ngrok alternatives with authentication
Eleven tools that decide who can open a shared app, by identity, password, network, or link.
For email-based sign-in in front of a stable hostname, use Cloudflare Access on a named tunnel. For SSO and expiring share links on your own server, use Pangolin. For basic auth or an IP allowlist with no account, use Pinggy. For a link that opens once and expires within 24 hours, with no account, use qURL™.
Facts checked October 1, 2026, each value linked to its source. Full dataset.
Why people look for ngrok alternatives
- ngrok endpoints are public by default; access control is a Traffic Policy you add.
- The free plan includes 3 OAuth or OIDC users a month.
- An account and authtoken before the first URL.
- Links have no built-in expiry, and the endpoint stays up while the agent runs.
The alternatives at a glance
| Tool | Best for | Account needed before the first URL | Visitor access control | Link expiry | Single-use links |
|---|---|---|---|---|---|
| qURL CLI | A link that opens once and expires within 24 hours, with no account on either side | No. The first publish creates the device identity our test | Single-use access link by default; link and session lifetimes. IP allow and deny lists and other rules can gate links through the API, not the CLI layerv.ai | Yes. qurl share returned a 24-hour link in our no-account test; no-account links are capped at 24 hours our test | Yes, the default for qurl share our test |
| Cloudflare Tunnel (named) | Identity-based policies in front of a stable hostname, with service tokens for machines | Yes: account plus a domain on Cloudflare developers.cloudflare.com | Cloudflare Access policies; service tokens for machines developers.cloudflare.com | No per-link expiry; Access session settings apply developers.cloudflare.com | Not documented developers.cloudflare.com |
| Cloudflare Quick Tunnel (trycloudflare.com) | An email one-time PIN in front of a quick tunnel, with no account | No developers.cloudflare.com | Optional --allowed-mail email one-time PIN (browsers only; change it by restarting cloudflared) developers.cloudflare.com | No; the URL works until cloudflared stops developers.cloudflare.com | Not documented developers.cloudflare.com |
| Pangolin | SSO, PIN codes, passcodes, email one-time codes and expiring share links | Yes: a Pangolin Cloud account, or the admin account on your own server docs.pangolin.net | SSO and identity providers, users and roles, PIN, passcode, email OTP, header auth, share links, IP/geo/path rules docs.pangolin.net | Yes. Share links take an expiration or never expire; deleting a link revokes it docs.pangolin.net | Not documented docs.pangolin.net |
| zrok (free) | OAuth with an email pattern on public shares, or private shares to granted accounts | Yes: a free account, no card zrok.io | Basic auth; OAuth with an email pattern; private shares github.com | Ephemeral shares end with the process netfoundry.io | Not documented netfoundry.io |
| Pinggy (free) | Basic auth, a bearer token, or an IP allowlist with no account | No, to start pinggy.io | Basic auth, bearer token, IP allowlist pinggy.io | Free tunnels time out after 60 minutes pinggy.io | Not documented pinggy.io |
| LocalXpose (free) | Basic auth, a header key, or an IP allowlist from a CLI or GUI | Yes: a free account and access token localxpose.io | Basic auth (--basic-auth), key auth with an X-TOKEN header (--key-auth), IP whitelist (--ip-whitelist) localxpose.io | Free tunnels are time-limited (length not published) localxpose.io | Not documented localxpose.io |
| Microsoft dev tunnels | Access limited to a Microsoft tenant or a GitHub organization | Yes: GitHub, Microsoft, or Entra ID learn.microsoft.com | Tenant, GitHub organization, or anonymous; 24-hour access tokens learn.microsoft.com | Temporary tunnels end when the host disconnects; persistent tunnels are deleted after 30 days idle; anonymous access can be time-limited learn.microsoft.com | Not documented learn.microsoft.com |
| Tailscale Serve | Private access through Tailscale, with identity headers for the app | Yes: a tailnet with HTTPS certificates enabled tailscale.com | Tailscale access rules; Tailscale-User-Login identity headers for the app tailscale.com | No; a foreground session runs until stopped, and --bg keeps it running across reboots tailscale.com | No tailscale.com |
| frp | Basic auth or a preshared visitor key on a server you run | No; you run frps on your own server github.com | HTTP basic auth (httpUser/httpPassword) on http proxies; secretKey for STCP/XTCP visitors; token or OIDC authenticates clients, not visitors github.com | Not documented github.com | Not documented github.com |
| Expose (free) | Basic auth on a PHP-friendly tunnel | Yes: a free account for the auth token expose.dev | Basic auth (--basicAuth); pricing lists access control under Pro expose.dev | Free connections are time-limited (length not documented) expose.dev | Not documented expose.dev |
Each alternative
qURL CLIMade by LayerV
Best for: A link that opens once and expires within 24 hours, with no account on either side.
