# Open-Source ngrok Alternatives: 12 Ways to Share Localhost, Compared > Open-source and self-hosted ngrok alternatives compared: license, latest release, whether you run your own server, and who can reach your app. Source: https://layerv.ai/compare/open-source-ngrok-alternatives/ --- [← All Comparisons](https://layerv.ai/compare/) # Open-source ngrok alternatives Twelve tools with open-source code you can run or host yourself, with their licenses, latest releases, and who can reach the app. To run the whole stack on your own server, frp covers TCP, UDP, HTTP and HTTPS, and Pangolin adds SSO and expiring share links. zrok can be self-hosted or used as a service. To skip the server and keep the app off a public URL, the qURL™ CLI is MIT-licensed and needs no account. Facts checked October 1, 2026, each value linked to its source. [Full dataset](https://layerv.ai/compare/localhost-tunnels/). ## Why people look for ngrok alternatives - The ngrok agent is closed source, and every tunnel runs through ngrok’s own edge. - An account and authtoken before the first URL, and a warning page for free-plan browser visitors. - Free-plan limits: 3 endpoints, 1 GB a month out, and 20,000 HTTP requests a month. - A public URL that anyone with the address can request unless you add a Traffic Policy. ## The alternatives at a glance License and release metadata checked October 14, 2026. __Open-source ngrok alternatives: what each is best for, its license and latest release, and account needed before the first URL, who can reach it, visitor access control__ | Tool | Best for | License | Latest release | Account needed before the first URL | Who can reach it | Visitor access control | | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [qURL CLI](https://layerv.ai/compare/open-source-ngrok-alternatives/#alt-qurl) | An MIT-licensed CLI that shares an app with no account, no server and no public URL | [MIT](https://github.com/layervai/qurl-integrations/blob/main/LICENSE) | [v3.5.0 (2026-10-10)](https://github.com/layervai/qurl-integrations/releases) | No. The first publish creates the device identity [our test](https://layerv.ai/research/qurl-behaviour) | No one until a link is opened; then the opener’s public IP for that session, including other devices behind that IP [layerv.ai](https://layerv.ai/docs/qurls.md) | Single-use access link by default; link and session lifetimes. IP allow and deny lists and other rules can gate links through the API, not the CLI [layerv.ai](https://layerv.ai/docs/qurls.md) | | [frp](https://layerv.ai/compare/open-source-ngrok-alternatives/#alt-frp) | A full self-hosted reverse proxy for TCP, UDP, HTTP and HTTPS | [Apache-2.0](https://github.com/fatedier/frp/blob/dev/LICENSE) | [v0.71.1 (2026-10-14)](https://github.com/fatedier/frp/releases) | No; you run frps on your own server [github.com](https://github.com/fatedier/frp) | Public: anyone who reaches the server port or domain; STCP/XTCP proxies only to visitors with the secret key [github.com](https://github.com/fatedier/frp) | HTTP basic auth (httpUser/httpPassword) on http proxies; secretKey for STCP/XTCP visitors; token or OIDC authenticates clients, not visitors [github.com](https://github.com/fatedier/frp) | | [zrok (free)](https://layerv.ai/compare/open-source-ngrok-alternatives/#alt-zrok) | Public or private shares, self-hosted or on the zrok.io service | [Apache-2.0](https://github.com/openziti/zrok/blob/main/LICENSE) | [v2.0.8 (2026-10-08)](https://github.com/openziti/zrok/releases) | Yes: a free account, no card [zrok.io](https://zrok.io/pricing/) | Your choice per share: public shares are open to anyone with the URL; private shares only to zrok accounts you grant [netfoundry.io](https://netfoundry.io/docs/zrok/how-tos/shares/configure-permission-modes) | Basic auth; OAuth with an email pattern; private shares [github.com](https://github.com/openziti/zrok/blob/main/cmd/zrok2/sharePublic.go) | | [Pangolin](https://layerv.ai/compare/open-source-ngrok-alternatives/#alt-pangolin) | A self-hosted reverse proxy with SSO, PIN codes, email one-time codes and expiring share links | [AGPL-3.0](https://github.com/fosrl/pangolin/blob/main/LICENSE) | [1.24.0 (2026-09-30)](https://github.com/fosrl/pangolin/releases) | Yes: a Pangolin Cloud account, or the admin account on your own server [docs.pangolin.net](https://docs.pangolin.net/about/pangolin-cloud-vs-self-hosted) | Visitors who pass the resource's authentication; Pangolin SSO is on by default [docs.pangolin.net](https://docs.pangolin.net/manage/resources/public/authentication) | SSO and identity providers, users and roles, PIN, passcode, email OTP, header auth, share links, IP/geo/path rules [docs.pangolin.net](https://docs.pangolin.net/manage/resources/public/authentication) | | [sish](https://layerv.ai/compare/open-source-ngrok-alternatives/#alt-sish) | Self-hosted tunnels over plain ssh -R, with nothing to install on the client | [MIT](https://github.com/antoniomika/sish/blob/main/LICENSE) | [v2.24.1 (2026-10-09)](https://github.com/antoniomika/sish/releases) | No, on your own server; your SSH public key goes in its pubkeys directory [github.com](https://github.com/antoniomika/sish) | Public: anyone with the URL; TCP aliases only to authenticated SSH users [docs.ssi.sh](https://docs.ssi.sh/forwarding-types) | HTTP basic auth per forwarded host; server-wide IP and country allowlists; TCP aliases limited to listed SSH key fingerprints [docs.ssi.sh](https://docs.ssi.sh/cli) | | [chisel](https://layerv.ai/compare/open-source-ngrok-alternatives/#alt-chisel) | TCP and UDP tunnels over HTTP, secured with SSH, to a server you run | [MIT](https://github.com/jpillora/chisel/blob/master/LICENSE) | [v1.12.0 (2026-08-29)](https://github.com/jpillora/chisel/releases) | No; you run chisel server yourself [github.com](https://github.com/jpillora/chisel) | Anyone who can reach the reverse port on your server [github.com](https://github.com/jpillora/chisel) | Not documented for visitors; --auth and --authfile authenticate tunnel clients [github.com](https://github.com/jpillora/chisel) | | [Expose (free)](https://layerv.ai/compare/open-source-ngrok-alternatives/#alt-expose) | PHP developers who want a self-hostable server or the free hosted one | [MIT](https://github.com/exposedev/expose/blob/master/LICENSE.md) | [3.2.4 (2026-09-17)](https://github.com/exposedev/expose/releases) | Yes: a free account for the auth token [expose.dev](https://expose.dev/docs/getting-started/authentication) | Public: anyone with the URL [expose.dev](https://expose.dev/docs/getting-started/authentication) | Basic auth (--basicAuth); pricing lists access control under Pro [expose.dev](https://expose.dev/docs/client/basic-authentication) | | [bore (bore.pub)](https://layerv.ai/compare/open-source-ngrok-alternatives/#alt-bore) | Forwarding a raw TCP port, through bore.pub or your own server | [MIT](https://github.com/ekzhang/bore/blob/main/LICENSE) | [v0.6.0 (2025-06-09)](https://github.com/ekzhang/bore/releases) | No, for the public bore.pub server [github.com](https://github.com/ekzhang/bore) | Public: anyone who connects to the port [github.com](https://github.com/ekzhang/bore) | Optional shared secret between client and server, not visitors [github.com](https://github.com/ekzhang/bore) | | [rathole](https://layerv.ai/compare/open-source-ngrok-alternatives/#alt-rathole) | A small, fast NAT-traversal proxy for TCP and UDP | [Apache-2.0](https://github.com/rathole-org/rathole/blob/main/LICENSE) | [v0.5.0 (2023-10-01)](https://github.com/rathole-org/rathole/releases) | No; you run the rathole server yourself [github.com](https://github.com/rathole-org/rathole) | Public: anyone who connects to the port [github.com](https://github.com/rathole-org/rathole) | Not documented for visitors; a mandatory per-service token authenticates clients [github.com](https://github.com/rathole-org/rathole) | | [Tunnelmole](https://layerv.ai/compare/open-source-ngrok-alternatives/#alt-tunnelmole) | An HTTPS URL with no account from an npm package, or a self-hosted service | [MIT](https://github.com/robbie-cahill/tunnelmole-client/blob/main/LICENSE.md) | [2.4.0 (2025-06-05)](https://www.npmjs.com/package/tunnelmole) | No [tunnelmole.com](https://tunnelmole.com) | Public: anyone with the URL [github.com](https://github.com/robbie-cahill/tunnelmole-client) | Not documented [github.com](https://github.com/robbie-cahill/tunnelmole-client) | | [localtunnel](https://layerv.ai/compare/open-source-ngrok-alternatives/#alt-localtunnel) | A