7 free ngrok alternatives in 2026 — tested, scored, honest.

Yes, I work on one of these. I've put it last in the list and tried to keep the scoring boring — the same three questions for every tool — so you can skim the grid and pick your own. The goal is a fair reference post, not a pitch.

How we scored them

Three questions per tool:

1. How “free” is the free tier, really? Open-source and self-hostable is the strongest form. A SaaS with an uncapped no-credit-card tier is the next-best. A free tier with a rate cap or feature paywall is noted.
2. How hard is the first tunnel? Measured in commands. curl | sh then one command is the bar; anything more than that is friction.
3. What does the ops story look like at 50 tunnels? Is there a dashboard, audit log, RBAC? Or are you managing tunnels with SSH keys and a spreadsheet?

1. Cloudflare Tunnel (cloudflared)

Cloudflare's own tunneling product, built around cloudflared. You point it at a local service, add a DNS record on a domain you own (which must be on Cloudflare DNS), and it serves that service behind the Cloudflare edge with TLS termination and their WAF.

Good: free for most uses, the Cloudflare edge is genuinely world-class, DDoS protection and rate limiting come for free, integrates with Zero Trust for access control if you already use Cloudflare identity.

Pinches: you need a domain on Cloudflare's DNS. Not a tunnel-first tool — it's an extension of their edge platform. If your use case is “share localhost with a collaborator for 20 minutes” you're overpaying with setup complexity. And it's closed-source on the control-plane side.

Pick this when: you already run on Cloudflare and want tunnels as one more tool in that box.

2. Tailscale Funnel

Tailscale is a mesh VPN built on WireGuard. Funnel is their public-ingress feature: expose a port from any node on your tailnet to the internet. Free for personal plans.

Good: if you already run Tailscale, Funnel is one flag away (tailscale serve). The network model is excellent — your dev machine stays in the mesh, public traffic goes through their relays, authentication can leverage the mesh's existing identity.

Pinches: requires every endpoint to be on your tailnet. Fine for your own devices; awkward for “let a random teammate see this for five minutes.” The free plan has node limits; you upgrade when your team grows. Control plane is proprietary.

Pick this when: your team is already on Tailscale and you want another reason to keep loving it.

3. frp (Fast Reverse Proxy)

Chinese-origin open-source project, MIT-licensed, Go. Server + client model, you self-host both. Supports HTTP, HTTPS, TCP, UDP, STCP, plugins.

Good: completely free, completely open, incredibly widely deployed, handles just about every protocol variant you could want. Config is one TOML file per side. No vendor in the picture.

Pinches: no dashboard out of the box (there are third-party UIs, uneven quality). No multi-tenancy. No audit log. No built-in OAuth/OIDC gate — you wire auth yourself or put it behind an auth-proxy. Documentation is improving but still rough at the edges in English. If your use case is a single power-user running an always-on tunnel on their own box, this is the gold standard. If you're building a product on top, you're reinventing a lot.

Pick this when: you want zero external dependencies and you're comfortable writing your own management layer.

4. localtunnel

An older open-source project (Node.js). Point it at a local port, get a loca.lt URL. Free public service plus a self-hostable server.

Good: zero setup friction (npx localtunnel --port 3000). No account needed. Fine for five-minute share links.

Pinches: the public service has had reliability ups and downs; performance isn't comparable to commercial services. No custom domains on the free service, no auth, no inspector. Self-hosting is a bit fiddly. Not designed for long-running production tunnels.

Pick this when: you need a URL for two minutes and don't care about anything else.

5. bore

Tiny open-source TCP tunnel written in Rust. MIT. A single binary, about ~1000 lines of code. Genuinely elegant.

Good: smallest possible tool for the job. One binary, one command on each side, works. Easy to audit end-to-end; you can read the whole repo in an hour. Pure TCP, so works for SSH, databases, custom protocols.

Pinches: TCP-only (no HTTP routing, no built-in TLS termination of public traffic, no custom domains). No inspector, no auth, no dashboard. You're routing ports, that's it. Exactly what it says on the tin — nothing more.

Pick this when: you need a port-forward and refuse to run anything larger to get it.

6. chisel

Open-source TCP/UDP tunnel over HTTP(S) — built for firewall traversal when everything else is blocked. Go, MIT.

Good: the “everything is blocked except HTTPS” tool. Speaks WebSocket, so it tunnels through any proxy that lets WebSockets out. SOCKS5 server built in. Extremely useful in hostile network environments.

Pinches: not designed for public sharing — both sides have to authenticate and peer up. No public URL generator, no custom domains, no inspector. Fills a different niche than ngrok-style tools.

Pick this when: you need to punch out of a hotel / corporate / air-gapped network and connect to your home lab.

7. 21tunnel (us)

Open-source, dual MIT + Apache-2.0, Rust agent + server + dashboard. Free self-host; free hosted Hobby tier (no credit card). The tool this blog lives on.

Good: the only option in the list with all three of (1) fully open-source control plane, (2) free hosted tier with no rate cap, and (3) multi-tenant dashboard + RBAC + MFA + audit log + Stripe billing as a package. Rust, strict lints, no unsafe code. 5 DB migrations. One binary self-hosts the whole stack. See the build log for how it came together.

Pinches: newer than the field — MVP-stage, shipped late April 2026. Some ngrok enterprise-only features aren't here yet (full K8s Operator, some SaaS connector plugins). If “has been around for 10 years” is a requirement, this isn't it.

Pick this when: you want ngrok-like DX with an open-source control plane, or you want to self-host tunneling as a platform feature for your users without running ngrok on the backend.

How to pick one

Short list, in decision order:

• “I just want a URL for 2 minutes.” → localtunnel.
• “I use Cloudflare DNS already.” → Cloudflare Tunnel.
• “My team lives on Tailscale.” → Tailscale Funnel.
• “I'm exposing a TCP port from my hobby box, forever, and nothing more.” → bore or frp.
• “I'm stuck behind a paranoid firewall.” → chisel.
• “I want ngrok-like DX with a proper dashboard, open-source, self-hostable, free.” → 21tunnel. That's the niche we aimed for; see the comparison page for the specific decisions.
• “I want ngrok's polish and don't mind paying.” → stay on ngrok. Genuinely. They're good at what they do.

If your team ends up using two of these for different use-cases, that's a totally reasonable outcome. None of these tools are trying to be the last tool you ever install.

---