ngrok vs. Expose: Comparing an Enterprise Ingress Platform to a Web-First PHP Tunnel
IT
Current comparison
Looking for the main ngrok alternative guide?
We keep the latest ngrok alternative comparison, CLI commands, pricing notes, and webhook examples on one canonical page.
Open the InstaTunnel ngrok alternative guideQuick answer
ngrok vs Beyond Code's Expose: The Open-Source Tunnel : quick answer
If free tunnel limits interrupt your workflow, compare session length, stable URLs, concurrent tunnels, and paid-plan pricing before choosing a localhost tunnel tool.
What free tunnel limits should developers check first?
Check session duration, URL stability, concurrent tunnels, custom subdomains, bandwidth or request limits, and whether webhook callbacks survive restarts.
How does InstaTunnel handle longer development sessions?
InstaTunnel Free is designed around 24-hour sessions, with Pro available for higher limits and MCP endpoint tunnel workflows.
If you build APIs, integrate webhooks from providers like Stripe, Shopify, or GitHub, or need to show work-in-progress to a client, you’ve run into the same problem: a server running on localhost is invisible to the outside world. Tunneling tools solve this by running a lightweight client on your machine that opens an outbound connection to a remote server, which then assigns a public URL and routes incoming traffic back down the tunnel.
For over a decade, ngrok has been the default answer. But its free tier has gotten measurably tighter in 2026, and one of the tools independent developers are reaching for instead is Beyond Code’s Expose — an open-source, PHP-native tunnel built specifically for the web development workflow rather than as a generic network transport.
This piece breaks down what each tool actually does today, with current pricing, limits, and installation steps checked against primary documentation rather than recycled blog claims.
Why you need a tunnel
A few recurring cases come up constantly in web development:
- Webhook testing — Stripe, GitHub, and similar services need a public URL to deliver events to your local API.
- Mobile app testing — an iOS or Android emulator (or a physical device) needs an endpoint to talk to your local backend.
- Client demos — showing the latest state of a site without deploying to staging.
ngrok: the incumbent
ngrok was originally created in March 2013 by Alan Shreve, who built it as an exercise in learning Go. It has since grown well past a simple tunneling utility. Today its own pricing page frames it as a full ingress platform, and the free tier still ships with capabilities that used to be paid add-ons elsewhere: HTTPS tunnels, a web-based traffic inspector with request replay, ngrok SDKs, a Kubernetes Operator, remote agent management, circuit breaking, and automatic TLS. On the identity side, the free plan supports OAuth/SAML/OIDC traffic identities for up to 3 monthly active users, and load balancing is available under the name “endpoint pooling.”
What’s actually restricted on the free plan
Checked directly against ngrok’s current documentation, the free-tier limits are:
| Resource | Free tier limit |
|---|---|
| Data transfer out | 1 GB/month |
| HTTP/S requests | Up to 20,000/month |
| Online endpoints | Up to 3 |
| Concurrent agents | 3 |
| TCP connections | Up to 5,000/month |
| HTTP request rate | 4,000/min |
| Custom/vanity domains | Not available — dev domain only |
A few points that get misrepresented a lot in third-party comparison posts are worth being precise about:
- No session timeout. The free tier does not impose timeouts on endpoints — you can run it continuously as a background service. Claims of a “2-hour session limit” on the free plan don’t match ngrok’s own documentation.
- The interstitial page is real, but narrower than commonly described. ngrok injects an interstitial warning page in front of HTML browser traffic on the free tier to deter phishing abuse; once a visitor clicks through, a cookie suppresses the page for that domain for 7 days. Critically, this does not affect programmatic or API access to your endpoint — so it doesn’t actually break automated webhook delivery from services posting to your endpoint directly. It’s a friction point for browser-based demos, not for machine-to-machine traffic. It can also be removed on the free tier itself by sending a
ngrok-skip-browser-warningheader or a customUser-Agent, without upgrading.
Current paid tiers
The free plan includes $5 of one-time included usage and no usage beyond that credit. Above free:
- Hobbyist — $8/month billed annually ($10/month billed monthly), with $10 of monthly included usage, up to 3 online endpoints, 5GB data transfer included, 100k HTTP/S requests included, and no interstitial page. Domains are ngrok-branded, not fully custom.
- Pay-as-you-go — $20/month base with $20 of included usage, unlimited online endpoints, unlimited data transfer and requests beyond the included amounts (billed as overage), and support for bringing your own domain.
- Enterprise — contact sales; SSO/SAML, SCIM, SLAs, HIPAA BAAs, and SOC 2 documentation are available here.
(Note: “Personal” is an older plan name that no longer appears on ngrok’s current pricing page — the equivalent tier today is Hobbyist.)
