Every way to share localhost, compared
qURL™ and 22 tunnel tools, side by side, with a source for every value.
Most localhost tunnels give your app a public URL: ngrok and Tailscale Funnel after you create an account, and Cloudflare quick tunnels, localtunnel, and SSH services such as Pinggy without one. qURL is the only tool here that needs no account or server of your own and gives the app no public URL: each recipient gets an access link that is single-use by default and expires within 24 hours.
Facts checked October 1, 2026 against each vendor’s documentation or our tests. Licensed CC BY 4.0.
Which tool fits, at a glance
| Tool | Account needed before the first URL | Who can reach it | Link expiry | Single-use links | Warning page shown to visitors | Free-tier limits |
|---|---|---|---|---|---|---|
| qURL CLI | No. The first publish creates the device identity our test | No one until a link is opened; then the opener’s public IP for that session, including other devices behind that IP layerv.ai | Yes. qurl share returned a 24-hour link in our no-account test; no-account links are capped at 24 hours our test | Yes, the default for qurl share our test | None our test | Without an account: up to 3 active resources, with links that last up to 24 hours github.com |
| ngrok (free plan) | Yes: account and authtoken ngrok.com | Public: anyone with the URL ngrok.com | No built-in expiry; free endpoints have no timeout and stay up while the agent runs ngrok.com | Not documented ngrok.com | Yes, on free-plan browser traffic (ERR_NGROK_6024) ngrok.com | 3 endpoints, 1 GB/month out, 20,000 HTTP requests/month, 4,000 requests/min ngrok.com |
| Cloudflare Quick Tunnel (trycloudflare.com) | No developers.cloudflare.com | Public, unless --allowed-mail is set developers.cloudflare.com | No; the URL works until cloudflared stops developers.cloudflare.com | Not documented developers.cloudflare.com | Not documented developers.cloudflare.com | 200 in-flight requests; no uptime guarantee; for testing and development developers.cloudflare.com |
| Cloudflare Tunnel (named) | Yes: account plus a domain on Cloudflare developers.cloudflare.com | Public unless you add a Cloudflare Access application developers.cloudflare.com | No per-link expiry; Access session settings apply developers.cloudflare.com | Not documented developers.cloudflare.com | Not documented developers.cloudflare.com | Available on all plans; 1,000 tunnels per account, 25 replicas per tunnel developers.cloudflare.com |
| Tailscale Funnel | Yes: a tailnet with MagicDNS, HTTPS certificates, and the funnel node attribute tailscale.com | Public: anyone on the internet tailscale.com | No; runs until you turn it off tailscale.com | No tailscale.com | Not documented tailscale.com | Available on all plans; non-configurable bandwidth limits, not published; beta tailscale.com |
| Tailscale Serve | Yes: a tailnet with HTTPS certificates enabled tailscale.com | Authorized Tailscale users, including accepted machine-share recipients tailscale.com | No; a foreground session runs until stopped, and --bg keeps it running across reboots tailscale.com | No tailscale.com | Not documented tailscale.com | Free Personal plan: up to 6 users, unlimited user devices tailscale.com |
| localtunnel | No github.com | Public: anyone with the URL github.com | Active while the lt client stays connected; no expiry setting github.com | Not documented github.com | Reminder page that asks for a tunnel password (the creator’s public IP), per the service’s maintainer github.com, unofficial | Not documented github.com |
| Pinggy (free) | No, to start pinggy.io | Public: anyone with the URL pinggy.io | Free tunnels time out after 60 minutes pinggy.io | Not documented pinggy.io | Yes, a one-time browser screening page on free tunnels; non-browser clients skip it; none on Pro pinggy.io | 60-minute tunnel timeout pinggy.io |
| Serveo (free) | No serveo.net | Public: anyone with the URL serveo.net | None documented for HTTP; anonymous public TCP ports last 10 minutes (30 with a registered key) serveo.net | Not documented serveo.net | Yes on the free tier; removed on Pro serveo.net | 3 active tunnels; anonymous TCP: 1 port, 10 minutes, 2 connections, 256 KiB/s serveo.net |
| localhost.run (free) | No account for free domains (SSH key or the nokey user) localhost.run | Public: anyone with the URL localhost.run | No expiry setting; the free domain rotates localhost.run | Not documented localhost.run | Not documented localhost.run | Free domain names change regularly; speed limit localhost.run |
| Microsoft dev tunnels | Yes: GitHub, Microsoft, or Entra ID learn.microsoft.com | Private by default; anonymous access is opt-in learn.microsoft.com | Temporary tunnels end when the host disconnects; persistent tunnels are deleted after 30 days idle; anonymous access can be time-limited learn.microsoft.com | Not documented learn.microsoft.com | Yes, an anti-phishing page on first visit learn.microsoft.com | 5 GB a month and 10 tunnels per user; 1,500 HTTP requests a minute per port; public preview, no SLA learn.microsoft.com |
