10 ngrok alternatives in 2026 — tested, ranked, honestly reviewed

ngrok is the default tunneling service and has been for a decade. That's worth something. But "default" isn't "best for you" — the free-tier subdomain churn breaks webhook integrations, the paid tier starts at ~$10/mo for a single reserved domain, the server is closed-source SaaS-only, and the AI-agent delegation story is still your-personal-token-in-an-env-var. Below: every credible ngrok alternative in 2026, scored on a reproducible 8-dimension rubric, with honest verdicts on which one fits which job.

Published 2026-05-11 · ~14 minute read · Author: Vikas Swaminh

TL;DR

Quick verdict by use case:

• Default + polish — ngrok still wins on documentation, dashboard polish, and the size of the existing Stack Overflow / Reddit answer pool.
• Free + custom domain — Cloudflare Tunnel, if your domain is on Cloudflare DNS.
• Simplest setup, no install — Pinggy.io, one SSH command.
• Self-host the whole stack — 21tunnel (Rust, MIT + Apache-2.0), frp (Go, Apache-2.0), or bore (Rust, MIT).
• Building for AI coding agents — 21tunnel (master key + scoped child keys + cascade revoke). Every other alternative leaks your full-access token to the agent.
• Already on Tailscale — Tailscale Funnel is built into your existing mesh, no second tool needed.

How we scored

Eight dimensions, each scored 0-2, then summed for a 0-16 composite. We score on what's in each product's documented free tier (or its lowest paid tier if there's no free tier) as of 2026-05-11. Pricing accurate on the date of writing; the SaaS pricing pages drift, so the absolute numbers age — the relative ranking shouldn't change much.

1. Setup friction — 0 = needs account + auth token before first run. 2 = single command, no account.
2. Stable URL on free tier — does the URL survive a tunnel restart? Webhook integrations depend on this. 0 = no. 2 = yes, including a reserved or custom subdomain.
3. Custom domain on free tier — bring your own domain at $0. 0 = paid only. 2 = free.
4. Self-hostability — can you run the server-side yourself? 0 = no, SaaS only. 2 = open-source server you can run on your own VM.
5. AI-agent delegation — does it have a master-key pattern so an AI agent can mint short-lived scoped child keys without holding your god-mode token? 0 = no. 2 = first-class, with cascade revoke.
6. Pricing transparency — does the public pricing page tell you the full cost of the use case you're shopping for? 0 = "contact us". 2 = simple table.
7. Request inspector / audit log — can you see and replay what came through? 0 = no. 2 = yes, on free or lowest paid tier.
8. Polish + ecosystem — docs, dashboard, editor extensions, community size. 0 = barely functional. 2 = best-in-class.

We do not score on "is the company old" or "do investors like it" — those don't matter for the decision you're making. We also don't score raw throughput because every tunneling service is fast enough for development. Sustained production traffic is a different question (none of these are built for that).

The 10 alternatives, ranked

1. 21tunnel 15 / 16

Best for: developers building AI-agent workflows, anyone who wants to self-host the entire stack on their own VM, and developers who want a custom domain on a free tier without being locked into Cloudflare DNS.

21tunnel ships an open-source Rust server (TLS 1.3 + yamux multiplexing), an open-source CLI agent (mytunnel), and a hosted dashboard. Free Hobby tier includes 3 concurrent tunnels, 10 Mbps per tunnel, 20,000 requests/month, and custom domain support on signup. Pro is $10/mo flat. The differentiator is the AI-agent delegation primitive: a mtk_master_ key can mint scoped child keys with TTL, organized into project namespaces with subdomain isolation, with one-click cascade revoke. Same shape Stripe / OpenAI / Resend use for service accounts, applied to tunnels.

Scoring: setup 1 (account needed) · stable URL 2 · custom domain free 2 · self-host 2 · AI-agent delegation 2 · pricing 2 · inspector 2 · polish 2.

Caveat: we made it. Read the head-to-head with ngrok and the ngrok-alternative landing for more depth. Smaller community than ngrok — the Stack Overflow answer pool is thinner. We made up for it with explicit docs but you'll occasionally have to read source.

2. ngrok 12 / 16

Best for: people who want the safe default, have heard of ngrok, and don't need the cheapest or most open option.

ngrok is the category leader and has been since 2015. The agent is open-source on GitHub; the server is proprietary SaaS. Free tier gives you one tunnel with an ephemeral subdomain — fine for a one-off, painful for daily webhook development because the URL changes every restart. Personal ~$10/mo gets you a reserved your-name.ngrok.io. Pro ~$20/mo adds custom domains and multiple concurrent tunnels. Documentation is genuinely excellent — the docs site is one of the best in the developer-tools space.

Scoring: setup 1 · stable URL 0 (free ephemeral) · custom domain free 0 · self-host 0 · AI-agent delegation 1 (auth tokens exist but no scoped child keys) · pricing 2 · inspector 2 · polish 2 · ecosystem bonus floor +4.

Honest: if you've used ngrok for years and you're happy, the migration cost to anything else isn't worth the savings. Switch when you hit a specific pain point — webhook URL churn, custom-domain pricing, or AI-agent delegation needs.