Expose: a web-first, open-source alternative
Expose is built and maintained by Marcel Pociot at Beyond Code — the team also behind Laravel Herd and Tinkerwell. Unlike ngrok’s Go binary, Expose’s core is open source and written in PHP, and it’s scoped narrowly: it shares HTTP/HTTPS traffic for anything reachable on your own machine. It doesn’t attempt to be a generic TCP/UDP transport the way ngrok is.
As of mid-2026, the project is active: the GitHub repository has 4.6k stars and 309 forks, is MIT-licensed, and its latest release, 3.2.2, shipped March 27, 2026.
Installing Expose
The currently documented install paths are:
PHP Archive (PHAR) — the primary documented method:
curl https://github.com/exposedev/expose/raw/master/builds/expose -L --output expose
chmod +x expose
sudo mv expose /usr/local/bin/expose
Via Composer:
composer global require exposedev/expose
Make sure your global Composer bin directory is on your PATH. Expose ships as a compiled binary but still requires PHP to be installed locally to run.
Laravel Herd: if you already use Laravel Herd, Expose is available in your terminal out of the box — you just need to set your token.
Authenticating and sharing a site
expose token YOUR_TOKEN
Then, from a project directory:
expose share http://localhost:8000
If your local sites resolve at a .test domain (as with Laravel Herd or Valet), you can skip the URL entirely and just run expose from inside the project directory. A local request dashboard is available for inspecting and replaying traffic, similar in spirit to ngrok’s localhost:4040 inspector.
Reserved/custom subdomains are gated behind a paid tier: passing --subdomain requires either your own self-hosted Expose server or an Expose Pro/Team account — on the free plan you get a new random subdomain on every connection.
Current Expose pricing
Pulled directly from expose.dev:
| Tier | Price | Includes |
|---|---|---|
| Hobby | Free | TLS/SSL encryption, time-limited connections, random URLs, single EU server |
| Pro | $79 per user per year | No time limit, access control, persistent URLs, custom domains and subdomains, reserved subdomains, global server network |
| Team | $229 per team per year, for up to 10 users | Everything in Pro, plus priority support |
The “global server network” on Pro/Team spans seven regions: EU (Frankfurt), US (New York and San Francisco), Asia Pacific (Singapore), India (Bangalore), South America (São Paulo), and Australia (Sydney), selectable via expose servers and --server.
Self-hosting
This is still the differentiator most developers cite. The self-hosted version of Expose lets you run the server on your own infrastructure, giving you full control over your data with no third-party servers involved, plus support for your own custom domains and SSL. A basic DigitalOcean Droplet still starts at $4/month as of mid-2026, which is enough to run a self-hosted Expose server with effectively no bandwidth cap beyond what the VPS provider allows — no interstitial page, and no dependency on Beyond Code’s hosted infrastructure at all.
Laravel ecosystem integration
Expose has two separate integration points worth distinguishing:
- Laravel Herd (Beyond Code’s own local environment for macOS and Windows) has a native Expose integration built in, letting you share a site with a single command or click. The auth token can be set through Herd’s settings UI rather than the CLI.
- Laravel Valet (Taylor Otwell’s separate, community-maintained tool) also supports sharing via either ngrok or Expose, selected through the
share-toolconfig command; Valet will prompt to install whichever tool you choose via Homebrew (ngrok) or Composer (Expose).
Feature comparison
| Feature | ngrok (Free / Hobbyist) | Expose (Hobby / Pro) |
|---|---|---|
| Primary use case | Generic network transport; enterprise API/K8s ingress | Web developer local environments (HTTP/S only) |
| Language | Go | PHP |
| Free-tier bandwidth | 1 GB/month | Not published as a hard cap; time-limited connections instead |
| Free-tier requests | 20,000/month | Not published as a hard cap |
| Custom domains | Paid only (Hobbyist: ngrok-branded; Pay-as-you-go: bring your own) | Paid only (Pro: $79/user/yr) or free via self-hosting |
| Protocols | HTTP/S, TCP, TLS | HTTP/S only |
| Browser interstitial on free tier | Yes, bypassable via header/user-agent; doesn’t affect API traffic | No |
| Request inspection dashboard | Yes (localhost:4040) | Yes |
| Open source | No | Yes (MIT, client and server) |
| Self-hosting | Not applicable (managed only) | Yes, fully documented |
When each one makes sense
Stick with ngrok if: - You need raw TCP/TLS tunneling (databases, SSH, game servers, IoT) — Expose is HTTP/S only. - You need Kubernetes ingress, SSO/SAML at the org level, or SOC 2/HIPAA documentation for compliance. - You’d rather not have a PHP runtime as a dependency for a networking tool.
Consider Expose if: - Your traffic is exclusively HTTP/HTTPS and you want to avoid the free-tier interstitial page for browser-facing demos. - You’re already in the PHP/Laravel ecosystem, especially on Laravel Herd, where Expose is a first-class integration. - You want custom domains without a per-seat annual fee, and are willing to run and maintain your own small VPS.
