Your localhost,
over the internet.
Give anything on your machine a secure public link in one command. HTTP, TCP and TLS tunnels that work behind NAT, CGNAT, and corporate firewalls. No port forwarding. No router config. No exposed IP.
Private by default
Your traffic is never inspected.
Most tunnels either read your traffic or hide what runs on your machine. Localport does neither, and you don't have to take our word for it.
Open-source agent
The agent that runs on your machine is open source. Read it, build it yourself, and see what touches your network before you trust it.
View the agentRemote Access
A fleet answers nobody without a client certificate you issued. Every request is verified, every access is logged where it was enforced, and you revoke any one of them in seconds.
How it worksZero inspection
We never read your payloads, log them, or train on them. Traffic passes straight through and stays yours, in the region you choose.
Our privacy stanceStandard
A public HTTPS link for anything you run.
Run anything on a local port and get a public HTTPS link you control. It carries HTTP, TCP, and TLS with browser-trusted certificates out of the box, and you gate access with IP rules and a password. The address stays yours between restarts, so webhooks and teammates never hit a dead URL.
Remote Access
Name who reaches which device. Pro
A fleet refuses every caller until you say otherwise. Give access to a teammate, a role, or a machine, and name what it reaches: one device, a pattern, or the whole fleet. The grant is written against the identity, so it survives a certificate rotation, and taking it back closes the connections it covered.
Reaching no devices yet Reaching 1 of 180 devices Reaching 31 of 180 devices
Give access to Jane CooperShared
One URL that reaches every teammate at once.
Register the webhook once and never touch it again. A fanout tunnel hands your whole team one permanent URL, so every teammate receives the same request the moment it lands. No per-developer tunnels, and no replaying events to chase.
What's included.
Flat team pricing from $5/mo billed yearly ($6 month-to-month). No per user fees. No surprise overages. Everything below is on every plan except the two entries that name theirs.
- HTTP, TCP, TLS Tunnels
- Web apps, APIs, databases, SSH, game servers, and custom sockets.
- Automatic HTTPS
- A real certificate every browser trusts, issued and renewed for you.
- No Port Forwarding
- One outbound connection. Your router stays closed and your home IP stays hidden, behind CGNAT, double NAT, and office firewalls.
- Static Subdomains and Reserved Ports
- Reserve a name and a port so your address survives every restart.
- IP Allowlist
- Limit a tunnel to the addresses and ranges you trust. Everyone else is refused.
- Password Protection
- A username and password in front of any HTTP tunnel. No code changes.
- Header Authentication
- Require an API key or header on every request. Calls without it are refused.
- Webhook Verification
- Check signatures from GitHub, Stripe, Shopify, Slack, or a provider you configure.
- Force HTTPS
- Send every visitor to the https:// address. One toggle.
- Two-Factor Authentication
- Passkeys or an authenticator app. Admins can require it across the team.
- Session Management
- Every browser, phone, and CLI signed in. Sign one out and its access stops.
- Inspectable Agent
- The binary on your machine has its source on GitHub. Read it, build it yourself.
- Live Dashboard
- Connections, bandwidth, and live activity, without an SSH session.
- Secure Remote Access using mTLS
- Devices answer only certificates you issued. Revoke one to cut its live connections. Every connection is logged. Pro and Enterprise.
- Audit Log
- Every change to your team configuration: who, from where, when, allowed or refused. Pro and Enterprise.
Honest comparison
One flat price, nothing metered by usage.
One flat price buys your whole team real tunnels with nothing metered by usage. HTTP, TCP, TLS, fleets and Fanout, generous bandwidth, and every teammate are included, with certificate-gated remote access on Pro. We skip the free tier and spend that money on the paid plans instead. Here is how that stacks up against ngrok and Cloudflare Tunnels.
Same $20/mo as ngrok, billed yearly. Far more in the box.
Localport Pro gives you 30× the included bandwidth (150 GB vs 5 GB), 50 team members at one flat price instead of $5 per extra seat, and no per-endpoint-hour billing. Even Hobby starts at $5 with 4× the bandwidth of ngrok’s $8 tier.
Swipe to compare →
| Localport | ngrok | Cloudflare Tunnels | |
|---|---|---|---|
| Pricing | Flat $5 to $20/mo yearly | $8 to $20/mo + usage | Free HTTP, then enterprise |
| Monthly bandwidth | 20 to 150 GB included | 1 to 5 GB, then $0.10/GB | Unlimited (HTTP) |
| Team members | 5 to 50, one flat price | 1 to 3, then $5/user | Per seat |
| HTTP, TCP & TLS | Included | TLS on $20 tier | HTTP, TCP, SSH |
| Mutual TLS (mTLS) | On Pro, $20/mo | $20 tier + usage | Zero Trust add-on |
| Fleet tunnels | Included | Not supported | Not supported |
| Fanout delivery | Included | Not supported | Not supported |
| Password & IP rules | Included | Paid tiers | Zero Trust add-on |
| Open-source agent | Yes, on GitHub | Closed source | cloudflared (OSS) |
| Payload inspection | Never | On by default | Proxied |
Get your first tunnel running in one command.
Flat team pricing from $5/mo billed yearly. HTTP, TCP, and TLS tunnels on every plan, with certificate-gated remote access on Pro. Works straight through NAT, CGNAT, and corporate firewalls.
Start with a free trial. Cancel any time.
Inspect exactly what runs on your machine.
The Localport agent is the binary that connects your services to our network. Its source lives on GitHub, so you can read every commit, build it from scratch, and verify what touches your network before you ever trust it.