single-use links | Not documented developers.cloudflare.com | Not documented ngrok.com | No tailscale.com | Yes, the default for qurl share our test |
| Protocols | HTTP(S); TCP, SSH, RDP, SMB with cloudflared on the client developers.cloudflare.com | HTTP(S); TCP after card verification ngrok.com | HTTPS proxy, TCP, TLS-terminated TCP; ports 443, 8443, and 10000 only tailscale.com | HTTP(S), WebSocket, SSE; no raw TCP our test |
| Free-tier limits | Available on all plans; 1,000 tunnels per account, 25 replicas per tunnel developers.cloudflare.com | 3 endpoints, 1 GB/month out, 20,000 HTTP requests/month, 4,000 requests/min ngrok.com | Available on all plans; non-configurable bandwidth limits, not published; beta tailscale.com | Without an account: up to 3 active resources, with links that last up to 24 hours github.com |
What they have in common, and where qURL differs
Cloudflare Tunnel, ngrok, and Tailscale Funnel all answer the same question: how do I give this app an address other people can reach? Each puts the app on a public name, then leaves it to you to decide who gets through: Cloudflare Access policies, ngrok Traffic Policy, or, for Funnel, the app’s own sign-in.
qURL answers a narrower question: how do I let this one person or agent in, for a while? The app gets no public address. qurl publish registers it, and qurl share prints a link for one recipient that is single-use by default and expires within 24 hours. It suits a client preview, a check on your phone, or an agent that needs a private target. It does not suit webhooks, a public API, or raw TCP, which is where the three tunnels win.
Frequently Asked Questions
Which of the three is private by default?
None. A Cloudflare Tunnel hostname is public unless you add a Cloudflare Access application, an ngrok URL is public unless you add a Traffic Policy, and Tailscale Funnel is public to anyone, with no access control on Funnel traffic. Tailscale Serve is private, but viewers need a Tailscale account and client. With qurl 3.4.1 or later, a plain publish makes the app private: it opens only for the publisher’s devices and the people and devices the publisher allowed. A single-use access link is one way to let a recipient in.
Do any of them work without an account?
No. Cloudflare Tunnel needs a Cloudflare account and a domain on Cloudflare, ngrok needs an account and authtoken, and Funnel needs a tailnet. Cloudflare quick tunnels on trycloudflare.com skip the account, and so does the qURL CLI.
Can I give someone a link that expires or works once?
Not with these three. ngrok endpoints have no built-in expiry and stay up while the agent runs, Cloudflare Tunnel has no per-link expiry (Access session settings apply), and Funnel runs until you turn it off. None of them documents single-use links. With no flags, qurl share prints a link that can be opened once and expires within 24 hours.
Which one gives me a stable URL?
All three. Cloudflare Tunnel gives you a stable hostname on your own domain, the ngrok free plan gives each account one stable dev domain on ngrok-free.app or ngrok-free.dev, and Funnel uses machine-name.tailnet-name.ts.net, a name that is published in Certificate Transparency logs. qURL gives each recipient their own access link instead of one shared URL.
What does each one cost to start?
Cloudflare Tunnel is available on all Cloudflare plans. The ngrok free plan includes 3 endpoints, 1 GB a month of outbound data, and 20,000 HTTP requests a month. Funnel is available on all Tailscale plans with bandwidth limits Tailscale does not publish, and it is in beta. The qURL CLI without an account allows up to 3 active resources, with links that last up to 24 hours.
Who can open a qURL link?
Whoever holds it, once: with no flags, qurl share prints a single-use link. Opening it admits the network address it was opened from for the session, which lasts 1 hour by default for an app published from the CLI. Other devices on the same public IP address, such as an office or café network, can reach the app until the session ends, so keep your app’s own sign-in for anything sensitive. By default a link admits whoever opens it; access rules set through the API, such as IP allow and deny lists, can restrict that.
Share one app without a public address
Install the qURL CLI, then publish the app you have running. No sign-up.
New to qURL? Start at qurl.link