qURL™ vs Tailscale Funnel
Share one app without a tailnet or a public hostname.
Tailscale Funnel needs a Tailscale account, a tailnet with MagicDNS and HTTPS, and a funnel attribute in your policy file; then the app is public on a ts.net hostname. qURL needs no account: the app stays off the public internet, and each recipient gets a link that is single-use by default and expires within 24 hours.
Facts checked October 1, 2026 against each vendor’s documentation. Download the data
Funnel and qURL both get an app on your machine to someone outside your network. Funnel makes a port on a tailnet device public; qURL sends a private link to each recipient.
How qURL and Tailscale Funnel differ
Funnel is part of Tailscale. To use it you need a tailnet, MagicDNS, HTTPS certificates for the tailnet, and a funnel node attribute in the tailnet policy file. tailscale funnel 3000 then makes the port “completely public”, in Tailscale’s words, at machine-name.tailnet-name.ts.net. Funnel listens only on ports 443, 8443, and 10000, its traffic is subject to non-configurable bandwidth limits, and it is in beta.
The hostname is discoverable too. Tailscale’s HTTPS documentation warns that machine names are published in the public Certificate Transparency ledger and advises against enabling HTTPS if a machine name is sensitive. Funnel requests carry no Tailscale identity, so Tailscale does not tell the app who is calling.
qURL needs no account and no network to join. qurl publish prints a CRID for the app, and qurl share turns it into an access link for one recipient. Recipients land on a host covered by a wildcard certificate, so no per-app name appears in Certificate Transparency logs.
From a running app to a link you can send
qurl publish http://127.0.0.1:3000
qurl share <CRID>tailscale funnel 3000qURL and Tailscale Funnel, side by side
| Question | qURL CLI | Tailscale Funnel |
|---|---|---|
| Account needed before the first URL | No. The first publish creates the device identity our test | Yes: a tailnet with MagicDNS, HTTPS certificates, and the funnel node attribute tailscale.com |
| What the URL looks like | A qurl.link access link per recipient; the app answers at r_<id>.qurl.site, a name absent from Certificate Transparency logs our test | Stable machine-name.tailnet-name.ts.net; machine names are published in Certificate Transparency logs tailscale.com |
| Who can reach it | No one until a link is opened; then the opener’s public IP for that session, including other devices behind that IP layerv.ai | Public: anyone on the internet tailscale.com |
| Warning page shown to visitors | None our test | Not documented tailscale.com |
| Visitor access control | Single-use access link by default; link and session lifetimes. IP allow and deny lists and other rules can gate links through the API, not the CLI layerv.ai | None on Funnel traffic; Funnel requests carry no Tailscale identity headers tailscale.com |
| Link expiry | Yes. qurl share returned a 24-hour link in our no-account test; no-account links are capped at 24 hours our test | No; runs until you turn it off tailscale.com |
| Single-use links | Yes, the default for qurl share our test | No tailscale.com |
| Protocols | HTTP(S), WebSocket, SSE; no raw TCP our test | HTTPS proxy, TCP, TLS-terminated TCP; ports 443, 8443, and 10000 only tailscale.com |
| Free-tier limits | Without an account: up to 3 active resources, with links that last up to 24 hours github.com | Available on all plans; non-configurable bandwidth limits, not published; beta tailscale.com |
Which one to use
Choose qURL to
Share one app with someone outside your tailnet without enrolling them, opening a public port, or publishing a machine name. Each link ends on its own, and nothing in a tailnet policy has to change.
When Tailscale is the better choice
If everyone who needs the app is already on your tailnet, use Tailscale Serve: it stays private to the tailnet and passes the viewer’s identity to the app. Choose Funnel when you want a stable public HTTPS address anyone can reach, including webhook senders.
Frequently Asked Questions
Do I need a Tailscale account to use Funnel?
Yes. Funnel runs on a device in your tailnet and needs MagicDNS, HTTPS certificates, and a funnel node attribute in the tailnet policy file. The qURL CLI publishes without an account; without one you get up to 3 active resources, with links that last up to 24 hours.
Is a Tailscale Funnel URL private?
No. Tailscale describes a Funnel port as completely public, and the ts.net hostname, which includes your machine and tailnet names, appears in Certificate Transparency logs.
Which ports can Funnel use?
Funnel listens publicly only on 443, 8443, and 10000, and proxies those to a port on your machine. A qURL access link has no public port to choose; recipients reach the app through the link.
Should I use Tailscale Serve instead?
Use Serve when every viewer is already on your tailnet: it keeps the app private to the tailnet and adds identity headers such as Tailscale-User-Login. qURL is for recipients outside the tailnet who should not have to join it.
How is this different from a public tunnel?
A public tunnel exposes an endpoint and can protect it with authentication. With LayerV, your local app stays hidden from public scans. You create a private, expiring way in for one resource at a time. A teammate or AI agent can use the app without a public deployment or access to your wider network.
Who can open a qURL link?
Whoever holds it, once: with no flags, qurl share prints a single-use link. Opening it admits the network address it was opened from for the session, which lasts 1 hour by default for an app published from the CLI. Other devices on the same public IP address, such as an office or café network, can reach the app until the session ends, so keep your app’s own sign-in for anything sensitive. By default a link admits whoever opens it; access rules set through the API, such as IP allow and deny lists, can restrict that.
Can my coding agent share my app with qURL?
Yes. Give Claude Code, Cursor, or Windsurf the qURL skill (https://layerv.ai/skills/qurl/SKILL.md) and ask it to share the app: it installs the qurl CLI, publishes the app privately, and gives you an address to send. The agent applies the private access rules you choose. For named recipients, give it their email addresses so it can send invitations. Recipients verify their email in the browser and save a passkey; they never send you their email verification code. The agent checks policy support before sharing and keeps the app private if the deployment cannot support it. For one person right away, ask it for a one-time link instead. Codex starts with network access off, so save the skill file for it first.
Share your app without an account
Paste one prompt into your coding agent, or install the qURL CLI and publish the app yourself. No sign-up, no API key.
New to qURL? Start at qurl.link