one-line npx command in a Node.js project | [MIT](https://github.com/localtunnel/localtunnel/blob/master/LICENSE) | [2.0.2 (2021-09-18)](https://www.npmjs.com/package/localtunnel) | No [github.com](https://github.com/localtunnel/localtunnel) | Public: anyone with the URL [github.com](https://github.com/localtunnel/localtunnel) | Not documented [github.com](https://github.com/localtunnel/localtunnel) | | [boringproxy](https://layerv.ai/compare/open-source-ngrok-alternatives/#alt-boringproxy) | A self-hosted tunnel server with a web UI, automatic HTTPS and optional basic auth | [MIT](https://github.com/boringproxy/boringproxy/blob/master/LICENSE) | [v0.10.0 (2023-01-04)](https://github.com/boringproxy/boringproxy/releases) | No; boringproxy server creates the admin login on first run [github.com](https://github.com/boringproxy/boringproxy.io/blob/master/pages/usage.md) | Public: anyone with the URL, unless the tunnel is password-protected [github.com](https://github.com/boringproxy/boringproxy.io/blob/master/pages/usage.md) | Optional HTTP basic auth per tunnel (Password Protect) [github.com](https://github.com/boringproxy/boringproxy.io/blob/master/pages/usage.md) | ## Each alternative 1. ### qURL CLI Made by LayerV **Best for:** An MIT-licensed CLI that shares an app with no account, no server and no public URL. **Trade-off vs ngrok:** The CLI is open source; the service it connects to is LayerV’s. No raw TCP. Command to the first shareable URL `qurl publish http://127.0.0.1:3000 qurl share ` [All qURL CLI facts →](https://layerv.ai/compare/localhost-tunnels/#tool-qurl) 2. ### frp **Best for:** A full self-hosted reverse proxy for TCP, UDP, HTTP and HTTPS. **Trade-off vs ngrok:** You run frps on a server with a public IP; visitor access is basic auth on HTTP proxies. Command to the first shareable URL `./frps -c ./frps.toml (on the server) ./frpc -c ./frpc.toml` [qURL vs frp →](https://layerv.ai/compare/qurl-vs-frp/) 3. ### zrok (free) **Best for:** Public or private shares, self-hosted or on the zrok.io service. **Trade-off vs ngrok:** The service needs an account; public shares from unverified free accounts show a warning page. Command to the first shareable URL `zrok2 enable zrok2 share public 8080` [qURL vs zrok (free) →](https://layerv.ai/compare/qurl-vs-zrok/) 4. ### Pangolin **Best for:** A self-hosted reverse proxy with SSO, PIN codes, email one-time codes and expiring share links. **Trade-off vs ngrok:** You run the server and a site connector; the Community Edition is AGPL-3.0. Command to the first shareable URL `pangolin up site --id --secret --endpoint https://app.pangolin.net Then add a public HTTPS resource in the dashboard` [qURL vs Pangolin →](https://layerv.ai/compare/qurl-vs-pangolin/) 5. ### sish **Best for:** Self-hosted tunnels over plain ssh -R, with nothing to install on the client. **Trade-off vs ngrok:** You run the server; the managed tuns.sh is a paid service. Command to the first shareable URL `docker run ... antoniomika/sish:latest --domain=example.com (on your server) ssh -p 2222 -R 80:localhost:8080 example.com` [All sish facts →](https://layerv.ai/compare/localhost-tunnels/#tool-sish) 6. ### chisel **Best for:** TCP and UDP tunnels over HTTP, secured with SSH, to a server you run. **Trade-off vs ngrok:** No hosted server and no visitor access control; users authenticate tunnel clients. Command to the first shareable URL `chisel server --port 8080 --reverse (on your server) chisel client http://:8080 R:3000:localhost:3000` [All chisel facts →](https://layerv.ai/compare/localhost-tunnels/#tool-chisel) 7. ### Expose (free) **Best for:** PHP developers who want a self-hostable server or the free hosted one. **Trade-off vs ngrok:** The hosted server needs an account; free connections are time-limited. Command to the first shareable URL `expose token expose share http://localhost:3000` [All Expose (free) facts →](https://layerv.ai/compare/localhost-tunnels/#tool-expose) 8. ### bore (bore.pub) **Best for:** Forwarding a raw TCP port, through bore.pub or your own server. **Trade-off vs ngrok:** TCP only, with no TLS; anyone who connects to the port reaches it. Command to the first