ngrok vs rustunnel — Honest Comparison of Pricing, Features & Self-Hosting

Looking for an ngrok vs rustunnel comparison that is not a pure sales page? This post is the head-to-head: pricing, open source, self-hosting, protocols, custom domains, and AI-agent support — with honest concessions on both sides. (Yes, we build rustunnel. We still document when ngrok is the better pick.)

ngrok remains the default name developers type when they need a public URL for localhost. rustunnel is the open-source, pay-as-you-go alternative built in Rust. If you want the broader category overview first, start with the open-source ngrok alternative pillar; this page goes deep on ngrok vs rustunnel specifically.

Feature comparison at a glance

Pricing note (2026-07): ngrok's public pricing lists Free (one-time usage credit, limited online endpoints), Hobbyist (~$8/month billed annually or $10 monthly, with monthly included usage), and Pay-as-you-go ($20/month plus additional usage). Always re-check ngrok.com/pricing before you budget — SaaS tiers change. rustunnel numbers come from our own published plans.

Pricing: flat tiers vs metered bandwidth

ngrok's model is plan-first. You pick Free, Hobbyist, or Pay-as-you-go (and higher tiers for orgs). You pay the plan even when your tunnels are idle over the weekend. Free is generous for a first hour of demos; production habits usually push people onto paid tiers for reserved domains, more endpoints, or team features.

rustunnel's managed model is usage-first:

# rustunnel managed — one command, HTTPS URL
rustunnel http 3000
# → https://random-subdomain.eu.edge.rustunnel.com

If you transfer under 30 GB on PAYG, you stay at the $3 floor. If you spike in CI, you pay for bytes — and you can set a spend cap so a runaway job suspends tunnels instead of surprising you with a huge bill. For the full billing rationale see pay-as-you-go tunnel pricing.

Open source and self-hosting

This is the structural fork in the comparison.

• ngrok is a commercial closed-source product. Self-hosting the control plane is not the default path; it is an enterprise conversation.
• rustunnel ships the server, client, and MCP integration under AGPL. The managed cloud is optional convenience, not a feature gate on the protocol.

# Self-host rustunnel on any VPS
curl -fsSL https://install.rustunnel.dev | sh
rustunnel-server init --domain tunnel.yourdomain.com
rustunnel-server start --tls --email admin@yourdomain.com

For a full walkthrough (Hetzner-sized box, DNS, TLS), see self-host ngrok on Hetzner and the self-hosting guide.

Architecture sketch

Both products put a relay in the middle: your laptop opens an outbound encrypted connection; the public edge terminates HTTPS and forwards traffic back through that session. Differences show up in packaging and ops:

1. Client — ngrok ships a polished multi-platform agent with a long product history. rustunnel's client is a ~5 MB Rust binary that idles around ~8 MB RAM.
2. Mux — rustunnel multiplexes tunnels over a single WebSocket to the edge (see the deeper diagram on the ngrok alternative post).
3. Ops surface — ngrok gives you a mature SaaS console and traffic inspection story. rustunnel gives you a dashboard + API on managed cloud, or full Prometheus (/metrics), groups, and health checks when you self-host.

# Protocols on the same CLI
rustunnel http 3000
rustunnel tcp 5432
rustunnel udp 27015
rustunnel p2p 5432 --secret <shared> --name my-db

When to choose ngrok

Pick ngrok when:

• You want the most recognized brand in the category and zero interest in operatorship.
• Your company already standardized on ngrok (SSO, audit logs, enterprise contracts, BAAs).
• You need traffic policy / enterprise edge features that live deep in ngrok's commercial stack.
• A free or Hobbyist plan covers occasional webhook tests and you do not care about open source.

Those are real advantages. Pretending otherwise would make this page less citable — and less useful.

When to choose rustunnel

Pick rustunnel when:

• You want open source + self-host without an enterprise sales process.
• You prefer pay-as-you-go economics where idle time is not a tax.
• You need UDP, P2P, and group load balancing with health checks from one CLI.
• You work with AI agents and want tunnels driven via MCP from Claude Code / Cursor / Codex.
• You may start on managed cloud and move to self-host later without rewriting tooling.

