Compliance shops can self-host
If your tunnel traffic can't leave your infrastructure, run the whole stack — agent, server, dashboard, Postgres — on your own VM. Dual MIT + Apache-2.0 license. See the self-host runbook →
21tunnel is an ngrok alternative built around three ideas ngrok doesn't ship: open-source server (dual MIT + Apache-2.0), self-hostable end-to-end, and first-class AI-agent delegation via master keys + project namespaces. Free Hobby tier has 3 tunnels and a custom domain — ngrok's free tier doesn't.
Honest table. ngrok wins on track record and polish; we win on price, source code, self-host, and AI-agent delegation. Pick what matters for you.
| 21tunnel | ngrok | |
|---|---|---|
| Free tier | 3 tunnels · 10 Mbps/tunnel · 20k req/mo · custom domain | 1 tunnel · ephemeral subdomain · no custom domain |
| Starter paid tier | $10/mo Pro — 20 tunnels · BYO domain · edge auth | ~$10/mo Personal — vanity ngrok subdomain only |
| Self-host option | Yes — MIT + Apache-2.0, single Rust binary against Postgres | No — SaaS-only |
| Source code (server) | Open — github.com/vikasswaminh/21tunnel | Closed (agent is MIT; server proprietary) |
| AI-agent delegation | Yes — master keys mint scoped child keys, cascade revoke | No first-class delegation primitive |
| Multi-tenant dashboard | Yes — RBAC, audit log, MFA all on free tier | Single-tenant model; audit on paid tiers |
| Request inspector | All tiers (replay coming) | Paid tiers (with replay) |
| Track record / reliability | MVP-stage, 2026 | Decade-old; the proven choice |
If your tunnel traffic can't leave your infrastructure, run the whole stack — agent, server, dashboard, Postgres — on your own VM. Dual MIT + Apache-2.0 license. See the self-host runbook →
Paste an mtk_master_ key into your AI assistant;
it mints its own short-lived project-scoped child keys and
you cascade-revoke everything in one click.
Full AI-agent guide →
Pro is $10/mo — same price as ngrok's Personal but includes BYO custom domains, edge auth (Google OAuth gate), and reserved subdomains. ngrok's Personal tier has a vanity ngrok subdomain only. See pricing →
Security features are not paywalled. Multi-tenant dashboard with owner/admin/member/viewer roles, partitioned audit log, TOTP MFA — all on the free Hobby plan. ngrok puts audit and MFA on paid tiers.
The CLI is shaped like ngrok's. For 90% of scripts, you change one word.
# Before
ngrok http 3000
# After
mytunnel http 3000
# → https://<random>.21tunnel.com forwards to 127.0.0.1:3000
Config files don't auto-migrate yet — copy ~/.ngrok/ngrok.yml
into ~/.21tunnel/config.toml by hand (small file). A scripted
--from-ngrok import is on the roadmap.
For 90% of use cases, yes. `ngrok http 3000` becomes `mytunnel http 3000`. Same shape, same flow. The features we don't have yet: a dedicated Kubernetes Operator, some deeper traffic-policy connectors, and ngrok's enterprise-only agent flags. If any of those are load-bearing for you, stay on ngrok.
Three reasons: (1) you can self-host if compliance demands your tunnel traffic never leave your infrastructure, (2) the source is auditable, dual MIT + Apache-2.0, and (3) we ship AI-agent delegation primitives (master keys + project namespaces + cascade revoke) that ngrok doesn't have today.
3 concurrent tunnels, 10 Mbps per tunnel, 20k HTTP requests/month, one bring-your-own custom domain. No credit card to start. The 7-day Pro trial unlocks the paid features automatically on signup so you can evaluate without paying.
Today, manually. Recreate your reserved subdomains in the 21tunnel dashboard, copy your config from ~/.ngrok/ngrok.yml into ~/.21tunnel/config.toml (small file), and point your scripts at `mytunnel` instead of `ngrok`. A scripted `--from-ngrok` import is on the roadmap; we don't pretend it ships today.
All three. The agent is a single static Rust binary; `mytunnel` runs on macOS, Linux, and Windows. Install with one command via the install script on login.21tunnel.com or download from the releases page.
Pinggy.io if you want SSH-tunnel-only with zero install (single ssh command). Cloudflare Tunnel if your domain already lives on Cloudflare DNS and you want the WAF/DDoS layer for free. Localtunnel if you want an npm-install indie tool with no commercial support. We honestly recommend those for the fits where they're better.
$0 forever — 3 tunnels, 10 Mbps per tunnel, 20k requests/month, custom domain on signup. No card. Includes a 7-day Pro trial so you can test the paid features without committing.