shareable URL `bore local 8000 --to bore.pub` [All bore (bore.pub) facts →](https://layerv.ai/compare/localhost-tunnels/#tool-bore) 9. ### rathole **Best for:** A small, fast NAT-traversal proxy for TCP and UDP. **Trade-off vs ngrok:** You run the server; tokens authenticate clients, not visitors; the latest release is from 2023. Command to the first shareable URL `./rathole server.toml (on the server) ./rathole client.toml` [All rathole facts →](https://layerv.ai/compare/localhost-tunnels/#tool-rathole) 10. ### Tunnelmole **Best for:** An HTTPS URL with no account from an npm package, or a self-hosted service. **Trade-off vs ngrok:** HTTP only; the URL is public and contains your IP address. Command to the first shareable URL `npx tunnelmole 3000` [All Tunnelmole facts →](https://layerv.ai/compare/localhost-tunnels/#tool-tunnelmole) 11. ### localtunnel **Best for:** A one-line npx command in a Node.js project. **Trade-off vs ngrok:** Public; visitors are asked for a tunnel password, per the maintainer. Command to the first shareable URL `npx localtunnel --port 8000` [qURL vs localtunnel →](https://layerv.ai/compare/qurl-vs-localtunnel/) 12. ### boringproxy **Best for:** A self-hosted tunnel server with a web UI, automatic HTTPS and optional basic auth. **Trade-off vs ngrok:** You run the server; the latest release is v0.10.0, from 2023. Command to the first shareable URL `boringproxy server -admin-domain (on the server) boringproxy client -server -user -token -client-name Then add a tunnel in the web UI` [All boringproxy facts →](https://layerv.ai/compare/localhost-tunnels/#tool-boringproxy) ## When to keep ngrok Keep ngrok when you want a managed edge with no server to run, request inspection and one-click replay for webhook debugging, and OAuth, OIDC, basic auth and IP rules in one Traffic Policy. ## Frequently Asked Questions Is there a free, open-source ngrok alternative? Yes. frp (Apache-2.0), rathole (Apache-2.0), chisel (MIT), sish (MIT), bore (MIT), Expose (MIT), zrok (Apache-2.0), boringproxy (MIT), localtunnel (MIT) and the Tunnelmole client (MIT) are open source. Pangolin’s Community Edition is AGPL-3.0\. The qURL CLI is MIT-licensed and connects to LayerV’s service. Which open-source tunnels need no server of my own? bore has a public server at bore.pub, Tunnelmole and localtunnel have hosted defaults, Expose has a free hosted server with an account, and zrok has the zrok.io service. frp, rathole, chisel, sish and boringproxy expect a server you run. The qURL CLI needs no server and no account. Which open-source alternatives control who can open the app? Pangolin has SSO, PIN codes, passcodes, email one-time codes and share links that can expire and be revoked. zrok has basic auth, OAuth with an email pattern, and private shares. sish has basic auth, IP and country allowlists and per-tunnel deadlines. frp has basic auth for HTTP proxies and secret keys for STCP. A qURL link opens once and expires within 24 hours. Is inlets open source? inlets Pro, the version that is maintained, is commercial software that needs a paid subscription and a license key. ## Related Resources [ngrok alternatives →](https://layerv.ai/compare/ngrok-alternatives/) [ngrok alternatives with authentication →](https://layerv.ai/compare/ngrok-alternatives-with-auth/) [qURL vs frp →](https://layerv.ai/compare/qurl-vs-frp/) [qURL vs Pangolin →](https://layerv.ai/compare/qurl-vs-pangolin/) [qURL vs zrok →](https://layerv.ai/compare/qurl-vs-zrok/) [Every localhost tunnel, compared →](https://layerv.ai/compare/localhost-tunnels/) [An ngrok alternative with no public URL ↗](https://qurl.link/private-ngrok-alternative) [qURL CLI source ↗](https://github.com/layervai/qurl-integrations) ## Built it with an agent? Let it share it. One prompt points Claude Code, Cursor, or Windsurf at the qURL skill. Or install the CLI and publish the app yourself. No account either way. [Get the prompt ↗](https://layerv.ai/vibe-coding/) New to qURL? Start at [qurl.link ](https://qurl.link/) --- *This markdown version is auto-generated from [https://layerv.ai/compare/open-source-ngrok-alternatives/](https://layerv.ai/compare/open-source-ngrok-alternatives/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*