Conclusion
The two tools aren’t solving quite the same problem anymore. ngrok has expanded into a broader ingress and API gateway platform, and its free tier — while genuinely capped at 1 GB and 20,000 requests a month — is less restrictive on the session/timeout front than a lot of comparison content suggests. Expose stays narrowly focused on HTTP/HTTPS sharing for web developers, trades ngrok’s protocol breadth for a lighter, open-source footprint, and makes self-hosting a real option rather than a workaround. Which one fits depends mostly on whether you need TCP/TLS tunneling and enterprise compliance features (ngrok), or you’re PHP/Laravel-centric and want either a free hosted tier without a warning page or full control via self-hosting (Expose).
Changelog
Corrections and additions made to the original draft, checked against primary sources on July 20, 2026:
- ngrok plan names and pricing — Original draft referenced a “Personal/Hobbyist plan at around $8 to $10/month.” Corrected to the current structure: Free ($0, $5 one-time usage credit), Hobbyist ($8/month billed annually, $10/month billed monthly, 5GB/100k requests included), Pay-as-you-go ($20/month base + metered overage), Enterprise (contact sales). “Personal” no longer appears as a plan name on ngrok’s pricing page. Source: ngrok Pricing page.
- Free-tier session limits — Original draft stated free sessions are “tightly constrained, meaning long-running background tunnels require frequent manual intervention.” ngrok’s own documentation states explicitly that free-tier endpoints have no timeout and can run indefinitely as a background service. Source: ngrok Free Plan Limits documentation.
- Interstitial page scope — Original draft claimed the interstitial “completely breaks automated webhook payloads.” ngrok’s documentation states the interstitial does not affect API or programmatic access, and can additionally be bypassed on the free tier via the
ngrok-skip-browser-warningheader or a custom User-Agent, without upgrading. Source: ngrok Free Plan Limits documentation. - ngrok free-tier feature list — Added a verified list of what’s actually included free (Kubernetes Operator, circuit breaking, OAuth/SAML traffic identities, endpoint pooling/load balancing, automatic TLS) in place of a generic “enterprise-grade” description. Source: ngrok Free Plan Limits and Pricing pages.
- Expose install command — Original draft used
composer global require beyondcode/expose. Current official documentation lists the PHAR download as the primary install method and gives the Composer package asexposedev/expose. Source: Expose Installation documentation. - Expose Pro/Team pricing — Original draft described Expose Pro only in general terms (“flat subscription,” “predictable pricing”) with no figures. Added current concrete pricing: Pro at $79/user/year, Team at $229/team/year for up to 10 users, plus the Hobby (free) tier’s actual restrictions (time-limited connections, single EU server, random URLs). Source: expose.dev pricing page.
- Custom subdomain gating — Clarified that the
--subdomainflag is explicitly a Pro/Team (or self-hosted) feature, not available on the free Hobby tier. Source: Expose Sharing documentation. - Global server regions — Added the specific list of seven Pro/Team server regions (EU, two US regions, Asia Pacific, India, South America, Australia), which the original draft didn’t specify. Source: Expose Global Server Infrastructure documentation.
- Laravel integration detail — Original draft only mentioned Laravel Valet’s
valet sharesupport. Added that Beyond Code’s own Laravel Herd ships with a native Expose integration configurable through its settings UI, which is a more directly relevant integration point than Valet given Beyond Code builds both tools. Valet’s support (viashare-tool expose, requiring a Composer install) is retained and confirmed as still current. Source: Expose Authentication documentation; Laravel Valet documentation (11.x). - Project activity/health — Added current GitHub repository stats (4.6k stars, 309 forks, MIT license, latest release 3.2.2 dated March 27, 2026) to establish the project is actively maintained in 2026, which the original draft didn’t substantiate. Source: GitHub — exposedev/expose.
- Self-hosting cost estimate — Verified the $4/month VPS figure against current DigitalOcean Basic Droplet pricing; confirmed accurate as of mid-2026. Source: DigitalOcean pricing coverage, July 2026.
- ngrok founding facts — Confirmed and cited: ngrok was created in March 2013 by Alan Shreve as a Go-learning project. Source: Ngrok, Inc. history (Wikitia); Twilio blog interview.
- Removed unverifiable marketing language from the original draft (e.g., “the web developer’s darling,” “stealing web developers from ngrok,” generic SEO framing and repeated bolded value propositions) in favor of neutral, comparative technical language.
- Protocol scope — Confirmed Expose’s documentation only describes HTTP/HTTPS sharing, with no TCP/UDP tunneling commands present anywhere in current docs, supporting the original draft’s claim that Expose can’t handle raw TCP traffic.
Related InstaTunnel pages
Continue from this article into the most relevant product guides and workflows.
Comments
Post a Comment