What are the ngrok free plan limits?
According to ngrok's official limits and pricing pages, the free plan includes:
- 1 GB of data transfer out per month, reset each billing cycle.
- 20,000 HTTP requests per month (sustained cap of 4,000 per minute) and 5,000 TCP connections per month. TCP requires credit card verification.
- Up to 3 online endpoints and 1 user.
- 1 development domain, assigned automatically. Custom, reserved and wildcard domains need a paid plan.
- An interstitial warning page before HTML browser traffic. Clicking "Visit" hides it for that domain for 7 days; it does not affect API clients and can be skipped with the
ngrok-skip-browser-warningheader. - $5 of one-time included usage.
The often repeated "two-hour session limit on the free plan" does not match the official docs: ngrok states that free endpoints have no timeout. On the paid side, Hobbyist is $10 per month (5 GB, no interstitial, 10 ngrok-branded domains, no bring-your-own domain) and Pay-as-you-go is $20 per month plus usage ($0.10 per GB after 5 GB; your own domain at $0.01 per active hour).
How do the ngrok alternatives compare?
Summary: Zorven and Pangolin are the options that combine HTTPS, TCP, UDP, custom domains and built-in visitor auth in a self-hostable package (Pangolin's raw TCP/UDP is self-hosted only); Cloudflare Quick Tunnel is the fastest start without an account, and frp and bore are the leanest self-hosted transports.
| Feature | Zorven | ngrok | Cloudflare Tunnel | Tailscale Funnel | Pangolin | Pinggy | localtunnel / bore | frp |
|---|---|---|---|---|---|---|---|---|
| HTTPS tunnel | Yes | Yes | Yes | Yes (TLS only; ports 443, 8443, 10000) | Yes | Yes | localtunnel: yes; bore: no (TCP only) | Yes (HTTP/HTTPS) |
| TCP | All plans | Yes (card verification on free) | Yes; visitors also need cloudflared | TLS connections only | Self-hosted only (remote node on Cloud) | Yes | bore: yes | Yes |
| UDP | Pro and up | Not documented | Not among public hostname service types | No (TLS only) | Self-hosted only | Yes | No | Yes |
| Custom domain | Hobby and up | Pay-as-you-go (billed per active hour) | Domain must be added to Cloudflare | No (ts.net only) | Included on free Basic | Pro | localtunnel: subdomain request (not guaranteed) | Yes (your server, your DNS) |
| Built-in auth / WAF | Basic Auth, Google/GitHub login, WAF log mode, bot protection on all plans; WAF blocking and Geo on Pro | Yes (Traffic Policy; plan dependent) | Cloudflare Access (Zero Trust) | Not documented | SSO (Team+), PIN, email OTP, geoblocking | Not verified here | bore: client secret only | Client auth (token/OIDC) |
| Self-host | Yes (AGPLv3 open core) | No | No | No | Yes (AGPL-3 + commercial EE) | No | Yes (MIT) | Yes, required (Apache-2.0) |
| Free tier (official) | 2 clients, 2 tunnels, 5 GB/month; first-visit warning page on HTTP tunnels under zorven.app | 1 GB/month, 20,000 requests, 3 endpoints, interstitial | Quick Tunnel without an account (200 in-flight requests, no SSE) | Personal: 6 users, non-commercial use | Basic: 5 users, 5 sites, 5 domains | 60-minute tunnel timeout, random subdomain | Free software | Free software; needs a server with a public IP |
| Entry price | Hobby $5/month (per plan) | Hobbyist $10/month | Zero Trust paid prices not published on the plans page | Standard $8/user/month | Team $4/user/month | Pro (price not shown on the official homepage; 7-day trial) | None | None (you pay for the server) |
"Not documented" and "not verified" mean we could not find a clear statement on the vendor's official pages; it does not mean the feature is missing. Prices are as of November 8, 2026 and may change.
Which tool fits which job?
Zorven
zorven 3000 puts a local port on a public HTTPS address. The client opens one outbound encrypted connection, so no port forwarding is needed and it works behind CGNAT. The Free plan includes 2 clients, 2 tunnels and 5 GB per month; when the quota runs out the connection stays up and speed drops to 1 Mbps. To be fair, the Free plan also shows a first-visit warning page on HTTP tunnels under zorven.app; paid plans and custom domains do not. Raw TCP is on every plan, UDP on Pro and up. Visitor login (password or Google/GitHub), WAF log mode, bot protection and Zorven CAPTCHA are on every plan; WAF blocking, Geo rules and IP allowlists are on Pro. The core is AGPLv3 and can be self-hosted. The weak spot: the hosted service runs in a single location (Istanbul) with no global edge network. See developers and personal for use cases.
Cloudflare Tunnel
Quick Tunnels need no account or domain, but Cloudflare's own docs limit each one to 200 in-flight requests (then 429), without Server-Sent Events, and point production traffic to named tunnels. A stable hostname requires adding your domain to Cloudflare first. Public hostname service types cover HTTP, HTTPS, TCP, SSH, RDP and others, but not UDP, and non-HTTP services require visitors to run cloudflared too. More in Cloudflare Tunnel alternative.
Tailscale Funnel
If you already run Tailscale, Funnel is the shortest path to a public URL. Its documented limits: ports 443, 8443 and 10000 only, TLS connections only, your tailnet's ts.net name only (no custom domain), non-configurable bandwidth limits, and beta status. The Personal plan is free for up to 6 users but meant for non-commercial use.
