Cloudflare Tunnel vs ngrok
Cloudflare Tunnel and ngrok compared for exposing local and self-hosted services: free-tier limits, paid pricing, domains, protocols, request inspection, authentication, high availability and where each one breaks, as of November 2026.
Quick Answer
Both run a small agent next to your service that dials out, so you never open an inbound port. Cloudflare Tunnel (cloudflared 2026.10.7, Apache-2.0) is available on every Cloudflare plan, including the free one, with 1,000 tunnels per account at no cost and no bandwidth or request quota on the Tunnel pages we read. The catch: you need a Cloudflare account and a domain on Cloudflare to publish a stable hostname, and non-HTTP services such as SSH or TCP need cloudflared on the client too. Its account-free Quick Tunnels give a random trycloudflare.com URL for testing, capped at 200 in-flight requests and without Server-Sent Events. ngrok (agent 3.39.13, closed source) is built for the developer loop: one command gives you HTTPS on a stable dev domain, a Traffic Inspector that replays requests, Traffic Policy for OAuth, IP rules and rate limits, and raw TCP endpoints any client can reach. Its free plan is capped at 1 GB transfer and 20,000 HTTP requests a month with an interstitial page in browsers; Hobbyist is $10 a month and Pay-as-you-go starts at $20. Use ngrok for webhooks, demos and short-lived sharing. Use Cloudflare Tunnel to publish self-hosted apps on your own domain for free.
Last updated November 5, 2026. Covers cloudflared 2026.10.7 (30 Oct 2026) and ngrok agent 3.39.13 (22 Oct 2026), with ngrok's current Free, Hobbyist and Pay-as-you-go pricing and Cloudflare's Tunnel, Quick Tunnels and Tunnels for Platforms docs read in November 2026.
| Feature | Cloudflare Tunnel | ngrok |
|---|---|---|
| Agent Licence | cloudflared: Apache-2.0 (open source, Go) | Proprietary, closed source (v1 open source but unmaintained) |
| Free Tier | Tunnel on all plans incl. Free; 1,000 tunnels per account included; Quick Tunnels without an account | $5 one-time credit; 1 GB/month, 20k HTTP requests, 5k TCP connections, 3 endpoints, 1 user |
| Paid Plans | Tunnels for Platforms: $4.50 per tunnel/month beyond 1,000; other add-ons via Cloudflare plans | Hobbyist $10/month (save $24 billed annually); Pay-as-you-go $20/month base incl. $20 usage, then metered |
| Account / Domain Needed | Account + domain on Cloudflare for published apps; none for Quick Tunnels | ngrok account (authtoken); no domain needed |
| Hostnames / Domains | Any hostname on your Cloudflare zone (CNAME to <UUID>.cfargotunnel.com); random trycloudflare.com for Quick Tunnels | 1 dev domain free; Hobbyist adds up to 10 ngrok-branded domains; custom domains on Pay-as-you-go at $0.01/hour |
| Protocols | HTTP, HTTPS, Unix sockets, TCP, SSH, RDP, SMB, bastion mode | HTTP, HTTPS, TCP, TLS (raw TLS endpoints paid only) |
| Client Software for Non-HTTP | Yes: end users run cloudflared access tcp/ssh, or use Client-to-Tunnel | No: TCP endpoints are reachable by any client |
| Request Inspection & Replay | Yes: Traffic Inspector with edit and replay, plus Agent API access | |
| Authentication / Access Control | Cloudflare Access policies; email one-time PIN on Quick Tunnels | Traffic Policy: OAuth/OIDC, IP restrictions, mTLS, webhook verification |
| Edge Features (WAF, CDN, Rate Limits) | CDN caching, WAF, Bot Management, DDoS protection, Load Balancing | Traffic Policy rate limits, rewrites, routing; DDoS Firewall on all endpoints |
| High Availability | 4 connections to 2+ data centers per replica; up to 25 replicas per tunnel | Unlimited agents and endpoints on Pay-as-you-go; Cloud Endpoints stay up without an agent |
| Agent Transport | Outbound to Cloudflare on port 7844, post-quantum encrypted | Single outbound TLS connection on port 443 |
| Browser Interstitial | None | Interstitial on free HTML traffic (cookie skips it for 7 days); removed on paid plans |
| Latest Agent Release (Nov 2026) | cloudflared 2026.10.7 (30 Oct 2026) | Agent 3.39.13 (22 Oct 2026) |
Cloudflare Tunnel
Cloudflare's outbound-only tunnel service: the open-source cloudflared daemon keeps persistent, post-quantum encrypted connections to Cloudflare's network and maps public hostnames on your Cloudflare-managed domain to local services, with Cloudflare's CDN, WAF and DDoS protection in front.