| zrok (free) | Yes: a free account, no card zrok.io | Your choice per share: public shares are open to anyone with the URL; private shares only to zrok accounts you grant netfoundry.io | Ephemeral shares end with the process netfoundry.io | Not documented netfoundry.io | Yes, an anti-phishing page on the first visit to public shares from unverified free accounts; adding a card removes it zrok.io | 5 GB/day; 7,500 requests per share per 5 minutes netfoundry.io |
| bore (bore.pub) | No, for the public bore.pub server github.com | Public: anyone who connects to the port github.com | bore.pub connections time out after 24 hours, per the maintainer github.com, unofficial | No github.com | None (raw TCP) github.com | 24-hour timeout and a per-source-IP connection limit on bore.pub, per the maintainer; no uptime guarantee github.com, unofficial |
| Expose (free) | Yes: a free account for the auth token expose.dev | Public: anyone with the URL expose.dev | Free connections are time-limited (length not documented) expose.dev | Not documented expose.dev | Not documented expose.dev | Per-connection time limit (length not published); single EU server (Germany); random URLs expose.dev |
| frp | No; you run frps on your own server github.com | Public: anyone who reaches the server port or domain; STCP/XTCP proxies only to visitors with the secret key github.com | Not documented github.com | Not documented github.com | Not documented github.com | No service tier; you run frps on your own server github.com |
| LocalXpose (free) | Yes: a free account and access token localxpose.io | Public: anyone with the URL localxpose.io | Free tunnels are time-limited (length not published) localxpose.io | Not documented localxpose.io | Yes, an interstitial warning page on the free Starter plan localxpose.io | 2 active HTTP/HTTPS tunnels; time limits; interstitial warning page localxpose.io |
| Pangolin | Yes: a Pangolin Cloud account, or the admin account on your own server docs.pangolin.net | Visitors who pass the resource's authentication; Pangolin SSO is on by default docs.pangolin.net | Yes. Share links take an expiration or never expire; deleting a link revokes it docs.pangolin.net | Not documented docs.pangolin.net | A Pangolin login page for unauthenticated visitors docs.pangolin.net | Cloud Basic: 5 users, 5 sites, 5 domains, 15 public resources; Community Edition is free to self-host pangolin.net |
| sish | No, on your own server; your SSH public key goes in its pubkeys directory github.com | Public: anyone with the URL; TCP aliases only to authenticated SSH users docs.ssi.sh | Optional per-tunnel deadline (deadline=15m or a timestamp) docs.ssi.sh | Not documented github.com | Not documented github.com | No free hosted tier; self-host, or use the managed tuns.sh with pico+ pico.sh |
| chisel | No; you run chisel server yourself github.com | Anyone who can reach the reverse port on your server github.com | Not documented github.com | Not documented github.com | None (raw TCP) github.com | No service tier; you run chisel server (the public demo server is gone) github.com |
| rathole | No; you run the rathole server yourself github.com | Public: anyone who connects to the port github.com | Not documented github.com | Not documented github.com | None (raw TCP) github.com | No service tier; you need your own server with a public IP github.com |
| Tunnelmole | No tunnelmole.com | Public: anyone with the URL github.com | Not documented github.com | Not documented github.com | Not documented github.com | Not published; paid plans list custom subdomains and no tunnel timeouts dashboard.tunnelmole.com |
| boringproxy | No; boringproxy server creates the admin login on first run github.com | Public: anyone with the URL, unless the tunnel is password-protected github.com | Not documented github.com | Not documented github.com | Not documented github.com | No service tier; the public demo instance is down github.com |
| inlets (inlets Pro) | Yes: a paid subscription and license key github.com | Public: anyone with the URL, unless OAuth or an IP allowlist is set inlets.dev | Not documented docs.inlets.dev | Not documented docs.inlets.dev | Not documented docs.inlets.dev | No free tier; Personal is $25/month for up to 5 tunnels, no commercial use inlets.dev |
The command to a first shareable URL
| Tool | What you install | Command to the first shareable URL |
|---|---|---|
| qURL CLI | qurl CLI (Homebrew or release download) | qurl publish http://127.0.0.1:3000
qurl share <CRID> |
| ngrok (free plan) | ngrok agent | ngrok config add-authtoken <TOKEN>
ngrok http 8080 |
| Cloudflare Quick Tunnel (trycloudflare.com) | cloudflared | cloudflared tunnel --url http://localhost:8080 |
| Cloudflare Tunnel (named) | cloudflared | Create the tunnel in the dashboard, run the cloudflared install command it shows, then add a published application route |
| Tailscale Funnel | Tailscale client 1.38.3 or later (an open-source variant on macOS) | tailscale funnel 3000 |
