ngrok vs rustunnel — Honest Comparison of Pricing, Features & Self-Hosting

Looking for an ngrok vs rustunnel comparison that is not a pure sales page? The scannable product landing is rustunnel vs ngrok — table, when-to-choose, FAQs, and CTAs. This post is the long-form head-to-head: pricing, open source, self-hosting, protocols, custom domains, and AI-agent support, with honest concessions on both sides. (Yes, we build rustunnel. We still document when ngrok is the better pick.)

ngrok remains the default name developers type when they need a public URL for localhost. rustunnel is the open-source, pay-as-you-go alternative built in Rust. If you want the broader category overview first, start with the open-source ngrok alternative pillar; this page goes deep on ngrok vs rustunnel specifically.

Feature comparison at a glance

Pricing note (2026-07): ngrok's public pricing lists Free (one-time usage credit, limited online endpoints), Hobbyist (~$8/month billed annually or $10 monthly, with monthly included usage), and Pay-as-you-go ($20/month plus additional usage). Always re-check ngrok.com/pricing before you budget — SaaS tiers change. rustunnel numbers come from our own published plans.

Pricing: flat tiers vs metered bandwidth

ngrok's model is plan-first. You pick Free, Hobbyist, or Pay-as-you-go (and higher tiers for orgs). You pay the plan even when your tunnels are idle over the weekend. Free is generous for a first hour of demos; production habits usually push people onto paid tiers for reserved domains, more endpoints, or team features.

rustunnel's managed model is usage-first:

# rustunnel managed — one command, HTTPS URL
rustunnel http 3000
# → https://random-subdomain.eu.edge.rustunnel.com

If you transfer under 30 GB on PAYG, you stay at the $3 floor. If you spike in CI, you pay for bytes — and you can set a spend cap so a runaway job suspends tunnels instead of surprising you with a huge bill. For the full billing rationale see pay-as-you-go tunnel pricing.

Open source and self-hosting

This is the structural fork in the comparison.

• ngrok is a commercial closed-source product. Self-hosting the control plane is not the default path; it is an enterprise conversation.
• rustunnel ships the server, client, and MCP integration under AGPL. The managed cloud is optional convenience, not a feature gate on the protocol.

# Self-host rustunnel on any VPS
curl -fsSL https://install.rustunnel.dev | sh
rustunnel-server init --domain tunnel.yourdomain.com
rustunnel-server start --tls --email admin@yourdomain.com

For a full walkthrough (Hetzner-sized box, DNS, TLS), see self-host ngrok on Hetzner and the self-hosting guide.

Architecture sketch

Both products put a relay in the middle: your laptop opens an outbound encrypted connection; the public edge terminates HTTPS and forwards traffic back through that session. Differences show up in packaging and ops:

1. Client — ngrok ships a polished multi-platform agent with a long product history. rustunnel's client is a ~5 MB Rust binary that idles around ~8 MB RAM.
2. Mux — rustunnel multiplexes tunnels over a single WebSocket to the edge (see the deeper diagram on the ngrok alternative post).
3. Ops surface — ngrok gives you a mature SaaS console and traffic inspection story. rustunnel gives you a dashboard + API on managed cloud, or full Prometheus (/metrics), groups, and health checks when you self-host.

# Protocols on the same CLI
rustunnel http 3000
rustunnel tcp 5432
rustunnel udp 27015
rustunnel p2p 5432 --secret <shared> --name my-db

When to choose ngrok

Pick ngrok when:

• You want the most recognized brand in the category and zero interest in operatorship.
• Your company already standardized on ngrok (SSO, audit logs, enterprise contracts, BAAs).
• You need traffic policy / enterprise edge features that live deep in ngrok's commercial stack.
• A free or Hobbyist plan covers occasional webhook tests and you do not care about open source.

Those are real advantages. Pretending otherwise would make this page less citable — and less useful.

When to choose rustunnel

Pick rustunnel when:

• You want open source + self-host without an enterprise sales process.
• You prefer pay-as-you-go economics where idle time is not a tax.
• You need UDP, P2P, and group load balancing with health checks from one CLI.
• You work with AI agents and want tunnels driven via MCP from Claude Code / Cursor / Codex.
• You may start on managed cloud and move to self-host later without rewriting tooling.

