qURL™ vs Pangolin
A self-hosted access platform, or a link with nothing to host.
Pangolin is a WireGuard-based reverse proxy you self-host or use as Pangolin Cloud, with SSO, PIN codes, email one-time codes and share links that can expire. qURL needs no server or account: qurl publish keeps the app off the public internet, and qurl share prints a link that works once and expires within 24 hours.
Facts checked October 14, 2026 against each vendor’s documentation. Download the data
Pangolin is an open-source access platform for publishing internal apps through a server you run. qURL is an MIT-licensed CLI that publishes a local app without a public route and hands out one link per recipient.
How qURL and Pangolin differ
Pangolin runs a server with a reverse proxy, and a site connector (the Pangolin CLI or Newt) links your machine to it over WireGuard. Each resource gets a hostname on a domain you add (Pangolin’s own domains are on paid Cloud plans), and Pangolin puts its own sign-in in front: single sign-on, PIN codes, passcodes, email one-time codes, geoblocking and allow-lists. Share links can carry an expiry and be deleted. Raw TCP and UDP resources on self-hosted servers bypass Pangolin’s authentication. The Community Edition is AGPL-3.0; the Enterprise Edition is under a commercial license.
qURL connects out from your machine too, but it gives the app no public address. qurl publish registers the app and prints its CRID, the app’s stable ID; qurl share turns the CRID into an access link for one recipient. Opening the link admits that recipient’s network address for the session; by protocol design, other addresses get no response.
From a running app to a link you can send
qurl publish http://127.0.0.1:3000
qurl share <CRID>pangolin up site --id <ID> --secret <SECRET> --endpoint https://app.pangolin.net
Then add a public HTTPS resource in the dashboardqURL and Pangolin, side by side
| Question | qURL CLI | Pangolin |
|---|---|---|
| Account needed before the first URL | No. The first publish creates the device identity our test | Yes: a Pangolin Cloud account, or the admin account on your own server docs.pangolin.net |
| What the URL looks like | A qurl.link access link per recipient; the app answers at r_<id>.qurl.site, a name absent from Certificate Transparency logs our test | A hostname on a domain you add; provided domains (.hostlocal.app, .tunneled.to) on paid Cloud plans docs.pangolin.net |
| Who can reach it | No one until a link is opened; then the opener’s public IP for that session, including other devices behind that IP layerv.ai | Visitors who pass the resource's authentication; Pangolin SSO is on by default docs.pangolin.net |
| Warning page shown to visitors | None our test | A Pangolin login page for unauthenticated visitors docs.pangolin.net |
| Visitor access control | Single-use access link by default; link and session lifetimes. IP allow and deny lists and other rules can gate links through the API, not the CLI layerv.ai | SSO and identity providers, users and roles, PIN, passcode, email OTP, header auth, share links, IP/geo/path rules docs.pangolin.net |
| Link expiry | Yes. qurl share returned a 24-hour link in our no-account test; no-account links are capped at 24 hours our test | Yes. Share links take an expiration or never expire; deleting a link revokes it docs.pangolin.net |
| Single-use links | Yes, the default for qurl share our test | Not documented docs.pangolin.net |
| Protocols | HTTP(S), WebSocket, SSE; no raw TCP our test | HTTP(S), browser SSH/RDP/VNC; raw TCP/UDP on self-hosted servers, without Pangolin authentication docs.pangolin.net |
| Free-tier limits | Without an account: up to 3 active resources, with links that last up to 24 hours github.com | Cloud Basic: 5 users, 5 sites, 5 domains, 15 public resources; Community Edition is free to self-host pangolin.net |
Which one to use
Choose qURL to
Share one app with one person or an agent from your own machine, with no server to run and no hostname to manage. Each link works once and expires on its own.
When Pangolin is the better choice
Choose Pangolin to publish many internal apps for a team behind single sign-on on infrastructure you control, with browser access to SSH, RDP and VNC.
Frequently Asked Questions
Is Pangolin open source?
The Community Edition is open source under AGPL-3.0. The Enterprise Edition is under the Fossorial Commercial License, free for personal use and for businesses under $100K in revenue.
Do Pangolin share links expire?
They can: a share link takes an optional validity period and can be deleted. A qURL link from qurl share opens once and expires within 24 hours by default.
Who can open a qURL link?
Whoever holds it, once: with no flags, qurl share prints a single-use link. Opening it admits the network address it was opened from for the session, which lasts 1 hour by default for an app published from the CLI. Other devices on the same public IP address, such as an office or café network, can reach the app until the session ends, so keep your app’s own sign-in for anything sensitive. By default a link admits whoever opens it; access rules set through the API, such as IP allow and deny lists, can restrict that.
Can my coding agent share my app with qURL?
Yes. Give Claude Code, Cursor, or Windsurf the qURL skill (https://layerv.ai/skills/qurl/SKILL.md) and ask it to share the app: it installs the qurl CLI, publishes the app privately, and gives you an address to send. The agent applies the private access rules you choose. For named recipients, give it their email addresses so it can send invitations. Recipients verify their email in the browser and save a passkey; they never send you their email verification code. The agent checks policy support before sharing and keeps the app private if the deployment cannot support it. For one person right away, ask it for a one-time link instead. Codex starts with network access off, so save the skill file for it first.
Share your app without an account
Paste one prompt into your coding agent, or install the qURL CLI and publish the app yourself. No sign-up, no API key.
New to qURL? Start at qurl.link