| Tailscale Serve | Tailscale client, for you and every viewer | tailscale serve 3000 |
| localtunnel | Node.js package | npx localtunnel --port 8000 |
| Pinggy (free) | Nothing beyond an SSH client | ssh -p 443 -R0:localhost:8000 qr@free.pinggy.io |
| Serveo (free) | Nothing beyond an SSH client | ssh -R 80:localhost:3000 serveo.net |
| localhost.run (free) | Nothing beyond an SSH client | ssh -R 80:localhost:8080 localhost.run |
| Microsoft dev tunnels | devtunnel CLI or VS Code | devtunnel user login
devtunnel host -p 8080 --allow-anonymous |
| zrok (free) | zrok2 CLI (zrok 2.0) | zrok2 enable <TOKEN>
zrok2 share public 8080 |
| bore (bore.pub) | bore binary | bore local 8000 --to bore.pub |
| Expose (free) | expose CLI (PHP PHAR or Composer) | expose token <TOKEN>
expose share http://localhost:3000 |
| frp | frps on a server with a public IP; frpc on your machine (release binaries) | ./frps -c ./frps.toml (on the server)
./frpc -c ./frpc.toml |
| LocalXpose (free) | loclx CLI or GUI (binary, snap, or npm) | loclx account login
loclx tunnel http |
| Pangolin | Pangolin CLI or Newt as the site connector; self-hosting adds a Linux server with a public IP and a domain | pangolin up site --id <ID> --secret <SECRET> --endpoint https://app.pangolin.net
Then add a public HTTPS resource in the dashboard |
| sish | Nothing beyond an SSH client; the sish server (Docker or binary) on your host | docker run ... antoniomika/sish:latest --domain=example.com (on your server)
ssh -p 2222 -R 80:localhost:8080 example.com |
| chisel | chisel binary (client and server in one) | chisel server --port 8080 --reverse (on your server)
chisel client http://<server>:8080 R:3000:localhost:3000 |
| rathole | rathole binary or Docker image, on a server with a public IP and on your machine | ./rathole server.toml (on the server)
./rathole client.toml |
| Tunnelmole | Node.js package or prebuilt tmole binary | npx tunnelmole 3000 |
| boringproxy | boringproxy binary (server and client in one); OpenSSH 7.8 or later | boringproxy server -admin-domain <domain> (on the server)
boringproxy client -server <domain> -user <user> -token <token> -client-name <name>
Then add a tunnel in the web UI |
| inlets (inlets Pro) | inlets-pro binary (client and server in one); inletsctl to create the tunnel server | inletsctl create --provider digitalocean --region lon1 --access-token-file <key-file> --letsencrypt-domain <domain>
Point a DNS A record for <domain> at the server IP
inlets-pro http client --url <URL> --token <TOKEN> --upstream <domain>=http://127.0.0.1:3000 |
Head-to-head comparisons
Each tool in detail
qURL CLI
LayerV · facts checked October 1, 2026 · layerv.ai/cli
- Account needed before the first URL
- No. The first publish creates the device identity our test
- What you install
- qurl CLI (Homebrew or release download) layerv.ai
- Command to the first shareable URL
- qurl publish http://127.0.0.1:3000 qurl share <CRID> our test
- What the URL looks like
- A qurl.link access link per recipient; the app answers at r_<id>.qurl.site, a name absent from Certificate Transparency logs our test
- Who can reach it
- No one until a link is opened; then the opener’s public IP for that session, including other devices behind that IP layerv.ai
- Warning page shown to visitors
- None our test
- Visitor access control
- Single-use access link by default; link and session lifetimes. IP allow and deny lists and other rules can gate links through the API, not the CLI layerv.ai
- Link expiry
- Yes. qurl share returned a 24-hour link in our no-account test; no-account links are capped at 24 hours our test
- Single-use links
- Yes, the default for qurl share our test
- Protocols
- HTTP(S), WebSocket, SSE; no raw TCP our test
- Free-tier limits
- Without an account: up to 3 active resources, with links that last up to 24 hours github.com
ngrok (free plan)
ngrok · facts checked October 1, 2026 · ngrok.com
- Account needed before the first URL
- Yes: account and authtoken ngrok.com
- What you install
- ngrok agent ngrok.com
- Command to the first shareable URL
- ngrok config add-authtoken <TOKEN> ngrok http 8080 ngrok.com
- What the URL looks like
- One assigned dev domain per account (ngrok-free.app / ngrok-free.dev), stable ngrok.com
- Who can reach it
- Public: anyone with the URL ngrok.com
- Warning page shown to visitors
- Yes, on free-plan browser traffic (ERR_NGROK_6024) ngrok.com
- Visitor access control
- Traffic Policy: OAuth, OIDC, basic auth, IP restrictions (free plan: 3 OAuth/OIDC users a month) ngrok.com
- Link expiry
- No built-in expiry; free endpoints have no timeout and stay up while the agent runs ngrok.com
- Single-use links
- Not documented ngrok.com
- Protocols
- HTTP(S); TCP after card verification ngrok.com
- Free-tier limits
- 3 endpoints, 1 GB/month out, 20,000 HTTP requests/month, 4,000 requests/min ngrok.com
Cloudflare Quick Tunnel (trycloudflare.com)
Cloudflare · facts checked October 1, 2026 · try.cloudflare.com