Pros
- Available on all Cloudflare plans, including Free; every account includes 1,000 tunnels at no cost, and the Tunnel docs we read list no bandwidth or request quota
- Puts your origin behind Cloudflare's network, so CDN caching, WAF, Bot Management and DDoS protection apply to published hostnames, and the origin needs no public IP or open inbound port
- Built-in redundancy: each cloudflared run opens four connections to at least two Cloudflare data centers, and you can add up to 25 replicas (100 connections) per tunnel
- cloudflared is open source under Apache-2.0, ships packages for Linux (amd64, arm64, armhf, 386, FIPS builds), macOS and Windows, and runs as a systemd service, launch agent or Windows service
- Account-free Quick Tunnels give a temporary trycloudflare.com URL with one command, optionally gated by email one-time PINs via --allowed-mail
- Integrates with the rest of Cloudflare: Access policies, Load Balancing pools, Workers VPC, Terraform and the API
Cons
- Publishing a stable hostname needs a Cloudflare account and a domain on Cloudflare, so your DNS has to live there
- Non-HTTP services (TCP, SSH, RDP, SMB) are streamed over WebSockets and end users must run cloudflared access on their side; there is no plain public TCP port
- Quick Tunnels are for testing only: no uptime guarantee, a new hostname each time, 200 in-flight requests and no Server-Sent Events
- No built-in request inspector or replay like ngrok's Traffic Inspector
- Cloudflare's service-specific terms require a specific paid service to serve video and other large files through Free, Pro and Business plan hostnames
Best For
Self-hosters, homelab and VPS users who want to publish apps on their own domain for free with Cloudflare's edge security in front, and teams already using Cloudflare DNS, Access or Load Balancing.
ngrok
A developer-focused ingress platform: the ngrok agent (CLI, SDKs, Kubernetes Operator or reverse SSH) dials out to ngrok's network and creates public or internal endpoints, with request inspection and replay, Traffic Policy rules for auth and routing, and usage-based paid plans.
Pros
- Fastest path from localhost to a public HTTPS URL: ngrok http 8080 serves on a stable, auto-assigned dev domain that does not change between restarts, with no DNS setup
- Traffic Inspector shows every HTTP request and response, formats JSON and form bodies, and lets you edit and replay captured requests, which is ideal for webhook development
- Traffic Policy adds OAuth (for example Google), IP restrictions, mTLS, rate limits, rewrites and routing in front of your app without code changes
- Real public TCP endpoints (for example tcp://1.tcp.ngrok.io:12345) that any SSH, database or game client can reach without extra client software
- Several agent types: CLI, SDKs embedded in your app, a Kubernetes Operator and agentless reverse SSH; endpoints can also be internal-only
- One outbound TLS connection on port 443, which tends to pass restrictive corporate firewalls
Cons
- Free plan is tight: $5 of one-time credit, 1 GB transfer, 20,000 HTTP requests and 5,000 TCP connections a month, 3 online endpoints and a single user
- Free HTTP endpoints show an interstitial warning page to browser visitors until you upgrade or send the ngrok-skip-browser-warning header
- Custom and own domains need a paid plan, and production use is metered: endpoint hours, $0.10/GB transfer and $1 per 100k requests beyond the included amounts
- The current agent is closed source; only the unmaintained v1 is on GitHub
- SSO and RBAC are add-ons on Pay-as-you-go at $10 per user per month
Best For
Developers testing webhooks, sharing local work with clients or teammates, demoing mobile backends, and teams that want an API-gateway-style edge with auth and rate limiting on endpoints that can live anywhere.
Pricing at scale: free quotas vs metered usage
The pricing models could hardly be more different. Cloudflare's Tunnel docs say the product is available on all plans, and the Tunnels for Platforms page says every account includes 1,000 tunnels at no cost. Beyond that, extra tunnels cost $4.50 per tunnel per month, and every tunnel that exists counts, even with no connector online. None of the Tunnel pages we read set a bandwidth or request quota. The one billing-adjacent rule is in Cloudflare's service-specific terms: serving video and other large files through Free, Pro or Business hostnames requires a specific paid service. ngrok meters almost everything. The free plan comes with $5 of one-time credit, 1 GB of data transfer, 20,000 HTTP requests and 5,000 TCP connections per month, 3 online endpoints, 3 concurrent agents and one user. Hobbyist costs $10 a month, or saves $24 billed annually, and raises the included amounts to 5 GB and 100,000 requests, but it stops at its $10 credit. Pay-as-you-go has a $20 base fee that includes $20 of usage. Beyond that you pay $0.10 per GB, $1 per 100k HTTP requests, $2 per 100k TCP connections, endpoint hours, $0.01 per hour per custom domain, and $5 per extra user after three. So a busy self-hosted app moving 200 GB a month costs nothing on Cloudflare Tunnel, while on ngrok the transfer alone is roughly $19.50 above the included 5 GB.
Developer workflow: webhooks, inspection and sharing
This is where ngrok earns its price. Run ngrok http 8080 and you get an HTTPS URL on your account's dev domain, for example a name under ngrok-free.app. That URL stays the same when you restart the agent, so a webhook endpoint you register with a provider keeps working tomorrow. The Traffic Inspector lists every request and response, syntax-highlights JSON, XML and form bodies, filters by path, method or status, and replays any request. You can edit headers, query parameters or the body before replaying, which means you do not have to wait for Stripe or GitHub to redeliver an event while you fix a handler. The same data is available through the Agent API for automated tests. Cloudflare's equivalent quick path is cloudflared tunnel --url http://localhost:8080, which needs no account at all and prints a random trycloudflare.com URL. It is handy for a one-off share, and --allowed-mail can require an email one-time PIN. But the docs are explicit about its limits: the hostname changes every run, there is no uptime guarantee, it handles at most 200 in-flight requests before returning 429, and it does not support Server-Sent Events, which rules out many streaming and AI-chat demos. Neither Quick Tunnels nor named tunnels include a request inspector or replay.