Getting started with rustunnel

brew tap joaoh82/rustunnel
brew install rustunnel
rustunnel setup
rustunnel http 3000

Hobby is free (2 tunnels, random subdomains). PAYG starts at $3/month. Self-host stays free under AGPL.

For deeper docs: quickstart, load balancing reference, P2P tunnels, MCP / AI tools. Sibling comparisons: rustunnel vs Cloudflare Tunnel, vs Pinggy, vs LocalXpose, vs FRP.

Deep dive: what "free" actually means on each side

Free tiers are where most developers form a permanent opinion about a tunnel product. ngrok's Free plan (as of mid-2026 public pricing) includes a one-time usage credit and a small number of online endpoints with an assigned development domain. That is perfect for a weekend OAuth debug session. It is a poor fit if you need the same URL every Monday morning for a client review, or if your CI job restarts tunnels hundreds of times a month and burns through credits.

rustunnel Hobby is different in shape: two concurrent tunnels, random subdomains, no one-time credit meter on the free path, and no interstitial page in front of your traffic. You are limited by concurrency and naming, not by a depleting wallet of free usage. When you outgrow Hobby you move to pay-as-you-go — not to a feature matrix that locks custom subdomains behind a higher tier while still charging you when the tunnel is idle.

A practical decision rule:

1. One-off demo this afternoon → either free tier works; pick whatever is already installed.
2. Recurring webhook testing for a solo app → rustunnel PAYG or Hobby usually wins on cost predictability.
3. Company-wide SSO, audit logs, BAAs → ngrok enterprise packaging is often the path of least resistance, regardless of open source ideals.
4. Data residency / air-gapped lab → only a true self-hosted relay (rustunnel AGPL server) satisfies the constraint without a sales call.

Operational checklist before you migrate off ngrok

If you are evaluating a migration, run this checklist once before you rewrite scripts:

• Inventory every place an ngrok URL is hardcoded (Stripe webhooks, GitHub App callbacks, mobile deep links, partner sandboxes).
• Decide stable vs ephemeral URLs. Ephemeral is fine for agents; stable needs custom subdomains (PAYG) or your own domain (self-host).
• Measure monthly bytes proxied, not "number of tunnels." Bandwidth is what rustunnel bills; tunnel count is free on PAYG.
• Confirm whether any workflow needs TCP with fixed remote ports, UDP, or mutual TLS that you currently buy from ngrok add-ons.
• If AI agents open tunnels, plan the token distribution story (RUSTUNNEL_TOKEN / API keys) the same way you plan cloud credentials.

# Example migration pattern: keep the same local port, change only the public URL
rustunnel http 4242 --subdomain stripe-webhooks
# Update the provider dashboard once, then forget it

Security and trust boundaries

Neither product magically makes localhost "secure." Both expose a local process to the public internet through an authenticated outbound control channel. The differences are in who operates the middlebox and what you can inspect.

• With managed ngrok, the middlebox is ngrok's commercial edge. You get a mature traffic inspector and enterprise policy surface.
• With managed rustunnel, the middlebox is rustunnel's multi-region edge. Payloads are proxied end-to-end over TLS; you get dashboard + API key controls and optional spend caps.
• With self-hosted rustunnel, the middlebox is your VPS. Certificate issuance, firewall rules, and retention policies are yours to define — which is exactly what regulated environments often require.

For threat modeling, treat a public tunnel URL like a temporary production endpoint: pin auth on the app itself, rotate tokens, and prefer short-lived agent tunnels over permanent anonymous HTTP.

Related reading and next steps

If this comparison helped, continue with:

• The product landing rustunnel vs ngrok for the table and FAQs in marketing layout.
• The pillar post rustunnel — open-source ngrok alternative for architecture diagrams and self-host summary.
• Pay-as-you-go pricing for the billing math.
• rustunnel vs FRP if you are comparing open-source reverse proxies rather than SaaS tunnels.
• Docs: quickstart, self-hosting, MCP server.

We will keep this page honest as public pricing drifts — if you spot a stale competitor claim, open an issue on the website repo or email support. Citable comparison pages only work when the concessions stay accurate.

→ Ready to try the open-source path? Create a free account or browse the GitHub repo.