Getting started with rustunnel

brew tap joaoh82/rustunnel
brew install rustunnel
rustunnel setup
rustunnel http 3000

Hobby is free (2 tunnels, random subdomains). PAYG starts at $3/month. Self-host stays free under AGPL.

For deeper docs: quickstart, load balancing reference, P2P tunnels, MCP / AI tools. Sibling comparisons: rustunnel vs Cloudflare Tunnel, vs Pinggy, vs LocalXpose, vs FRP.

Deep dive: what "free" actually means on each side

Free tiers are where most developers form a permanent opinion about a tunnel product. ngrok's Free plan (as of mid-2026 public pricing) includes a one-time usage credit and a small number of online endpoints with an assigned development domain. That is perfect for a weekend OAuth debug session. It is a poor fit if you need the same URL every Monday morning for a client review, or if your CI job restarts tunnels hundreds of times a month and burns through credits.

rustunnel Hobby is different in shape: two concurrent tunnels, random subdomains, no one-time credit meter on the free path, and no interstitial page in front of your traffic. You are limited by concurrency and naming, not by a depleting wallet of free usage. When you outgrow Hobby you move to pay-as-you-go — not to a feature matrix that locks custom subdomains behind a higher tier while still charging you when the tunnel is idle.

A practical decision rule:

1. One-off demo this afternoon → either free tier works; pick whatever is already installed.
2. Recurring webhook testing for a solo app → rustunnel PAYG or Hobby usually wins on cost predictability.
3. Company-wide SSO, audit logs, BAAs → ngrok enterprise packaging is often the path of least resistance, regardless of open source ideals.
4. Data residency / air-gapped lab → only a true self-hosted relay (rustunnel AGPL server) satisfies the constraint without a sales call.

Operational checklist before you migrate off ngrok

If you are evaluating a migration, run this checklist once before you rewrite scripts:

• Inventory every place an ngrok URL is hardcoded (Stripe webhooks, GitHub App callbacks, mobile deep links, partner sandboxes).
• Decide stable vs ephemeral URLs. Ephemeral is fine for agents; stable needs custom subdomains (PAYG) or your own domain (self-host).
• Measure monthly bytes proxied, not "number of tunnels." Bandwidth is what rustunnel bills; tunnel count is free on PAYG.
• Confirm whether any workflow needs TCP with fixed remote ports, UDP, or mutual TLS that you currently buy from ngrok add-ons.
• If AI agents open tunnels, plan the token distribution story (RUSTUNNEL_TOKEN / API keys) the same way you plan cloud credentials.

# Example migration pattern: keep the same local port, change only the public URL
rustunnel http 4242 --subdomain stripe-webhooks
# Update the provider dashboard once, then forget it

Security and trust boundaries

Neither product magically makes localhost "secure." Both expose a local process to the public internet through an authenticated outbound control channel. The differences are in who operates the middlebox and what you can inspect.

• With managed ngrok, the middlebox is ngrok's commercial edge. You get a mature traffic inspector and enterprise policy surface.
• With managed rustunnel, the middlebox is rustunnel's multi-region edge. Payloads are proxied end-to-end over TLS; you get dashboard + API key controls and optional spend caps.
• With self-hosted rustunnel, the middlebox is your VPS. Certificate issuance, firewall rules, and retention policies are yours to define — which is exactly what regulated environments often require.

For threat modeling, treat a public tunnel URL like a temporary production endpoint: pin auth on the app itself, rotate tokens, and prefer short-lived agent tunnels over permanent anonymous HTTP.

Related reading and next steps

If this comparison helped, continue with:

• The pillar post rustunnel — open-source ngrok alternative for architecture diagrams and self-host summary.
• Pay-as-you-go pricing for the billing math.
• rustunnel vs FRP if you are comparing open-source reverse proxies rather than SaaS tunnels.
• Docs: quickstart, self-hosting, MCP server.

We will keep this page honest as public pricing drifts — if you spot a stale competitor claim, open an issue on the website repo or email support. Citable comparison pages only work when the concessions stay accurate.

→ Ready to try the open-source path? Create a free account or browse the GitHub repo.