ngrok

Overview

ngrok is a cloud networking platform for securely connecting services to traffic, with controls for routing and handling requests. It suits developers who need to expose services across environments and teams that need broader protocol or traffic-policy support. Its flexibility is a strength, but usage caps make plan choice important when endpoints must remain online.

Key features

Tunnels and traffic controls

The ngrok agent sends traffic to services through a secure tunnel without requiring firewall changes. Traffic Policy uses CEL-based rules to route or authenticate requests, apply rate limits or web application firewall (WAF) controls, and reject traffic. These controls make ngrok more than a basic tunnel, particularly for teams that need to govern incoming requests; users who only need occasional access to a development service may not need that breadth.

Protocols and integrations

ngrok supports HTTP, TLS, and TCP, including WebSockets, gRPC, SSH, Postgres, MQTT, and Minecraft traffic. That range suits varied development and service workloads, rather than only ordinary web traffic. Its Integrations Hub covers areas including SSO, databases, Kubernetes, OAuth, webhooks, and web servers. It also verifies webhook signatures for more than 70 providers, among them Stripe, GitHub, Bitbucket, Twilio, Slack, and Shopify.

Security and compliance

Agent-to-edge connections use TLS 1.2 or higher, and ngrok encrypts databases, filesystems, and data warehousing at rest. The company states that it is SOC 2 Type 2 compliant, supports HIPAA deployments and business associate agreements (BAAs), complies with GDPR and CCPA, and participates in the EU-US Data Privacy Framework. Region pinning and points of presence across the United States, Europe, Asia Pacific, Australia, India, Japan, and South America give customers options for locating traffic. Those capabilities make ngrok relevant to organizations with security or residency requirements, though Enterprise is the plan that explicitly includes HIPAA, SOC 2, and BAAs.

Support

Paid support options include Dedicated On-Call with an 8 business hour SLA, plus Slack or Teams support and 24×7 paging as add-ons. These options are most relevant to production teams that need a defined escalation path; they add less for hobby projects that can tolerate interruption.

Pricing

ngrok is freemium, with a free tier and paid plans starting at $10/mo. The Free plan costs 0.00 USD per free and includes $5 one-time usage, up to 3 online endpoints, 1GB of data transfer, 20k HTTP/S requests, and 1 team member. That is a useful starting point for individual experiments, but the one-time usage and small quotas limit sustained use.

Hobbyist costs 10.00 USD per month, billed monthly, and includes $10 monthly usage, up to 3 online endpoints, 5GB of data transfer, 100k HTTP/S requests, and 1 team member. It is aimed at solo developers, home labs, and game servers, but does not add endpoint capacity over Free. Most importantly, when Hobbyist usage credit runs out, endpoints stop working until the billing cycle ends and credit resets, a poor fit for workloads that cannot accept that interruption.

Pay-as-you-go costs 20.00 USD per month, billed monthly plus additional usage. It includes $20 monthly usage, unlimited online endpoints, data transfer, HTTP/S requests, and team members. For teams shipping production traffic, the higher base price buys room to scale past the Hobbyist caps, though additional usage can raise the bill.

Enterprise uses contract billing with custom pricing. It includes SSO/SAML and SCIM, SLAs with dedicated support, HIPAA, SOC 2, BAAs, AWS Marketplace, and per-device and per-customer pricing. It is the relevant option for organizations needing those enterprise identity, compliance, or support provisions; its contract model is less suited to buyers seeking a fixed self-serve price. ngrok offers a free trial, but no trial duration is stated.

Platforms

ngrok supports API, Linux, macOS, self-hosted, web, and Windows environments. Its deployment and configuration models both support mixed approaches, and TLS termination and WebSocket support are available.

Who it's for

ngrok is a strong fit for developers who need secure tunnels without firewall changes, especially when their work spans multiple protocols or requires webhook verification. Hobbyist is positioned for solo developers, home labs, and game servers; Pay-as-you-go is aimed at teams shipping production traffic. Organizations with compliance, identity, and service-level requirements should consider Enterprise. Its 15.3 million developer signups suggest broad adoption, but the plan limits—not the signup count—should guide a purchase decision.

Pros and cons

• Pro: Secure tunnels avoid firewall changes, making service access simpler across environments.
• Pro: CEL-based Traffic Policy combines routing, authentication, rate limiting, WAF controls, and rejection rules.
• Pro: Broad protocol and webhook support covers needs beyond standard HTTP development.
• Pro: Region pinning, at-rest encryption, TLS 1.2 or higher, and stated compliance support address security-sensitive deployments.
• Con: Free usage is capped at 3 endpoints, 1GB, 20k HTTP/S requests, and one team member.
• Con: Hobbyist has the same endpoint cap and stops serving endpoints after its usage credit is exhausted until reset.
• Con: Pay-as-you-go adds usage charges beyond its monthly included amount, while Enterprise requires custom contract pricing.

Alternatives

Consider Pomerium if its free Personal plan’s 10 users, 10 routes, 5 policies, and 2 service accounts better match an access-control setup; its Business plan is 7.00 USD per month.

BunkerWeb is worth considering when a free AGPLv3 open-source option is the priority, with a PRO plan also offered at custom pricing. Choose F5 BIG-IP APM as another option for access management across its supported platforms.

For a free open-source reverse proxy with HTTP serving, caching, load balancing, TCP/UDP proxying, and mail proxying, consider NGINX. Traefik Proxy is an alternative when service auto-discovery and ingress-controller capabilities matter. Envoy Proxy offers another free open-source proxy option, installable through Docker, macOS Homebrew, or a static binary. freenginx is another free option, distributed under a 2-clause BSD-like license.

Browse Reverse Proxy Software or Kubernetes Ingress Controllers for broader comparisons.

Verdict

Choose ngrok if you need secure tunnels plus flexible traffic rules, broad protocol support, or webhook verification across development and production services. Its free tier is useful for limited trials, while teams with substantial or production traffic should weigh the Pay-as-you-go allowances against extra usage charges. Look elsewhere if a hard usage stop is unacceptable, you need more than one Hobbyist team member, or a simpler free proxy better fits the job.