- Account needed before the first URL
- No developers.cloudflare.com
- What you install
- cloudflared developers.cloudflare.com
- Command to the first shareable URL
- cloudflared tunnel --url http://localhost:8080 developers.cloudflare.com
- What the URL looks like
- Temporary *.trycloudflare.com hostname; changes each run developers.cloudflare.com
- Who can reach it
- Public, unless --allowed-mail is set developers.cloudflare.com
- Warning page shown to visitors
- Not documented developers.cloudflare.com
- Visitor access control
- Optional --allowed-mail email one-time PIN (browsers only; change it by restarting cloudflared) developers.cloudflare.com
- Link expiry
- No; the URL works until cloudflared stops developers.cloudflare.com
- Single-use links
- Not documented developers.cloudflare.com
- Protocols
- HTTP(S); Server-Sent Events not supported developers.cloudflare.com
- Free-tier limits
- 200 in-flight requests; no uptime guarantee; for testing and development developers.cloudflare.com
Cloudflare Tunnel (named)
Cloudflare · facts checked October 1, 2026 · www.cloudflare.com/products/tunnel/
- Account needed before the first URL
- Yes: account plus a domain on Cloudflare developers.cloudflare.com
- What you install
- cloudflared developers.cloudflare.com
- Command to the first shareable URL
- Create the tunnel in the dashboard, run the cloudflared install command it shows, then add a published application route developers.cloudflare.com
- What the URL looks like
- Stable hostname on your own domain developers.cloudflare.com
- Who can reach it
- Public unless you add a Cloudflare Access application developers.cloudflare.com
- Warning page shown to visitors
- Not documented developers.cloudflare.com
- Visitor access control
- Cloudflare Access policies; service tokens for machines developers.cloudflare.com
- Link expiry
- No per-link expiry; Access session settings apply developers.cloudflare.com
- Single-use links
- Not documented developers.cloudflare.com
- Protocols
- HTTP(S); TCP, SSH, RDP, SMB with cloudflared on the client developers.cloudflare.com
- Free-tier limits
- Available on all plans; 1,000 tunnels per account, 25 replicas per tunnel developers.cloudflare.com
Tailscale Funnel
Tailscale · facts checked October 1, 2026 · tailscale.com/kb/1223/funnel
- Account needed before the first URL
- Yes: a tailnet with MagicDNS, HTTPS certificates, and the funnel node attribute tailscale.com
- What you install
- Tailscale client 1.38.3 or later (an open-source variant on macOS) tailscale.com
- Command to the first shareable URL
- tailscale funnel 3000 tailscale.com
- What the URL looks like
- Stable machine-name.tailnet-name.ts.net; machine names are published in Certificate Transparency logs tailscale.com
- Who can reach it
- Public: anyone on the internet tailscale.com
- Warning page shown to visitors
- Not documented tailscale.com
- Visitor access control
- None on Funnel traffic; Funnel requests carry no Tailscale identity headers tailscale.com
- Link expiry
- No; runs until you turn it off tailscale.com
- Single-use links
- No tailscale.com
- Protocols
- HTTPS proxy, TCP, TLS-terminated TCP; ports 443, 8443, and 10000 only tailscale.com
- Free-tier limits
- Available on all plans; non-configurable bandwidth limits, not published; beta tailscale.com
Tailscale Serve
Tailscale · facts checked October 1, 2026 · tailscale.com/kb/1312/serve
- Account needed before the first URL
- Yes: a tailnet with HTTPS certificates enabled tailscale.com
- What you install
- Tailscale client, for you and every viewer tailscale.com
- Command to the first shareable URL
- tailscale serve 3000 tailscale.com
- What the URL looks like
- machine-name.tailnet-name.ts.net; machine names are published in Certificate Transparency logs tailscale.com
- Who can reach it
- Authorized Tailscale users, including accepted machine-share recipients tailscale.com
- Warning page shown to visitors
- Not documented tailscale.com
- Visitor access control
- Tailscale access rules; Tailscale-User-Login identity headers for the app tailscale.com
- Link expiry
- No; a foreground session runs until stopped, and --bg keeps it running across reboots tailscale.com
- Single-use links
- No tailscale.com
- Protocols
- HTTP(S) proxy, files, directories, plain text, TCP, TLS-terminated TCP tailscale.com
- Free-tier limits
- Free Personal plan: up to 6 users, unlimited user devices tailscale.com
localtunnel
localtunnel (open source) · facts checked October 1, 2026 · github.com/localtunnel/localtunnel
- Account needed before the first URL
- No github.com
- What you install
- Node.js package github.com
- Command to the first shareable URL
- npx localtunnel --port 8000 github.com
- What the URL looks like
- Random *.loca.lt subdomain (optional --subdomain, not guaranteed) loca.lt
- Who can reach it
- Public: anyone with the URL github.com
- Warning page shown to visitors
- Reminder page that asks for a tunnel password (the creator’s public IP), per the service’s maintainer github.com, unofficial
- Visitor access control
