# Tailscale Funnel Alternative: Share a Private App Without Making It Public > qURL vs Tailscale Funnel: Funnel needs a tailnet and makes your app public on a ts.net name. qURL needs no account and sends an expiring link. Source: https://layerv.ai/compare/qurl-vs-tailscale-funnel/ --- [← All Comparisons](https://layerv.ai/compare/) # qURL™ vs Tailscale Funnel Share one app without a tailnet or a public hostname. Tailscale Funnel needs a Tailscale account, a tailnet with MagicDNS and HTTPS, and a funnel attribute in your policy file; then the app is public on a ts.net hostname. qURL needs no account: the app stays off the public internet, and each recipient gets a link that is single-use by default and expires within 24 hours. Facts checked October 1, 2026 against each vendor’s documentation. [Download the data](https://layerv.ai/data/localhost-tunnels/tunnels.json) Funnel and qURL both get an app on your machine to someone outside your network. Funnel makes a port on a tailnet device public; qURL sends a private link to each recipient. ## How qURL and Tailscale Funnel differ Funnel is part of Tailscale. To use it you need a tailnet, MagicDNS, HTTPS certificates for the tailnet, and a funnel node attribute in the tailnet policy file. tailscale funnel 3000 then makes the port “completely public”, in Tailscale’s words, at machine-name.tailnet-name.ts.net. Funnel listens only on ports 443, 8443, and 10000, its traffic is subject to non-configurable bandwidth limits, and it is in beta. The hostname is discoverable too. Tailscale’s HTTPS documentation warns that machine names are published in the public Certificate Transparency ledger and advises against enabling HTTPS if a machine name is sensitive. Funnel requests carry no Tailscale identity, so Tailscale does not tell the app who is calling. qURL needs no account and no network to join. qurl publish prints a CRID for the app, and qurl share turns it into an access link for one recipient. Recipients land on a host covered by a wildcard certificate, so no per-app name appears in Certificate Transparency logs. ## From a running app to a link you can send qURL CLI ``` qurl publish http://127.0.0.1:3000 qurl share ``` Tailscale Funnel ``` tailscale funnel 3000 ``` ## qURL and Tailscale Funnel, side by side __qURL CLI compared with Tailscale Funnel, with the source for each value__ | Question | qURL CLI | Tailscale Funnel | | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Account needed before the first URL | No. The first publish creates the device identity [our test](https://layerv.ai/research/qurl-behaviour) | Yes: a tailnet with MagicDNS, HTTPS certificates, and the funnel node attribute [tailscale.com](https://tailscale.com/kb/1223/funnel) | | What the URL looks like | A qurl.link access link per recipient; the app answers at r\_.qurl.site, a name absent from Certificate Transparency logs [our test](https://layerv.ai/research/qurl-behaviour) | Stable machine-name.tailnet-name.ts.net; machine names are published in Certificate Transparency logs [tailscale.com](https://tailscale.com/kb/1153/enabling-https) | | Who can reach it | No one until a link is opened; then the opener’s public IP for that session, including other devices behind that IP [layerv.ai](https://layerv.ai/docs/qurls.md) | Public: anyone on the internet [tailscale.com](https://tailscale.com/kb/1223/funnel) | | Warning page shown to visitors | None [our test](https://layerv.ai/research/qurl-behaviour) | Not documented [tailscale.com](https://tailscale.com/kb/1223/funnel) | | Visitor access control | Single-use access link by default; link and session lifetimes. IP allow and deny lists and other rules can gate links through the API, not the CLI [layerv.ai](https://layerv.ai/docs/qurls.md) | None on Funnel traffic; Funnel requests carry no Tailscale identity headers [tailscale.com](https://tailscale.com/kb/1312/serve) | | Link expiry | Yes. qurl share returned a 24-hour link in our no-account test; no-account links are capped at 24 hours [our test](https://layerv.ai/research/qurl-behaviour) | No; runs until you turn it off [tailscale.com](https://tailscale.com/kb/1311/tailscale-funnel) | | Single-use links | Yes, the default for qurl share [our test](https://layerv.ai/research/qurl-behaviour) | No [tailscale.com](https://tailscale.com/kb/1311/tailscale-funnel) | | Protocols | HTTP(S), WebSocket, SSE; no raw TCP [our test](https://layerv.ai/research/qurl-behaviour) | HTTPS proxy, TCP, TLS-terminated TCP; ports 443, 8443, and 10000 only [tailscale.com](https://tailscale.com/kb/1311/tailscale-funnel) | | Free-tier limits | Without an account: up to 3 active resources, with links that last up to 24 hours [github.com](https://github.com/layervai/qurl-integrations/blob/main/apps/cli/README.md) | Available