Pangolin
A WireGuard-based, AGPL-licensed, identity-aware reverse proxy and access platform with more than 23,000 GitHub stars, very popular in the self-hosting community. The free Basic plan covers 5 users, 5 sites and 5 domains. Raw TCP/UDP resources only work on self-hosted instances (or a remote node with Cloud), and per the docs they carry no authentication or access rules. Detailed comparison: Pangolin vs Zorven.
Pinggy
Works with a single SSH command and no install (ssh -p 443 -R0:localhost:8000 free.pinggy.io). Offers HTTP(S), TCP, UDP and TLS tunnels. Free tunnels close after 60 minutes and use random subdomains; custom domains are a Pro feature.
localtunnel and bore
Both are MIT-licensed, free and small. localtunnel focuses on sharing HTTP(S) and does not guarantee the subdomain you ask for. bore is a TCP-only tunnel; you can run your own bore server, and its README notes that traffic beyond the handshake is not encrypted by default.
frp
The most widely used self-hosted tunnel: Apache-2.0, with TCP, UDP, HTTP and HTTPS (plus STCP and peer-to-peer XTCP). It needs a server with a public IP; you write configuration files by hand, and the server offers a status dashboard and token or OIDC client authentication. For visitor login or a WAF you add another layer in front.
Is there an open-source, self-hosted ngrok alternative?
Yes, several. For a complete package: Zorven (AGPLv3; you run the server component on your own infrastructure and tunnel traffic stays there) and Pangolin (AGPL-3 community edition; the enterprise edition uses a commercial license). For a transport only: frp, bore and the localtunnel server. Zorven's open core leaves out some commercial features (for example Zorven Apps); see the FAQ.
How do I migrate from ngrok? Command mapping
Download the client or install it with curl -fsSL https://zorven.app/install.sh | sudo bash, then copy your device token from the dashboard. The Zorven side below uses documented commands only; see the CLI docs for every flag.
| Task | ngrok | Zorven |
|---|---|---|
| Save token | ngrok config add-authtoken <token> | zorven authtoken zrv_live_... |
| Expose an HTTP port | ngrok http 3000 | zorven 3000 or zorven http 3000 |
| HTTPS local target | ngrok http https://localhost:8443 | zorven https://localhost:8443 |
| Self-deleting tunnel | - | zorven ephemeral 3000 --ttl 30m |
| Password protection | ngrok http 3000 --basic-auth "user:pass" | Dashboard > Tunnels > Access: Basic Auth or Google/GitHub login (all plans) |
| Custom domain | ngrok http 3000 --url https://app.example.com | Dashboard > Domains: add the domain, verify with CNAME or TXT, attach to the tunnel (Hobby and up) |
| TCP (SSH, databases) | ngrok tcp 22 | Create a TCP tunnel in the dashboard with target 127.0.0.1:22; visitors connect to zorven.app:PORT |
| Background service | ngrok service install | sudo zorven service install --token zrv_live_... |
| Request inspection | Local web interface (localhost:4040) | Request inspector with one-click replay in the dashboard |
| Manage from an AI assistant | - | zorven mcp (Claude Code, Claude Desktop, Cursor; Pro and up) |
When should you still choose ngrok?
- Your visitors are spread worldwide. ngrok's official point-of-presence list includes the US, Europe (Frankfurt), Singapore, Australia, India, Japan and Brazil. Zorven's hosted service runs in one location (Istanbul), so visitors on distant continents may see higher latency.
- You need a mature ecosystem. ngrok has led the category for years; webhook provider docs, SDKs and integrations usually use ngrok in their examples.
- Usage-based billing suits you. With spiky traffic, Pay-as-you-go can work out cheaper than a fixed plan.
- You need API gateway or AI gateway features. ngrok has expanded in that direction; Zorven focuses on tunnels, tunnel security, private networking and remote access.
For team and company scenarios see business; for plan limits see pricing.
Frequently asked questions
Sources
- ngrok pricing (accessed: 2026-11-08)
- ngrok free plan limits (accessed: 2026-11-08)
- ngrok points of presence (accessed: 2026-11-08)
- Cloudflare Quick Tunnels (TryCloudflare) (accessed: 2026-11-08)
- Cloudflare: create a remote tunnel (accessed: 2026-11-08)
- Cloudflare: supported protocols (accessed: 2026-11-08)
- Tailscale Funnel (accessed: 2026-11-08)
- Tailscale pricing (accessed: 2026-11-08)
- Pangolin pricing (accessed: 2026-11-08)
- Pangolin on GitHub (accessed: 2026-11-08)
- Pangolin raw TCP/UDP resources (accessed: 2026-11-08)
- Pinggy (accessed: 2026-11-08)
- localtunnel on GitHub (accessed: 2026-11-08)
- bore on GitHub (accessed: 2026-11-08)
- frp on GitHub (accessed: 2026-11-08)
- Zorven pricing (accessed: 2026-11-08)
- Zorven docs (accessed: 2026-11-08)
- Zorven FAQ (accessed: 2026-11-08)
- About Zorven (accessed: 2026-11-08)
- Zorven llms.txt (accessed: 2026-11-08)