- Not documented github.com
- Link expiry
- Active while the lt client stays connected; no expiry setting github.com
- Single-use links
- Not documented github.com
- Protocols
- HTTP(S) github.com
- Free-tier limits
- Not documented github.com
Pinggy (free)
Pinggy · facts checked October 1, 2026 · pinggy.io
- Account needed before the first URL
- No, to start pinggy.io
- What you install
- Nothing beyond an SSH client pinggy.io
- Command to the first shareable URL
- ssh -p 443 -R0:localhost:8000 qr@free.pinggy.io pinggy.io
- What the URL looks like
- Random URL that changes on reconnect; persistent subdomains on Pro pinggy.io
- Who can reach it
- Public: anyone with the URL pinggy.io
- Warning page shown to visitors
- Yes, a one-time browser screening page on free tunnels; non-browser clients skip it; none on Pro pinggy.io
- Visitor access control
- Basic auth, bearer token, IP allowlist pinggy.io
- Link expiry
- Free tunnels time out after 60 minutes pinggy.io
- Single-use links
- Not documented pinggy.io
- Protocols
- HTTP(S), TCP, TLS over SSH; UDP needs the Pinggy CLI pinggy.io
- Free-tier limits
- 60-minute tunnel timeout pinggy.io
Serveo (free)
Serveo · facts checked October 1, 2026 · serveo.net
- Account needed before the first URL
- No serveo.net
- What you install
- Nothing beyond an SSH client serveo.net
- Command to the first shareable URL
- ssh -R 80:localhost:3000 serveo.net serveo.net
- What the URL looks like
- *.serveo.net subdomain; custom subdomain available serveo.net
- Who can reach it
- Public: anyone with the URL serveo.net
- Warning page shown to visitors
- Yes on the free tier; removed on Pro serveo.net
- Visitor access control
- Not documented for visitors serveo.net
- Link expiry
- None documented for HTTP; anonymous public TCP ports last 10 minutes (30 with a registered key) serveo.net
- Single-use links
- Not documented serveo.net
- Protocols
- HTTP(S); raw TCP (random port) and private TCP/SSH aliases over SSH; UDP only via paid WireGuard serveo.net
- Free-tier limits
- 3 active tunnels; anonymous TCP: 1 port, 10 minutes, 2 connections, 256 KiB/s serveo.net
localhost.run (free)
localhost.run · facts checked October 1, 2026 · localhost.run
- Account needed before the first URL
- No account for free domains (SSH key or the nokey user) localhost.run
- What you install
- Nothing beyond an SSH client localhost.run
- Command to the first shareable URL
- ssh -R 80:localhost:8080 localhost.run localhost.run
- What the URL looks like
- Free domains change after a few hours; custom domains on paid plans localhost.run
- Who can reach it
- Public: anyone with the URL localhost.run
- Warning page shown to visitors
- Not documented localhost.run
- Visitor access control
- Not documented localhost.run
- Link expiry
- No expiry setting; the free domain rotates localhost.run
- Single-use links
- Not documented localhost.run
- Protocols
- HTTP with automatic HTTPS; TLS passthrough and non-HTTP need a paid custom domain localhost.run
- Free-tier limits
- Free domain names change regularly; speed limit localhost.run
Microsoft dev tunnels
Microsoft · facts checked October 1, 2026 · learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview
- Account needed before the first URL
- Yes: GitHub, Microsoft, or Entra ID learn.microsoft.com
- What you install
- devtunnel CLI or VS Code learn.microsoft.com
- Command to the first shareable URL
- devtunnel user login devtunnel host -p 8080 --allow-anonymous learn.microsoft.com
- What the URL looks like
- *.devtunnels.ms; persistent when created with devtunnel create learn.microsoft.com
- Who can reach it
- Private by default; anonymous access is opt-in learn.microsoft.com
- Warning page shown to visitors
- Yes, an anti-phishing page on first visit learn.microsoft.com
- Visitor access control
- Tenant, GitHub organization, or anonymous; 24-hour access tokens learn.microsoft.com
- Link expiry
- Temporary tunnels end when the host disconnects; persistent tunnels are deleted after 30 days idle; anonymous access can be time-limited learn.microsoft.com
- Single-use links
- Not documented learn.microsoft.com
- Protocols
- HTTP(S) and WebSocket via the web URL; other TCP via devtunnel connect learn.microsoft.com
- Free-tier limits
- 5 GB a month and 10 tunnels per user; 1,500 HTTP requests a minute per port; public preview, no SLA learn.microsoft.com
zrok (free)
NetFoundry · facts checked October 1, 2026 · zrok.io
- Account needed before the first URL
- Yes: a free account, no card zrok.io
- What you install
- zrok2 CLI (zrok 2.0) netfoundry.io
- Command to the first shareable URL
- zrok2 enable <TOKEN> zrok2 share public 8080 netfoundry.io
- What the URL looks like
- *.share.zrok.io; random and ephemeral by default, or a reserved name netfoundry.io
- Who can reach it
- Your choice per share: public shares are open to anyone with the URL; private shares only to zrok accounts you grant netfoundry.io
- Warning page shown to visitors
- Yes, an anti-phishing page on the first visit to public shares from unverified free accounts; adding a card removes it zrok.io
