ngrok

ngrok is a cloud networking platform that secures, transforms and routes traffic to services wherever they run. Its agent sends traffic through secure tunnels without requiring firewall changes. Traffic Policy uses CEL-based rules to route, authenticate, rate-limit, apply WAF controls or reject requests. The platform supports HTTP, TLS and TCP traffic, including WebSockets, gRPC, SSH, Postgres, MQTT and Minecraft. Its Integrations Hub lists integrations and guides for areas including SSO, databases, Kubernetes, OAuth, webhooks and web servers; it verifies webhook signatures for more than 70 providers. The free plan costs nothing and includes $5 one-time usage, up to three online endpoints, 1GB data transfer, 20k HTTP/S requests and one team member. Hobbyist costs $10 a month. When its usage credit runs out, endpoints stop until the billing cycle ends and credit resets. ngrok lists region pinning across the United States, Europe, Asia Pacific, Australia, India, Japan and South America.

ngrok provides tunneling, traffic controls and support for a wide range of protocols. Review the included usage limits and the Hobbyist credit behavior before choosing a plan.

The Free and Hobbyist plans are described for developers, solo developers, home labs and game servers. Pay-as-you-go is described for teams shipping production traffic.

Overview

ngrok is a cloud networking platform that securely connects traffic to services wherever they run. It suits developers and teams that need flexible tunnels, protocol support, and request controls; its breadth is a strength, but usage caps make plan choice important when availability matters.

Key features

Tunnels and traffic controls

The ngrok agent carries traffic to services through a secure tunnel without requiring firewall changes. Its CEL-based Traffic Policy can route and authenticate requests, impose rate limits, apply web application firewall controls, or reject traffic. That makes ngrok more capable than a tunnel alone for teams that need to shape incoming requests, though the policy controls may be unnecessary for a simple development endpoint.

Protocols and integrations

Support covers HTTP, TLS, and TCP, including WebSockets, gRPC, SSH, Postgres, MQTT, and Minecraft traffic. This range suits varied development and service-access needs, rather than only browser-facing web apps. The Integrations Hub includes guides and integrations for SSO, databases, event destinations, frameworks, Kubernetes, OAuth, protocols, webhooks, and web servers. Signature verification for more than 70 webhook providers, including Stripe, GitHub, Bitbucket, Twilio, Slack, and Shopify, is a practical advantage for teams receiving third-party events.

Security and deployment

Agent-to-edge connections use TLS 1.2 or higher, and ngrok encrypts databases, filesystems, and data warehousing at rest. It states that it is SOC 2 Type 2 compliant, supports HIPAA deployments and BAAs, complies with GDPR and CCPA, and participates in the EU-US Data Privacy Framework. Region pinning and points of presence across the United States, Europe, Asia Pacific, Australia, India, Japan, and South America give teams options for traffic placement. These are useful provisions for regulated or geographically distributed workloads, but deployment requirements still determine whether they fit a particular organization.

Pricing

ngrok uses a freemium model, with a free plan and paid plans from $10/mo. The free plan costs nothing, with a one-time $5 usage allowance, up to 3 online endpoints, up to 1GB of data transfer, up to 20k HTTP/S requests, and 1 team member. It is a reasonable starting point for solo development or small experiments, but its limited usage and single seat constrain sustained or collaborative work.

Hobbyist costs $10 a month, billed monthly, and includes $10 monthly usage, up to 3 online endpoints, 5GB of data transfer, 100k HTTP/S requests, and 1 team member. It adds recurring usage capacity over Free, while retaining the same endpoint and seat caps. A critical caveat applies when Hobbyist usage credit runs out: endpoints stop working until the billing cycle ends and the credit resets. That interruption makes it a poor fit for services that must remain reachable through a usage spike.

Pay-as-you-go costs $20 a month, billed monthly plus additional usage. It includes $20 monthly usage, unlimited online endpoints, unlimited data transfer, unlimited HTTP/S requests, and unlimited team members. The higher base price buys room for production traffic and team collaboration, but additional usage is billed beyond the included amount.

Enterprise has custom pricing under contract. It includes SSO/SAML and SCIM, SLAs with dedicated support, HIPAA, SOC 2, BAAs, AWS Marketplace, and per-device and per-customer pricing. Paid support options include Dedicated On-Call with an 8 business hour SLA, plus Slack or Teams and 24×7 paging add-ons.

Platforms

ngrok supports API, Linux, macOS, self-hosted, web, and Windows environments. It offers both cloud and self-hosted deployment, as well as both configuration methods.

Who it's for

Free and Hobbyist are aimed at developers, solo developers, home labs, and game servers. Pay-as-you-go is positioned for teams shipping production traffic, especially when unlimited endpoints, transfer, requests, and seats justify its higher monthly base cost. Organizations needing contract terms, identity provisioning, compliance provisions, or dedicated support should consider Enterprise. Those with workloads that cannot tolerate a usage-credit shutdown should avoid relying on Hobbyist.

Pros and cons

Pros

• Broad protocol coverage: HTTP, TLS, TCP, and protocols such as gRPC, SSH, Postgres, MQTT, and Minecraft support more than conventional web endpoints.
• Request-level controls: Traffic Policy combines routing, authentication, rate limiting, WAF controls, and rejection rules.
• Webhook verification: Signature checks for more than 70 providers can reduce the work of validating incoming events.
• Production plan headroom: Pay-as-you-go removes endpoint, transfer, request, and seat caps, with additional usage billed separately.

Cons

• Hobbyist can interrupt service: Endpoints stop when included usage credit runs out and remain stopped until the cycle resets.
• Entry plans limit collaboration: Free and Hobbyist each allow only one team member; both also cap online endpoints at three.
• Production usage can add cost: Pay-as-you-go charges for additional usage beyond its $20 monthly allowance.

Alternatives

For a broader comparison, browse Kubernetes Ingress Controllers or Reverse Proxy Software.

• Airlock Microgateway is a freemium option for API or self-hosted use; its free Community Edition is aimed at small environments or local development, with enforced throughput and six-month license validity.
• NGINX Ingress Controller is a self-hosted freemium option for readers who need an ingress controller for a Kubernetes cluster.
• agentgateway is a free open-source gateway available for API, Linux, or self-hosted use, deployable as a binary, Docker container, or Kubernetes workload.
• BFE Ingress Controller is a free Apache 2.0-licensed option for API, Linux, macOS, self-hosted, or Windows environments, with no plan limits stated.
• Contour is a free, self-hosted Kubernetes ingress controller with community support.
• Envoy Gateway is a free open-source option for API or self-hosted use.
• F5 BIG-IP Container Ingress Services is free open-source software for API or self-hosted use, but requires a compatible licensed BIG-IP system, a Kubernetes or OpenShift cluster, and AS3 installed on BIG-IP.
• HAProxy Ingress is a free Linux or self-hosted option that requires a Kubernetes cluster; version 0.16 requires Kubernetes 1.21 or newer.

Verdict

ngrok is a strong choice for developers and teams that need secure tunnels, broad protocol support, and meaningful traffic controls across varied environments. Pay-as-you-go is the clearest fit for production teams that need uncapped endpoints and collaboration, while the free tier suits limited individual use. Look elsewhere if a hard usage-credit stop is unacceptable or if a simpler, free Kubernetes ingress controller better matches the job.