Tailscale alternatives for sharing apps
Share your app with a customer, without asking them to install Tailscale or making the app public.
For a private customer demo without a VPN setup task, choose qURL™: recipients open a single-use link in their browser, with no account or client to install. Links expire within 24 hours. Tailscale Serve needs an account and client; Funnel makes the app public. For policies on your own domain, consider Cloudflare Access.
Facts checked October 1, 2026, each value linked to its source. Full dataset.
Why people look for Tailscale alternatives
- Tailscale Serve requires customers and contractors to have a Tailscale account and install its client.
- Tailscale Funnel makes the address public, and Funnel traffic carries no Tailscale identity headers.
- Funnel serves on ports 443, 8443 and 10000 only.
- Machine names, and so the address, appear in Certificate Transparency logs.
The alternatives at a glance
| Tool | Best for | Account needed before the first URL | Who can reach it | Visitor access control |
|---|---|---|---|---|
| qURL CLI | Someone outside your tailnet, with no account, client or public URL | No. The first publish creates the device identity our test | No one until a link is opened; then the opener’s public IP for that session, including other devices behind that IP layerv.ai | Single-use access link by default; link and session lifetimes. IP allow and deny lists and other rules can gate links through the API, not the CLI layerv.ai |
| Cloudflare Tunnel (named) | Identity-based policies in front of a stable hostname on your domain | Yes: account plus a domain on Cloudflare developers.cloudflare.com | Public unless you add a Cloudflare Access application developers.cloudflare.com | Cloudflare Access policies; service tokens for machines developers.cloudflare.com |
| Cloudflare Quick Tunnel (trycloudflare.com) | A quick URL gated by an email one-time PIN, with no account | No developers.cloudflare.com | Public, unless --allowed-mail is set developers.cloudflare.com | Optional --allowed-mail email one-time PIN (browsers only; change it by restarting cloudflared) developers.cloudflare.com |
| Pangolin | A self-hosted alternative with SSO and expiring share links | Yes: a Pangolin Cloud account, or the admin account on your own server docs.pangolin.net | Visitors who pass the resource's authentication; Pangolin SSO is on by default docs.pangolin.net | SSO and identity providers, users and roles, PIN, passcode, email OTP, header auth, share links, IP/geo/path rules docs.pangolin.net |
| zrok (free) | Private shares to other zrok accounts, including TCP and UDP | Yes: a free account, no card zrok.io | Your choice per share: public shares are open to anyone with the URL; private shares only to zrok accounts you grant netfoundry.io | Basic auth; OAuth with an email pattern; private shares github.com |
| Microsoft dev tunnels | A tunnel that is private by default for people in your GitHub organization or tenant | Yes: GitHub, Microsoft, or Entra ID learn.microsoft.com | Private by default; anonymous access is opt-in learn.microsoft.com | Tenant, GitHub organization, or anonymous; 24-hour access tokens learn.microsoft.com |
| ngrok (free plan) | A public URL with OAuth or IP rules added through a Traffic Policy | Yes: account and authtoken ngrok.com | Public: anyone with the URL ngrok.com | Traffic Policy: OAuth, OIDC, basic auth, IP restrictions (free plan: 3 OAuth/OIDC users a month) ngrok.com |
Each alternative
qURL CLIMade by LayerV
Best for: Someone outside your tailnet, with no account, client or public URL.
Trade-off vs Tailscale: No raw TCP; each recipient needs their own link.
Command to the first shareable URLqurl publish http://127.0.0.1:3000 qurl share <CRID>Cloudflare Tunnel (named)
Best for: Identity-based policies in front of a stable hostname on your domain.
Trade-off vs Tailscale: Needs a Cloudflare account and a domain on Cloudflare.
Command to the first shareable URLCreate the tunnel in the dashboard, run the cloudflared install command it shows, then add a published application routeCloudflare Quick Tunnel (trycloudflare.com)
Best for: A quick URL gated by an email one-time PIN, with no account.
Trade-off vs Tailscale: The hostname changes each run; browsers only for the PIN.
Command to the first shareable URLcloudflared tunnel --url http://localhost:8080Pangolin
Best for: A self-hosted alternative with SSO and expiring share links.
Trade-off vs Tailscale: You run the server, or use Pangolin Cloud with an account.
Command to the first shareable URLpangolin up site --id <ID> --secret <SECRET> --endpoint https://app.pangolin.net Then add a public HTTPS resource in the dashboardzrok (free)
Best for: Private shares to other zrok accounts, including TCP and UDP.
Trade-off vs Tailscale: Both sides need zrok.
Command to the first shareable URLzrok2 enable <TOKEN> zrok2 share public 8080Microsoft dev tunnels
Best for: A tunnel that is private by default for people in your GitHub organization or tenant.
Trade-off vs Tailscale: Needs a GitHub or Microsoft sign-in.
Command to the first shareable URLdevtunnel user login devtunnel host -p 8080 --allow-anonymousngrok (free plan)
Best for: A public URL with OAuth or IP rules added through a Traffic Policy.
Trade-off vs Tailscale: Needs an account and authtoken; public by default.
Command to the first shareable URLngrok config add-authtoken <TOKEN> ngrok http 8080
When to keep Tailscale
Keep Tailscale when everyone who needs the app is on your tailnet: Serve gives them a stable address, identity headers your app can read, and TCP as well as HTTP.
Frequently Asked Questions
Can I share a Tailscale app with someone who is not on my tailnet?
Yes. Tailscale machine sharing lets invited users outside your tailnet reach Serve, but they still need a Tailscale account and client. With qURL, send a single-use link instead: the recipient needs only a browser, with no account or software to install.
Is Tailscale Funnel private?
No. Funnel makes the address reachable by anyone on the internet, and Funnel requests carry no Tailscale identity headers.
Who can open a qURL link?
Whoever holds it, once. Opening it admits the network address it was opened from for the session, so other devices on that public IP, such as an office network, can reach the app until the session ends. Keep your app’s own sign-in for anything sensitive.
Built it with an agent? Let it share it.
One prompt points Claude Code, Cursor, or Windsurf at the qURL skill. Or install the CLI and publish the app yourself. No account either way.
New to qURL? Start at qurl.link