- Visitor access control
- Basic auth; OAuth with an email pattern; private shares github.com
- Link expiry
- Ephemeral shares end with the process netfoundry.io
- Single-use links
- Not documented netfoundry.io
- Protocols
- HTTP(S) on public shares; raw TCP, UDP, and SOCKS on private shares netfoundry.io
- Free-tier limits
- 5 GB/day; 7,500 requests per share per 5 minutes netfoundry.io
bore (bore.pub)
bore (open source) · facts checked October 1, 2026 · github.com/ekzhang/bore
- Account needed before the first URL
- No, for the public bore.pub server github.com
- What you install
- bore binary github.com
- Command to the first shareable URL
- bore local 8000 --to bore.pub github.com
- What the URL looks like
- bore.pub:<random port> github.com
- Who can reach it
- Public: anyone who connects to the port github.com
- Warning page shown to visitors
- None (raw TCP) github.com
- Visitor access control
- Optional shared secret between client and server, not visitors github.com
- Link expiry
- bore.pub connections time out after 24 hours, per the maintainer github.com, unofficial
- Single-use links
- No github.com
- Protocols
- TCP only, no TLS github.com
- Free-tier limits
- 24-hour timeout and a per-source-IP connection limit on bore.pub, per the maintainer; no uptime guarantee github.com, unofficial
Expose (free)
Beyond Code · facts checked October 1, 2026 · expose.dev
- Account needed before the first URL
- Yes: a free account for the auth token expose.dev
- What you install
- expose CLI (PHP PHAR or Composer) expose.dev
- Command to the first shareable URL
- expose token <TOKEN> expose share http://localhost:3000 expose.dev
- What the URL looks like
- Random subdomain per connection on the free plan expose.dev
- Who can reach it
- Public: anyone with the URL expose.dev
- Warning page shown to visitors
- Not documented expose.dev
- Visitor access control
- Basic auth (--basicAuth); pricing lists access control under Pro expose.dev
- Link expiry
- Free connections are time-limited (length not documented) expose.dev
- Single-use links
- Not documented expose.dev
- Protocols
- HTTP(S); TCP port sharing is Pro expose.dev
- Free-tier limits
- Per-connection time limit (length not published); single EU server (Germany); random URLs expose.dev
frp
fatedier (open source) · facts checked October 14, 2026 · github.com/fatedier/frp
- Account needed before the first URL
- No; you run frps on your own server github.com
- What you install
- frps on a server with a public IP; frpc on your machine (release binaries) github.com
- Command to the first shareable URL
- ./frps -c ./frps.toml (on the server) ./frpc -c ./frpc.toml github.com
- What the URL looks like
- Your server's IP and remotePort for TCP/UDP; your own domain (customDomains or subdomain) for HTTP/HTTPS github.com
- Who can reach it
- Public: anyone who reaches the server port or domain; STCP/XTCP proxies only to visitors with the secret key github.com
- Warning page shown to visitors
- Not documented github.com
- Visitor access control
- HTTP basic auth (httpUser/httpPassword) on http proxies; secretKey for STCP/XTCP visitors; token or OIDC authenticates clients, not visitors github.com
- Link expiry
- Not documented github.com
- Single-use links
- Not documented github.com
- Protocols
- TCP, UDP, HTTP, HTTPS; secret STCP and peer-to-peer XTCP modes github.com
- Free-tier limits
- No service tier; you run frps on your own server github.com
LocalXpose (free)
LocalXpose · facts checked October 14, 2026 · localxpose.io
- Account needed before the first URL
- Yes: a free account and access token localxpose.io
- What you install
- loclx CLI or GUI (binary, snap, or npm) localxpose.io
- Command to the first shareable URL
- loclx account login loclx tunnel http localxpose.io
- What the URL looks like
- Unique subdomain on the free plan; custom subdomains and custom domains on Pro localxpose.io
- Who can reach it
- Public: anyone with the URL localxpose.io
- Warning page shown to visitors
- Yes, an interstitial warning page on the free Starter plan localxpose.io
- Visitor access control
- Basic auth (--basic-auth), key auth with an X-TOKEN header (--key-auth), IP whitelist (--ip-whitelist) localxpose.io
- Link expiry
- Free tunnels are time-limited (length not published) localxpose.io
- Single-use links
- Not documented localxpose.io
- Protocols
- HTTP(S) on the free plan; TCP, TLS, UDP on Pro localxpose.io
- Free-tier limits
- 2 active HTTP/HTTPS tunnels; time limits; interstitial warning page localxpose.io
Pangolin
Fossorial · facts checked October 14, 2026 · pangolin.net
- Account needed before the first URL
- Yes: a Pangolin Cloud account, or the admin account on your own server docs.pangolin.net
- What you install
- Pangolin CLI or Newt as the site connector; self-hosting adds a Linux server with a public IP and a domain docs.pangolin.net
- Command to the first shareable URL
