ngrok

Overview

ngrok is a cloud networking platform for developers and teams that need to route traffic securely to services across different environments. Its mix of tunnels, request controls and protocol support is the draw; the trade-off is that low-cost plans cap usage, and Hobbyist endpoints stop when their credit runs out.

Founded in 2015 and headquartered in San Francisco, ngrok says 15.3 million developers have signed up. That scale may reassure teams considering a broadly used platform, but the more useful question is whether its usage limits and controls fit the workload.

Key features

Tunnels and traffic policy

The ngrok agent sends traffic through a secure tunnel to services wherever they run, without firewall changes. Traffic Policy adds CEL-based rules for routing and authenticating requests, rate limiting, applying web application firewall controls or rejecting traffic. That makes ngrok more than a way to expose a local service: it can also enforce request-level rules, provided a team is prepared to configure them.

Protocols and integrations

Support for HTTP, TLS and TCP extends to WebSockets, gRPC, SSH, Postgres, MQTT and Minecraft traffic. That breadth suits developers who need to connect services beyond conventional web apps. The Integrations Hub covers SSO, databases, event destinations, frameworks, Kubernetes, OAuth, protocols, webhooks and web servers. Signature verification for more than 70 webhook providers, including Stripe, GitHub, Bitbucket, Twilio, Slack and Shopify, can reduce the work of validating incoming events.

Security and operations

Agent-to-edge connections use TLS 1.2 or higher, and ngrok encrypts databases, filesystems and data warehousing at rest. It states that it is SOC 2 Type 2 compliant, supports HIPAA deployments and BAAs, is GDPR and CCPA compliant, and participates in the EU-US Data Privacy Framework. Region pinning and points of presence across the United States, Europe, Asia Pacific, Australia, India, Japan and South America give teams options for where traffic is handled. Paid support options include Dedicated On-Call with an 8 business hour SLA, plus Slack or Teams and 24×7 paging add-ons.

Pricing

The Free plan costs 0.00 USD per free, with $5 one-time usage, up to 3 online endpoints, 1GB of data transfer, 20k HTTP/S requests and 1 team member. It suits experiments and light personal use, but its modest allowances make it a poor fit for a service with sustained traffic. The plan's one-time included usage is distinct from Hobbyist's monthly credit.

Hobbyist costs 10.00 USD per month, billed monthly, and includes $10 monthly usage, up to 3 online endpoints, 5GB of data transfer, 100k HTTP/S requests and 1 team member. It is aimed at solo developers, home labs and game servers that need more room than Free. The crucial limitation is that when Hobbyist usage credit runs out, endpoints stop working until the billing cycle ends and the credit resets; that makes it unsuitable for workloads that cannot tolerate an interruption.

Pay-as-you-go costs 20.00 USD per month, billed monthly plus additional usage. It includes $20 monthly usage, unlimited online endpoints, data transfer, HTTP/S requests and team members. This is the more practical tier for teams shipping production traffic, especially when endpoint or team-member counts would constrain Hobbyist. Additional usage means the monthly price is not the full cost ceiling.

Enterprise has custom pricing on a contract basis. It adds SSO/SAML and SCIM, SLAs with dedicated support, HIPAA, SOC 2 and BAAs, AWS Marketplace, and per-device and per-customer pricing. It is the relevant option for organizations needing those enterprise controls or commercial terms; teams that do not need them can start with the usage-based tiers. A free trial is available.

Platforms

ngrok supports API, Linux, macOS, self-hosted, web and Windows. Its deployment model and configuration method are both, making it relevant to teams that need a mix of hosted and self-managed setups. TLS termination, rate limiting, WAF controls and WebSocket support are also included.

Who it's for

ngrok is a strong fit for developers who need secure access to services without firewall changes, especially when they also need request policies, webhook verification or less common protocol support. Free and Hobbyist are oriented toward developers, solo users, home labs and game servers; Pay-as-you-go is positioned for teams shipping production traffic. If a production service must remain available regardless of a usage-credit threshold, the Hobbyist hard stop rules it out.

Pros and cons

• Pro: One platform covers secure tunnels and CEL-based routing, authentication, rate limiting and WAF controls, so teams can pair access with request handling.
• Pro: Broad protocol support and verification for more than 70 webhook providers serve workloads beyond ordinary HTTP applications.
• Pro: Region pinning, stated compliance support and higher-tier support options address needs that can matter in production deployments.
• Con: Free and Hobbyist restrict endpoints, traffic, requests and team size; Hobbyist also stops endpoints when its usage credit is exhausted.
• Con: Pay-as-you-go's $20 monthly price is paired with additional usage charges, so traffic growth can raise the bill.

Alternatives

Pomerium is worth considering when a smaller, explicitly capped access setup is enough: its free Personal plan includes 10 users, 10 routes, 5 policies and 2 service accounts, while Business is 7.00 USD per month.

LocalXpose is a simpler fit if two active HTTP or HTTPS tunnels, SSL/TLS encryption and unique subdomains cover the need; its Starter plan has time limits and an interstitial warning page.

BunkerWeb is an option for teams seeking a free, AGPLv3-licensed open-source web application firewall.

Caddy is another free option for teams looking for a web server or reverse proxy across platforms including Android, Linux, macOS and Windows.

freenginx suits readers who want a free, BSD-like licensed option for Linux, macOS, self-hosted or Windows environments.

NGINX is a free alternative when the need is a broad server and proxy stack, including content caching, load balancing and TCP/UDP or mail proxying.

Traefik Proxy is a free option for Kubernetes ingress, reverse proxying, load balancing and service auto-discovery.

For broader comparisons, see Reverse Proxy Software and Kubernetes Ingress Controllers.

Verdict

Choose ngrok if you need secure tunnels plus fine-grained traffic controls across a wide range of protocols, and can select a tier that matches your usage. Its main advantage is breadth in one platform; its main reason to look elsewhere is cost and availability risk at the lower tiers, particularly Hobbyist's hard stop when credit runs out.