3. Cloudflare Tunnel 12 / 16

Best for: developers whose domains are already on Cloudflare DNS. Genuinely free for the use case most people care about (one custom-domain tunnel).

Cloudflare Tunnel (formerly Argo Tunnel) is part of Cloudflare's Zero Trust suite. You run cloudflared on your machine, it opens an outbound connection to Cloudflare's edge, traffic for your domain (which must be on Cloudflare DNS) rides through to localhost. Custom domain, free TLS via Cloudflare, all included. Optional Cloudflare Access for auth (free up to 50 users). The setup is heavier than ngrok — you're configuring a DNS record and a cloudflared service — but once it's running, it's just there.

Scoring: setup 1 (requires CF account and DNS setup) · stable URL 2 · custom domain free 2 · self-host 0 (Cloudflare edge is proprietary) · AI-agent delegation 1 (service tokens exist, no first-class child-key mint) · pricing 2 · inspector 0 (the Zero Trust dashboard has logs but no inline request inspector) · polish 2 · ecosystem bonus +2.

Honest: if your domain isn't on Cloudflare DNS, the migration to get this working might cost you more than just paying ngrok or 21tunnel for a year.

4. Pinggy.io 10 / 16

Best for: the absolutely-zero-install case — you just want to run one SSH command, get a URL, share it.

Pinggy is a small, focused tunneling service with an elegant pitch: SSH is already installed everywhere, so use SSH as the agent. ssh -p 443 -R 0:localhost:3000 a.pinggy.io and you get back a HTTPS URL. No binary to install, no account for the free tier, works on Windows / macOS / Linux uniformly. Paid tier ~$3/mo adds reserved subdomains and longer session timeouts.

Scoring: setup 2 (one SSH command) · stable URL 0 (free tier session expires hourly) · custom domain free 0 · self-host 0 · AI-agent delegation 0 · pricing 2 · inspector 1 (web inspector on paid tier) · polish 1 (smaller team, docs are good but thinner) · ecosystem +0.

Honest: the cheapest paid tier in the category. If "I just need a URL right now" is your only requirement, Pinggy is the lightest tool here.

5. Localtunnel 8 / 16

Best for: indie / hobby projects, npm users who want a free tunnel without an account.

Localtunnel is an npm package (npx localtunnel --port 3000) that gives you a *.loca.lt subdomain forwarding to localhost. Free, no account. It's maintained by volunteers (the original creator handed it off), uptime is best-effort, and it occasionally goes down for hours. Don't build a webhook-critical workflow on it; do use it for a quick share.

Scoring: setup 2 (one npx command) · stable URL 0 · custom domain free 0 · self-host 1 (the server is open-source on GitHub but running it is fiddly) · AI-agent delegation 0 · pricing 2 (free) · inspector 0 · polish 1.

Honest: indie spirit, modest reliability. Treat it as a community amenity, not infrastructure.

6. Tailscale Funnel 10 / 16

Best for: teams already on Tailscale who want to expose one localhost service to the public internet without adding a second tool.

Tailscale Funnel is Tailscale's "expose a service from your tailnet to the public internet" feature. If you already run Tailscale (and many small teams do, for the private VPN-mesh use case), Funnel lets you mark a service public with one command — no new binary, no new dashboard. It rides Tailscale's existing auth (SSO, ACLs, device posture). Comes with your tailnet at no extra cost up to the free plan's user count.

Scoring: setup 1 (already-on-Tailscale prerequisite) · stable URL 2 (uses your tailnet hostnames) · custom domain free 1 (limited) · self-host 0 (the coordination plane is Tailscale's SaaS) · AI-agent delegation 1 · pricing 2 · inspector 0 · polish 2 · ecosystem +1.

Honest: if you're not on Tailscale, the cost of adopting Tailscale just to use Funnel is way more friction than installing ngrok. Don't pick this as your first tunnel tool.

7. bore 8 / 16

Best for: minimalists who want the simplest possible self-hostable Rust binary.

bore (github.com/ekzhang/bore) is a single Rust binary that does one thing: TCP tunneling. Run bore server on a VPS, bore local 3000 --to your-server.com on your laptop, done. No HTTPS termination, no dashboard, no web inspector — that's the point. You bring your own TLS via Caddy in front. MIT-licensed, tiny codebase (~1,500 lines), genuinely simple.

Scoring: setup 1 (need a VPS) · stable URL 2 · custom domain free 2 (you set up DNS) · self-host 2 · AI-agent delegation 0 · pricing 2 (free + VPS cost) · inspector 0 · polish 1.

Honest: if you want a tunnel and you're comfortable running a server, bore is the right pick for the philosophical-minimalist case. Doesn't try to be a product.

8. serveo 7 / 16

Best for: quick one-offs over SSH; no install on most platforms.

serveo is an SSH-based tunnel service. ssh -R 80:localhost:3000 serveo.net and you get a https://*.serveo.net URL. No account, no install. It's run by an independent operator and goes down occasionally; reliability is similar to Localtunnel.