Domains, DNS and protocols
To publish a stable hostname with Cloudflare Tunnel you need a Cloudflare account and a domain whose DNS is on Cloudflare. Adding a published application in the dashboard creates a CNAME to <UUID>.cfargotunnel.com for you, and a remotely managed tunnel can hold roughly 5,000 to 10,000 such applications in its 1 MB configuration. That works well if your DNS is already there and badly if it lives somewhere else and has to stay there. ngrok needs no domain. Free accounts get one dev domain, Hobbyist adds up to 10 ngrok-branded domains, and your own domains and wildcards need a paid plan. On Pay-as-you-go each custom domain costs $0.01 per hour, and wildcard traffic is billed per hostname. Protocols split the two further. Cloudflare publishes HTTP, HTTPS and Unix sockets directly to browsers. TCP, SSH, RDP and SMB are streamed over WebSockets, so the person connecting must run cloudflared access ssh or tcp, or use Client-to-Tunnel for long-lived connections. ngrok's TCP endpoints are ordinary host:port addresses such as 1.tcp.ngrok.io:12345 that any SSH client, database driver or Minecraft client can reach. That matters for sharing a database with a contractor or hosting a game server. Raw TLS endpoints that you terminate yourself are paid-only on ngrok.
Security model, access control and reliability
Both use the same basic idea: an agent dials out, so the service stays unreachable from the internet. cloudflared connects outbound on port 7844 with post-quantum encryption, and Cloudflare recommends allowing only that egress and blocking all inbound traffic. A tunnel UUID cannot be abused from another account, because cfargotunnel.com only proxies DNS records in the same account. Traffic then passes Cloudflare's CDN, WAF, Bot Management and DDoS protection, and you can put Cloudflare Access in front for identity-based login. ngrok's agent uses a single TLS connection on port 443, which is often easier to get through locked-down corporate networks. Access control is configured in Traffic Policy: an OAuth action with a managed provider such as Google, then a rule that denies anyone whose email does not end in your domain, plus IP restrictions, mTLS, rate limits and webhook signature verification. The free plan allows 5 rules per policy and 3 OAuth identities a month. For reliability, Cloudflare gives each connector four connections to at least two data centers, and you can add up to 25 replicas per tunnel or use Load Balancing for health-checked failover. On ngrok, Pay-as-you-go removes the endpoint and agent limits, and Cloud Endpoints can route traffic even when none of your agents are running. Free and Hobbyist are capped at 3 online endpoints.
Running it in production and on a VPS
For a homelab or VPS, the usual pattern is to install cloudflared as a service and manage the tunnel from the dashboard, the API or Terraform. Cloudflare documents systemd on Linux, launch agents on macOS and Windows services, plus guides for Kubernetes, Ansible and the major clouds. A Raspberry Pi can run it. For heavy traffic, the system requirements page recommends two dedicated hosts per location with at least 4 GB of RAM and 4 CPU cores each, 50,000 local ports and an open-files ulimit of 70,000 or more, because throughput is limited by ports rather than CPU. Metrics are exposed for Prometheus and Grafana. One operational gotcha: if the tunnel stops, its DNS record stays, and visitors see a 1016 error. ngrok's free endpoints have no timeout and can run as a background service. Production use is designed around Pay-as-you-go: unlimited endpoints, 100 TCP addresses, SDKs that embed the agent in your application, a Kubernetes Operator, and add-ons such as SSO and RBAC at $10 per user per month, dedicated agent IPs at $900 per month per region, and log export. The agent is closed source and self-updates with signed releases. If you need an auditable open-source agent, cloudflared's Apache-2.0 code is the only option of the two.
Verdict
Pick by what the tunnel is for. For the inner development loop, testing a Stripe or GitHub webhook, showing a client a branch, or pointing a phone at a local API, ngrok is the better tool. One command gives you an HTTPS URL that survives restarts, and the Traffic Inspector with edit-and-replay saves real time when a webhook handler misbehaves. The free plan covers that kind of light use, and Hobbyist at $10 a month removes the browser interstitial. For publishing something that stays up, a self-hosted dashboard, a homelab service, or an app on a VPS without opening ports, Cloudflare Tunnel wins. It costs nothing on the Free plan for up to 1,000 tunnels, the Tunnel pages we read set no transfer or request quota, it puts Cloudflare's WAF and DDoS protection in front, and replicas give you failover. You pay for it with DNS lock-in, since your domain has to be on Cloudflare, and with friction for non-HTTP protocols, because SSH and TCP users need cloudflared on their side. Choose ngrok instead for production only when you need public raw TCP endpoints that any client can reach, or its Traffic Policy gateway features, and you are fine with metered billing.