on all plans; non-configurable bandwidth limits, not published; beta [tailscale.com](https://tailscale.com/kb/1223/funnel) | ## Which one to use ### Choose qURL to Share one app with someone outside your tailnet without enrolling them, opening a public port, or publishing a machine name. Each link ends on its own, and nothing in a tailnet policy has to change. ### When Tailscale is the better choice If everyone who needs the app is already on your tailnet, use Tailscale Serve: it stays private to the tailnet and passes the viewer’s identity to the app. Choose Funnel when you want a stable public HTTPS address anyone can reach, including webhook senders. ## Frequently Asked Questions Do I need a Tailscale account to use Funnel? Yes. Funnel runs on a device in your tailnet and needs MagicDNS, HTTPS certificates, and a funnel node attribute in the tailnet policy file. The qURL CLI publishes without an account; without one you get up to 3 active resources, with links that last up to 24 hours. Is a Tailscale Funnel URL private? No. Tailscale describes a Funnel port as completely public, and the ts.net hostname, which includes your machine and tailnet names, appears in Certificate Transparency logs. Which ports can Funnel use? Funnel listens publicly only on 443, 8443, and 10000, and proxies those to a port on your machine. A qURL access link has no public port to choose; recipients reach the app through the link. Should I use Tailscale Serve instead? Use Serve when every viewer is already on your tailnet: it keeps the app private to the tailnet and adds identity headers such as Tailscale-User-Login. qURL is for recipients outside the tailnet who should not have to join it. How is this different from a public tunnel? A public tunnel exposes an endpoint and can protect it with authentication. With LayerV, your local app stays hidden from public scans. You create a private, expiring way in for one resource at a time. A teammate or AI agent can use the app without a public deployment or access to your wider network. Who can open a qURL link? Whoever holds it, once: with no flags, qurl share prints a single-use link. Opening it admits the network address it was opened from for the session, which lasts 1 hour by default for an app published from the CLI. Other devices on the same public IP address, such as an office or café network, can reach the app until the session ends, so keep your app’s own sign-in for anything sensitive. By default a link admits whoever opens it; access rules set through the API, such as IP allow and deny lists, can restrict that. Can my coding agent share my app with qURL? Yes. Give Claude Code, Cursor, or Windsurf the qURL skill (https://layerv.ai/skills/qurl/SKILL.md) and ask it to share the app: it installs the qurl CLI, publishes the app privately, and gives you an address to send. The agent applies the private access rules you choose. For named recipients, give it their email addresses so it can send invitations. Recipients verify their email in the browser and save a passkey; they never send you their email verification code. The agent checks policy support before sharing and keeps the app private if the deployment cannot support it. For one person right away, ask it for a one-time link instead. Codex starts with network access off, so save the skill file for it first. ## Related Resources [Every localhost tunnel, compared →](https://layerv.ai/compare/localhost-tunnels/) [Cloudflare Tunnel vs ngrok vs Tailscale Funnel →](https://layerv.ai/compare/cloudflare-tunnel-vs-ngrok-vs-tailscale-funnel/) [LayerV vs Tailscale →](https://layerv.ai/compare/layerv-vs-tailscale/) [qURL vs ngrok →](https://layerv.ai/compare/qurl-vs-ngrok/) [qURL vs Cloudflare Quick Tunnels →](https://layerv.ai/compare/qurl-vs-cloudflare-quick-tunnels/) [Guide: Share localhost without signing up →](https://layerv.ai/guides/share-localhost-without-signup/) [Tailscale docs: Funnel ↗](https://tailscale.com/kb/1223/funnel) [Tailscale docs: Enabling HTTPS ↗](https://tailscale.com/kb/1153/enabling-https) [Tailscale alternatives for sharing apps →](https://layerv.ai/compare/tailscale-alternatives/) [qURL vs Tailscale Serve →](https://layerv.ai/compare/qurl-vs-tailscale-serve/) ## Share your app without an account Paste one prompt into your coding agent, or install the qURL CLI and publish the app yourself. No sign-up, no API key. [Get the agent prompt ↗](https://layerv.ai/vibe-coding/) [Install the CLI ↗](https://layerv.ai/cli/) New to qURL? Start at [qurl.link ](https://qurl.link/) --- *This markdown version is auto-generated from [https://layerv.ai/compare/qurl-vs-tailscale-funnel/](https://layerv.ai/compare/qurl-vs-tailscale-funnel/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*