Scoring: setup 2 · stable URL 1 (best-effort subdomain) · custom domain free 0 · self-host 0 · AI-agent delegation 0 · pricing 2 (free) · inspector 0 · polish 1.

Honest: historically reliable, but single-operator means single point of failure. Fine as a backup; not infrastructure.

9. localhost.run 7 / 16

Best for: developers who like serveo's shape but want a more actively-maintained alternative.

localhost.run is essentially serveo's spiritual sibling — SSH-based tunneling, no install, no account for the free tier. Free tier gives you a *.lhr.life URL with hourly rotation; paid tier ~$5/mo gives you reserved subdomains and custom domains.

Scoring: setup 2 · stable URL 0 (free) · custom domain free 0 · self-host 0 · AI-agent delegation 0 · pricing 2 · inspector 1 (paid tier) · polish 2.

Honest: nicer dashboard than serveo, paid tier is one of the cheapest in the category. Picks up where serveo leaves off.

10. frp 9 / 16

Best for: Chinese dev community (large following there), self-host purists who want the most flexibility.

frp (Fast Reverse Proxy) is a Go-based self-hostable tunneling stack. Run frps on a server, frpc on your machine, configure TOML, done. Supports TCP / UDP / HTTPS / STCP / XTCP — the most protocol variety on this list. Apache-2.0 licensed. Documentation is partially Chinese-first; the English docs are good but thinner.

Scoring: setup 0 (TOML config) · stable URL 2 · custom domain free 2 · self-host 2 · AI-agent delegation 0 · pricing 2 · inspector 0 · polish 1.

Honest: if you want maximum flexibility and don't mind a steeper learning curve, frp is the most configurable thing on this list. If you want a product, not a toolkit, look elsewhere.

Side-by-side comparison

Same data as above, in one place:

How to pick (in one paragraph each)

If you want the default and don't want to think about it: ngrok. The docs are excellent, the StackOverflow answer pool is the largest, the migration cost of picking something else later is low because the primitive (a tunnel from a public URL to localhost) is the same everywhere.

If your domain is already on Cloudflare DNS: Cloudflare Tunnel. Free, custom domain, integrates with Cloudflare Access for auth. Setup is heavier than ngrok's but it's a one-time cost.

If you need the cheapest possible paid tier: Pinggy at ~$3/mo or localhost.run at ~$5/mo. Both work over SSH; the differentiator is dashboard polish.

If you want to self-host the entire stack: 21tunnel (if you also want a dashboard and a product), frp (if you want maximum protocol variety), or bore (if you want the smallest binary).

If you're building AI-agent workflows: 21tunnel. We built the master-key pattern specifically for this case. The mechanics are documented at our AI-agent page and the explainer post on master-key delegation. Every other tool on this list leaks your god-mode token to the agent.

If you're already on Tailscale: Funnel. It's already paid for.

Frequently asked questions

What's the best free alternative to ngrok in 2026?

Cloudflare Tunnel if your domain is on Cloudflare DNS (custom domain free, no time limits). Pinggy if you want zero install. 21tunnel's free Hobby tier if you want 3 concurrent tunnels + custom domain + an upgrade path to AI-agent delegation.

Is there a fully open-source alternative to ngrok?

Yes: 21tunnel (Rust, MIT + Apache-2.0, server + agent + dashboard), bore (Rust, MIT, agent + server), frp (Go, Apache-2.0). ngrok itself open-sources only the agent.

Why is ngrok so expensive compared to alternatives?

Brand inertia. They were first and they're still the default. Cloudflare Tunnel undercuts on price (free), 21tunnel undercuts on feature-for-feature pricing ($10/mo with custom domain vs ngrok's $20/mo Pro), Pinggy undercuts on absolute price (~$3/mo).

Can these handle production traffic?

Honestly, no — none of these are designed for sustained production traffic. They're development tools. If you need a public endpoint for a production app, terminate at a normal CDN / load balancer and connect to your real backend, not through a tunnel agent on someone's laptop.

Which alternative is best for AI coding agents?

21tunnel, because of the master-key delegation pattern. The agent gets a short-lived scoped child key, not your god-mode token. Cascade revoke from the dashboard nukes every key the agent ever minted in one click. ngrok and Cloudflare Tunnel both work but require giving the agent a higher-privilege token than ideal.

What about self-hosted ngrok-old (the v1 days)?

ngrok's v1 was open-source. v2 onwards is closed. The v1 codebase still exists on GitHub but is unmaintained and missing a decade of fixes. Don't deploy it to production. Use frp or 21tunnel for the self-host case.

Want to try the open-source alternative we ranked #1? 21tunnel is free on Hobby (3 tunnels, 10 Mbps per tunnel, 20,000 requests/month, custom domain on signup) and Pro is $10/mo flat. Or run the whole stack on your own VM — dual MIT + Apache-2.0 license, no SaaS dependency.

Related: What is ngrok? The honest explainer · 21tunnel vs ngrok (head-to-head) · Giving AI agents public URLs (the master-key pattern) · Exposing an MCP server to the internet.