- pangolin up site --id <ID> --secret <SECRET> --endpoint https://app.pangolin.net Then add a public HTTPS resource in the dashboard docs.pangolin.net
- What the URL looks like
- A hostname on a domain you add; provided domains (.hostlocal.app, .tunneled.to) on paid Cloud plans docs.pangolin.net
- Who can reach it
- Visitors who pass the resource's authentication; Pangolin SSO is on by default docs.pangolin.net
- Warning page shown to visitors
- A Pangolin login page for unauthenticated visitors docs.pangolin.net
- Visitor access control
- SSO and identity providers, users and roles, PIN, passcode, email OTP, header auth, share links, IP/geo/path rules docs.pangolin.net
- Link expiry
- Yes. Share links take an expiration or never expire; deleting a link revokes it docs.pangolin.net
- Single-use links
- Not documented docs.pangolin.net
- Protocols
- HTTP(S), browser SSH/RDP/VNC; raw TCP/UDP on self-hosted servers, without Pangolin authentication docs.pangolin.net
- Free-tier limits
- Cloud Basic: 5 users, 5 sites, 5 domains, 15 public resources; Community Edition is free to self-host pangolin.net
sish
sish (open source) · facts checked October 14, 2026 · github.com/antoniomika/sish
- Account needed before the first URL
- No, on your own server; your SSH public key goes in its pubkeys directory github.com
- What you install
- Nothing beyond an SSH client; the sish server (Docker or binary) on your host github.com
- Command to the first shareable URL
- docker run ... antoniomika/sish:latest --domain=example.com (on your server) ssh -p 2222 -R 80:localhost:8080 example.com github.com
- What the URL looks like
- Chosen or random subdomain of your sish domain; host:port for TCP docs.ssi.sh
- Who can reach it
- Public: anyone with the URL; TCP aliases only to authenticated SSH users docs.ssi.sh
- Warning page shown to visitors
- Not documented github.com
- Visitor access control
- HTTP basic auth per forwarded host; server-wide IP and country allowlists; TCP aliases limited to listed SSH key fingerprints docs.ssi.sh
- Link expiry
- Optional per-tunnel deadline (deadline=15m or a timestamp) docs.ssi.sh
- Single-use links
- Not documented github.com
- Protocols
- HTTP(S), WS(S), TCP, TCP aliases, SNI passthrough github.com
- Free-tier limits
- No free hosted tier; self-host, or use the managed tuns.sh with pico+ pico.sh
chisel
chisel (open source) · facts checked October 14, 2026 · github.com/jpillora/chisel
- Account needed before the first URL
- No; you run chisel server yourself github.com
- What you install
- chisel binary (client and server in one) github.com
- Command to the first shareable URL
- chisel server --port 8080 --reverse (on your server) chisel client http://<server>:8080 R:3000:localhost:3000 github.com
- What the URL looks like
- <server>:<port> on your chisel server github.com
- Who can reach it
- Anyone who can reach the reverse port on your server github.com
- Warning page shown to visitors
- None (raw TCP) github.com
- Visitor access control
- Not documented for visitors; --auth and --authfile authenticate tunnel clients github.com
- Link expiry
- Not documented github.com
- Single-use links
- Not documented github.com
- Protocols
- TCP and UDP over HTTP, encrypted with SSH; SOCKS5 github.com
- Free-tier limits
- No service tier; you run chisel server (the public demo server is gone) github.com
rathole
rathole (open source) · facts checked October 14, 2026 · github.com/rathole-org/rathole
- Account needed before the first URL
- No; you run the rathole server yourself github.com
- What you install
- rathole binary or Docker image, on a server with a public IP and on your machine github.com
- Command to the first shareable URL
- ./rathole server.toml (on the server) ./rathole client.toml github.com
- What the URL looks like
- Your server's address and the service's bind_addr port github.com
- Who can reach it
- Public: anyone who connects to the port github.com
- Warning page shown to visitors
- None (raw TCP) github.com
- Visitor access control
- Not documented for visitors; a mandatory per-service token authenticates clients github.com
- Link expiry
- Not documented github.com
- Single-use links
- Not documented github.com
- Protocols
- TCP and UDP; client-server transport over TCP, TLS, or Noise github.com
- Free-tier limits
- No service tier; you need your own server with a public IP github.com
Tunnelmole
Tunnelmole (open source) · facts checked October 14, 2026 · tunnelmole.com
- Account needed before the first URL
- No tunnelmole.com
- What you install
- Node.js package or prebuilt tmole binary github.com
- Command to the first shareable URL
- npx tunnelmole 3000 tunnelmole.com
- What the URL looks like
- Random tunnelmole.net subdomain that contains your IP address; custom subdomains are paid github.com
- Who can reach it
- Public: anyone with the URL github.com
- Warning page shown to visitors
- Not documented github.com
- Visitor access control
- Not documented github.com
- Link expiry
- Not documented github.com
- Single-use links
- Not documented github.com
- Protocols
- HTTP(S) github.com
