# Tailscale Alternatives for Sharing an App, Compared > Alternatives to Tailscale Serve and Funnel for sharing a local app with people outside your tailnet, without making it public to everyone. Source: https://layerv.ai/compare/tailscale-alternatives/ --- [← All Comparisons](https://layerv.ai/compare/) # Tailscale alternatives for sharing apps Share your app with a customer, without asking them to install Tailscale or making the app public. For a private customer demo without a VPN setup task, choose qURL™: recipients open a single-use link in their browser, with no account or client to install. Links expire within 24 hours. Tailscale Serve needs an account and client; Funnel makes the app public. For policies on your own domain, consider Cloudflare Access. Facts checked October 1, 2026, each value linked to its source. [Full dataset](https://layerv.ai/compare/localhost-tunnels/). ## Why people look for Tailscale alternatives - Tailscale Serve requires customers and contractors to have a Tailscale account and install its client. - Tailscale Funnel makes the address public, and Funnel traffic carries no Tailscale identity headers. - Funnel serves on ports 443, 8443 and 10000 only. - Machine names, and so the address, appear in Certificate Transparency logs. ## The alternatives at a glance __Tailscale alternatives for sharing apps: what each is best for, and account needed before the first URL, who can reach it, visitor access control__ | Tool | Best for | Account needed before the first URL | Who can reach it | Visitor access control | | ---------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [qURL CLI](https://layerv.ai/compare/tailscale-alternatives/#alt-qurl) | Someone outside your tailnet, with no account, client or public URL | No. The first publish creates the device identity [our test](https://layerv.ai/research/qurl-behaviour) | No one until a link is opened; then the opener’s public IP for that session, including other devices behind that IP [layerv.ai](https://layerv.ai/docs/qurls.md) | Single-use access link by default; link and session lifetimes. IP allow and deny lists and other rules can gate links through the API, not the CLI [layerv.ai](https://layerv.ai/docs/qurls.md) | | [Cloudflare Tunnel (named)](https://layerv.ai/compare/tailscale-alternatives/#alt-cloudflare-named-tunnel) | Identity-based policies in front of a stable hostname on your domain | Yes: account plus a domain on Cloudflare [developers.cloudflare.com](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/) | Public unless you add a Cloudflare Access application [developers.cloudflare.com](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/) | Cloudflare Access policies; service tokens for machines [developers.cloudflare.com](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/) | | [Cloudflare Quick Tunnel (trycloudflare.com)](https://layerv.ai/compare/tailscale-alternatives/#alt-cloudflare-quick-tunnel) | A quick URL gated by an email one-time PIN, with no account | No [developers.cloudflare.com](https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/) | Public, unless --allowed-mail is set [developers.cloudflare.com](https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/) | Optional --allowed-mail email one-time PIN (browsers only; change it by restarting cloudflared) [developers.cloudflare.com](https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/) | | [Pangolin](https://layerv.ai/compare/tailscale-alternatives/#alt-pangolin) | A self-hosted alternative with SSO and expiring share links | Yes: a Pangolin Cloud account, or the admin account on your own server [docs.pangolin.net](https://docs.pangolin.net/about/pangolin-cloud-vs-self-hosted) | Visitors who pass the resource's authentication; Pangolin SSO is on by default [docs.pangolin.net](https://docs.pangolin.net/manage/resources/public/authentication) | SSO and identity providers, users and roles, PIN, passcode, email OTP, header auth, share links, IP/geo/path rules [docs.pangolin.net](https://docs.pangolin.net/manage/resources/public/authentication) | | [zrok (free)](https://layerv.ai/compare/tailscale-alternatives/#alt-zrok) | Private shares to other zrok accounts, including TCP and UDP | Yes: a free account, no card [zrok.io](https://zrok.io/pricing/) | Your choice per share: public shares are open to anyone with the URL; private shares only to zrok accounts you grant [netfoundry.io](https://netfoundry.io/docs/zrok/how-tos/shares/configure-permission-modes) | Basic auth; OAuth with an email pattern; private shares [github.com](https://github.com/openziti/zrok/blob/main/cmd/zrok2/sharePublic.go) | | [Microsoft dev tunnels](https://layerv.ai/compare/tailscale-alternatives/#alt-ms-dev-tunnels) | A tunnel that is private by default for people in your GitHub organization or tenant | Yes: GitHub, Microsoft, or Entra ID [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/faq) | Private by default; anonymous access is opt-in [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security) | Tenant, GitHub organization, or anonymous; 24-hour access tokens [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security) | | [ngrok (free plan)](https://layerv.ai/compare/tailscale-alternatives/#alt-ngrok) | A public URL with OAuth or IP rules added through a Traffic Policy | Yes: account and authtoken [ngrok.com](https://ngrok.com/docs/share-localhost/quickstart) | Public: anyone with the URL [ngrok.com](https://ngrok.com/docs/share-localhost/quickstart) | Traffic Policy: OAuth, OIDC, basic auth, IP restrictions (free plan: 3 OAuth/OIDC users a month) [ngrok.com](https://ngrok.com/docs/share-localhost/auth) | ## Each alternative 1. ### qURL CLI Made by LayerV **Best for:** Someone outside your tailnet, with no account, client or public URL. **Trade-off vs Tailscale:** No raw TCP; each recipient needs their own link. Command to the first shareable URL `qurl publish http://127.0.0.1:3000 qurl share ` [All qURL CLI facts →](https://layerv.ai/compare/localhost-tunnels/#tool-qurl) 2. ### Cloudflare Tunnel (named) **Best for:** Identity-based policies in front of a stable hostname on your domain. **Trade-off vs Tailscale:** Needs a Cloudflare account and a domain on Cloudflare. Command to the first shareable URL Create the tunnel in the dashboard, run the cloudflared install command it shows, then add a published application route [qURL vs Cloudflare Tunnel (named) →](https://layerv.ai/compare/qurl-vs-cloudflare-tunnel/) 3. ### Cloudflare Quick Tunnel (trycloudflare.com) **Best for:** A quick URL gated by an email one-time PIN, with no account. **Trade-off vs Tailscale:** The hostname changes each run; browsers only for the PIN. Command to the first shareable URL `cloudflared tunnel --url http://localhost:8080` [qURL vs Cloudflare Quick Tunnel (trycloudflare.com) →](https://layerv.ai/compare/qurl-vs-cloudflare-quick-tunnels/) 4. ### Pangolin **Best for:** A self-hosted alternative with SSO and expiring share links. **Trade-off vs Tailscale:** You run the server, or use Pangolin Cloud with an account. Command to the first shareable URL `pangolin up site --id --secret --endpoint https://app.pangolin.net Then add a public HTTPS resource in the dashboard` [qURL vs Pangolin →](https://layerv.ai/compare/qurl-vs-pangolin/) 5. ### zrok (free) **Best for:** Private shares to other zrok accounts, including TCP and UDP. **Trade-off vs Tailscale:** Both sides need zrok. Command to the first shareable URL `zrok2 enable zrok2 share public 8080` [qURL vs zrok (free) →](https://layerv.ai/compare/qurl-vs-zrok/) 6. ### Microsoft dev tunnels **Best for:** A tunnel that is private by default for people in your GitHub organization or tenant. **Trade-off vs Tailscale:** Needs a GitHub or Microsoft sign-in. Command to the first shareable URL `devtunnel user login devtunnel host -p 8080 --allow-anonymous` [qURL vs Microsoft dev tunnels →](https://layerv.ai/compare/qurl-vs-microsoft-dev-tunnels/) 7. ### ngrok (free plan) **Best for:** A public URL with OAuth or IP rules added through a Traffic Policy. **Trade-off vs Tailscale:** Needs an account and authtoken; public by default. Command to the first shareable URL `ngrok config add-authtoken ngrok http 8080` [qURL vs ngrok (free plan) →](https://layerv.ai/compare/qurl-vs-ngrok/) ## When to keep Tailscale Keep Tailscale when everyone who needs the app is on your tailnet: Serve gives them a stable address, identity headers your app can read, and TCP as well as HTTP. ## Frequently Asked Questions Can I share a Tailscale app with someone who is not on my tailnet? Yes. Tailscale machine sharing lets invited users outside your tailnet reach Serve, but they still need a Tailscale account and client. With qURL, send a single-use link instead: the recipient needs only a browser, with no account or software to install. Is Tailscale Funnel private? No. Funnel makes the address reachable by anyone on the internet, and Funnel requests carry no Tailscale identity headers. Who can open a qURL link? Whoever holds it, once. Opening it admits the network address it was opened from for the session, so other devices on that public IP, such as an office network, can reach the app until the session ends. Keep your app’s own sign-in for anything sensitive. ## Related Resources [qURL vs Tailscale Serve →](https://layerv.ai/compare/qurl-vs-tailscale-serve/) [qURL vs Tailscale Funnel →](https://layerv.ai/compare/qurl-vs-tailscale-funnel/) [LayerV vs Tailscale →](https://layerv.ai/compare/layerv-vs-tailscale/) [Cloudflare Tunnel vs ngrok vs Tailscale Funnel →](https://layerv.ai/compare/cloudflare-tunnel-vs-ngrok-vs-tailscale-funnel/) [Cloudflare Tunnel alternatives →](https://layerv.ai/compare/cloudflare-tunnel-alternatives/) [Let one person open your local app ↗](https://qurl.link/share-with-one-person) ## Built it with an agent? Let it share it. One prompt points Claude Code, Cursor, or Windsurf at the qURL skill. Or install the CLI and publish the app yourself. No account either way. [Get the prompt ↗](https://layerv.ai/vibe-coding/) New to qURL? Start at [qurl.link ](https://qurl.link/) --- *This markdown version is auto-generated from [https://layerv.ai/compare/tailscale-alternatives/](https://layerv.ai/compare/tailscale-alternatives/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*