Piperace vs ngrok vs localhost.run
A side-by-side look at three ways to expose a local server to the internet — a self-hosted tunnel stack, a full-featured managed service, and a zero-install SSH tunnel.
All three services solve the same basic problem: giving your localhost a public URL. But they differ sharply in how much you run yourself, what protocols they support, how stable the URL is, and how much control you get over security and traffic. Below is a comparison built around the criteria that usually matter when choosing a tunneling tool.
Comparison table
| Criteria | Piperace | ngrok | localhost.run |
|---|---|---|---|
| Protocols | HTTP/HTTPS, TCP, TLS (SNI multiplexing). UDP is on the roadmap. | HTTP/HTTPS, TCP, TLS. No UDP. | HTTP/HTTPS, TLS passthrough. Non-HTTP TCP protocols can run over TLS on port 443. No UDP. |
| Self-hosted vs hosted | Self-hosted: Rails control plane + Go tunnel server + your own DNS. | Fully hosted SaaS. | Fully hosted SaaS. |
| Open source | No — private/closed source. | No — proprietary. | No — proprietary. |
| Static domain vs dynamic | {name}-{code}.piperace.fun. The name part is stable per user; the code makes it unique. |
Random domains on Free. Persistent/reserved domains on paid plans. | Free domains change regularly. Stable domain only with the Custom Domain plan. |
| Can set own domain | Planned; not implemented yet. | Yes — on paid plans (custom domains, wildcard on Pay-as-you-go). | Yes — Custom Domain plan ($9/mo billed annually) supports your own domain or a lhr.rocks subdomain. |
| Authentication / guest usage | Email/password accounts, API token, guest mode via device fingerprint, device-code login. | Authtoken required for the agent. OAuth/SAML/OIDC traffic policies on paid plans. | No signup for free tunnels. Custom Domain plan uses SSH-key authentication. |
| Platforms | CLI + GUI binaries for Windows, macOS Intel/Apple Silicon, Linux Intel/ARM. | CLI agent for Windows, macOS, Linux; SDKs for Go, Python, Node, Java, Rust; Kubernetes operator. | Any OS with an SSH client (Windows, macOS, Linux, etc.). No download needed. |
| Limits | 50 tunnels per server, 5 active tunnels / 10 TCP ports per user by default. Unlimited bandwidth during beta. | Free: 3 endpoints, 1 GB transfer, 20k HTTP requests. Higher limits on paid plans; overage billing. | Free: dynamic domains with speed limits. Custom Domain: up to 5 simultaneous tunnels, priority bandwidth. |
| Traffic inspection | Not built into the backend. The CLI can show a terminal QR code for mobile testing. | Traffic Inspector with request/response replay and export to Datadog, CloudWatch, S3, Azure. | No request inspector. Only basic SSH/CLI output. |
| Pricing | Free during beta; no billing implemented yet. | Free ($5 one-time credit), Hobbyist $10/mo, Pay-as-you-go $20/mo + usage, Enterprise custom. | Forever free tier; Custom Domain plan $9/mo billed annually. |
| Best for | Teams that want self-hosted tunnels, stable subdomains, and a simple cross-platform client. | Teams that need a managed global service, rich security policies, and deep observability. | Quick one-off sharing, demos, or any situation where you cannot install software. |
Piperace
Piperace is a self-hosted tunneling stack. The Rails backend handles accounts, API tokens, subdomain reservation, server selection, and Route53 DNS. A separate Go tunnel server forwards the actual traffic. Because you run the infrastructure yourself, you keep full control over data and limits.
The end-user experience is intentionally simple: piperace http 3000 -d myapp gives you a stable public URL, and reconnecting with the same name keeps the same subdomain. Both CLI and GUI clients are provided for all major desktop platforms.
ngrok
ngrok is the best-known managed tunneling service. Install the agent, run ngrok http 3000, and you get a public HTTPS URL backed by ngrok's global edge network. It is the most feature-rich option of the three, especially for security and observability.
Its Traffic Policy system lets you enforce IP restrictions, rate limits, OAuth/OIDC/SAML, JWT validation, mTLS, and custom responses. The Traffic Inspector lets you inspect and replay requests. The trade-offs are price and complexity: advanced features and higher limits sit behind paid plans.
localhost.run
localhost.run is the simplest of the three. It uses SSH remote forwarding, so there is no client to install and no account required for free tunnels. Run ssh -R 80:localhost:8080 localhost.run and you get an HTTPS URL instantly.
It works for HTTP, HTTPS, and TLS-based applications. You can even tunnel non-HTTP protocols such as PostgreSQL by wrapping them in TLS on port 443. The downside is that free domains change regularly and have speed limits, and there is no traffic inspector. For a stable domain and priority bandwidth you need the $9/month Custom Domain plan.
Which one should you choose?
Choose Piperace if you want to self-host your tunneling infrastructure, need stable subdomains without paying extra, and prefer a focused CLI/GUI client.
Choose ngrok if you want a managed global service with enterprise security, traffic inspection, team controls, and SDK integrations.
Choose localhost.run if you just need to share something quickly from a machine where you cannot install software, or you want the absolute simplest one-command setup.
Bottom line: Piperace is for self-hosted control, ngrok is for managed power, and localhost.run is for zero-install simplicity. Pick the one that matches how much infrastructure you want to own.