- Free-tier limits
- Not published; paid plans list custom subdomains and no tunnel timeouts dashboard.tunnelmole.com
boringproxy
boringproxy (open source) · facts checked October 14, 2026 · github.com/boringproxy/boringproxy
- Account needed before the first URL
- No; boringproxy server creates the admin login on first run github.com
- What you install
- boringproxy binary (server and client in one); OpenSSH 7.8 or later github.com
- Command to the first shareable URL
- boringproxy server -admin-domain <domain> (on the server) boringproxy client -server <domain> -user <user> -token <token> -client-name <name> Then add a tunnel in the web UI github.com
- What the URL looks like
- A domain you point at the server, such as a subdomain of a wildcard DNS record github.com
- Who can reach it
- Public: anyone with the URL, unless the tunnel is password-protected github.com
- Warning page shown to visitors
- Not documented github.com
- Visitor access control
- Optional HTTP basic auth per tunnel (Password Protect) github.com
- Link expiry
- Not documented github.com
- Single-use links
- Not documented github.com
- Protocols
- HTTP(S); raw TCP with Allow External TCP github.com
- Free-tier limits
- No service tier; the public demo instance is down github.com
inlets (inlets Pro)
OpenFaaS Ltd · facts checked October 14, 2026 · inlets.dev
- Account needed before the first URL
- Yes: a paid subscription and license key github.com
- What you install
- inlets-pro binary (client and server in one); inletsctl to create the tunnel server github.com
- Command to the first shareable URL
- inletsctl create --provider digitalocean --region lon1 --access-token-file <key-file> --letsencrypt-domain <domain> Point a DNS A record for <domain> at the server IP inlets-pro http client --url <URL> --token <TOKEN> --upstream <domain>=http://127.0.0.1:3000 docs.inlets.dev
- What the URL looks like
- Your own domain, with a Let's Encrypt certificate on your tunnel server docs.inlets.dev
- Who can reach it
- Public: anyone with the URL, unless OAuth or an IP allowlist is set inlets.dev
- Warning page shown to visitors
- Not documented docs.inlets.dev
- Visitor access control
- OAuth on HTTP tunnels (Personal: GitHub, Signet); IP allowlist inlets.dev
- Link expiry
- Not documented docs.inlets.dev
- Single-use links
- Not documented docs.inlets.dev
- Protocols
- HTTP(S), WebSockets, SSE, gRPC; TCP inlets.dev
- Free-tier limits
- No free tier; Personal is $25/month for up to 5 tunnels, no commercial use inlets.dev
What changed
- Cloudflare's quick tunnel documentation adds --allowed-mail, an optional email one-time PIN in front of a quick tunnel. source
- ngrok requires card verification before free accounts can open TCP endpoints, citing reports of its agent being bundled into malware. source
- ngrok describes the anti-phishing measures applied to free accounts, including the browser warning page. source
Frequently Asked Questions
Which localhost tunnels work without an account?
Cloudflare quick tunnels, localtunnel, Pinggy, Serveo, localhost.run, bore.pub, Tunnelmole, and the qURL CLI start without an account. frp, sish, chisel, rathole, and boringproxy need no service account but require your own server. ngrok, Cloudflare named tunnels, Tailscale Funnel and Serve, Microsoft dev tunnels, zrok, Expose, LocalXpose, Pangolin, and inlets need an account or license first. qURL needs no account or server of your own and gives the app no public URL.
Which tunnel keeps my local app private?
Microsoft dev tunnels are private by default but require a GitHub or Microsoft sign-in, and Tailscale Serve is private to your tailnet. Cloudflare quick tunnels can add an emailed PIN with --allowed-mail. qURL keeps the app off the public internet and admits each recipient through their own access link, with no account on either side.
Do any tunnels offer links that expire or work once?
Microsoft dev tunnels can grant time-limited anonymous access, Pangolin share links can expire, sish supports a per-tunnel deadline, and Pinggy’s free tunnels time out after 60 minutes. qURL is the only tool here that documents single-use links: with no flags, qurl share prints a link that can be opened once and expires within 24 hours. Opening it admits the opener’s network address for the session, so other devices on that public IP can reach the app until it ends.
Why do some tunnels show a warning page?
ngrok’s free plan, Microsoft dev tunnels, zrok, and localtunnel say their warning or reminder pages are there to fight phishing, and Pinggy, Serveo, and LocalXpose show one on free tunnels too. qURL shows recipients no warning page; the access link opens the app.
Can I reuse this data?
Yes. The dataset is published under CC BY 4.0 as JSON and CSV. Every value links the vendor document or test it came from, and each tool records the date its facts were last checked. Please credit LayerV and link this page.
Share your app without an account
Install the qURL CLI, then publish the app you have running.
New to qURL? Start at qurl.link