Trade-off vs ngrok: Access rules beyond the link, such as IP lists, are set through the API.
Command to the first shareable URLqurl publish http://127.0.0.1:3000 qurl share <CRID>Cloudflare Tunnel (named)
Best for: Identity-based policies in front of a stable hostname, with service tokens for machines.
Trade-off vs ngrok: Needs a Cloudflare account and a domain on Cloudflare.
Command to the first shareable URLCreate the tunnel in the dashboard, run the cloudflared install command it shows, then add a published application routeCloudflare Quick Tunnel (trycloudflare.com)
Best for: An email one-time PIN in front of a quick tunnel, with no account.
Trade-off vs ngrok: Works in browsers only; changing the allowed email means restarting cloudflared.
Command to the first shareable URLcloudflared tunnel --url http://localhost:8080Pangolin
Best for: SSO, PIN codes, passcodes, email one-time codes and expiring share links.
Trade-off vs ngrok: You run the server, or use Pangolin Cloud with an account.
Command to the first shareable URLpangolin up site --id <ID> --secret <SECRET> --endpoint https://app.pangolin.net Then add a public HTTPS resource in the dashboardzrok (free)
Best for: OAuth with an email pattern on public shares, or private shares to granted accounts.
Trade-off vs ngrok: Needs an account.
Command to the first shareable URLzrok2 enable <TOKEN> zrok2 share public 8080Pinggy (free)
Best for: Basic auth, a bearer token, or an IP allowlist with no account.
Trade-off vs ngrok: Free tunnels time out after 60 minutes.
Command to the first shareable URLssh -p 443 -R0:localhost:8000 qr@free.pinggy.ioLocalXpose (free)
Best for: Basic auth, a header key, or an IP allowlist from a CLI or GUI.
Trade-off vs ngrok: Needs an account; free tunnels show a warning page and are time-limited.
Command to the first shareable URLloclx account login loclx tunnel httpMicrosoft dev tunnels
Best for: Access limited to a Microsoft tenant or a GitHub organization.
Trade-off vs ngrok: Needs a GitHub or Microsoft sign-in; visitors see an anti-phishing page first.
Command to the first shareable URLdevtunnel user login devtunnel host -p 8080 --allow-anonymousTailscale Serve
Best for: Private access through Tailscale, with identity headers for the app.
Trade-off vs ngrok: Viewers need a Tailscale account and client.
Command to the first shareable URLtailscale serve 3000frp
Best for: Basic auth or a preshared visitor key on a server you run.
Trade-off vs ngrok: You run frps on a server with a public IP.
Command to the first shareable URL./frps -c ./frps.toml (on the server) ./frpc -c ./frpc.tomlExpose (free)
Best for: Basic auth on a PHP-friendly tunnel.
Trade-off vs ngrok: Needs an account; access control is listed under Pro.
Command to the first shareable URLexpose token <TOKEN> expose share http://localhost:3000
When to keep ngrok
Keep ngrok when you want OAuth, OIDC, basic auth and IP restrictions combined in one Traffic Policy on a managed edge, with request inspection and replay for debugging.
Frequently Asked Questions
Which ngrok alternative supports single sign-on?
Cloudflare Access and Pangolin both put identity-provider sign-in in front of an app. Microsoft dev tunnels limit access to a tenant or a GitHub organization. zrok public shares can require OAuth with an email pattern.
Which ngrok alternative can password-protect a tunnel without an account?
Pinggy adds basic auth, a bearer token or an IP allowlist with no account. A qURL link needs no account either and works differently: it opens once and expires within 24 hours, so there is no password to share.
Which alternatives make links that expire?
Pangolin share links can be given an expiry and revoked. A qURL link from qurl share opens once and expires within 24 hours by default. Microsoft dev tunnels can time-limit anonymous access.
Who can open a qURL link?
Whoever holds it, once. Opening it admits the network address it was opened from for the session, so other devices on that public IP, such as an office network, can reach the app until the session ends. Keep your app’s own sign-in for anything sensitive.
Built it with an agent? Let it share it.
One prompt points Claude Code, Cursor, or Windsurf at the qURL skill. Or install the CLI and publish the app yourself. No account either way.
New to qURL? Start at qurl.link