shouldiuse.io

VERDICT

Should I use ngrok.com?

ngrok is developer infrastructure that routes and secures traffic to your apps, APIs, and AI models, wherever they run. Start on localhost, ship to prod. - ngrok.com

Depends. Developers and platform teams get real value from ngrok's instant tunnels and enterprise ingress — buy it for dev workflows, webhooks, and customer-network access. Skip it for simple production hosting or if your security team can't tolerate tunnel traffic on the network.

Confidence

Medium. Based on ~40 public sources. List prices and review ratings are thin — no dollar figures found; 15 G2 reviews cited.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

$0

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Paid (per-device/per-customer)Not listed in sources

Best for

  • Developers exposing localhost for demos and webhooks
  • OAuth and Zoom-style app development
  • Teams reaching customer networks without VPNs
  • AI/MCP server exposure with auth

Not for

  • Non-technical users who just want simple site hosting
  • Production apps run on the free plan
  • Orgs whose firewalls block tunneling services outright
  • Budget-sensitive buyers needing cheap always-on tunnels

Gotchas - check before you buy

high

One premium buyer waited nearly a month for a refund response.

medium

Free plan gives random, expiring URLs; static/custom domains require paid tiers.

medium

Idle/always-on tunnels accumulate cost; traffic-policy pricing was only recently cut 10x.

medium

Your links may be flagged by scam checkers and firewalls.

Pros and cons

Pros

  • Free tier exposes localhost instantly; millions of developers use it.
  • One command starts a tunnel; tutorials span Zoom, Auth0, and MCP.
  • Enterprise features: traffic policy, OAuth, and edges beyond plain tunnels.
  • Approved in the US Department of Veterans Affairs TRM.
  • Raised $50M; venture-backed and actively shipping.

Cons

  • Heavily abused for phishing and malware delivery.
  • Corporate firewalls commonly block ngrok domains.
  • Premium buyer reported month-long unresolved support ticket.
  • Always-on tunnel costs push developers toward pay-per-use rivals.
  • Custom domains gated behind paid plans.

Sources & method

Analyzed 9/25/2026 - 15 sources - Legitimate, VA-approved service — but heavily abused by phishers and malware operators, so security teams often block it.

official x3review x5security x5news x2
  • Phishing abuse, Experts documented attackers using ngrok tunnels in phishing campaigns targeting financial organizations.
  • Named in CISA advisory, CISA's joint advisory on Russian military cyber actors references ngrok[.]com infrastructure.
  • Botnet cover, Malware authors hid cryptomining botnet traffic behind ngrok's ever-shifting proxy domains.

Key stats

  • Value for money: 3/5

    Rating

  • $0

    Starting price

  • 15

    Sources

  • Analyzed

  • Value for money: 3/5. Strong free tier; idle and paid costs draw complaints.
  • Ease of use: 4/5. One command exposes localhost; huge tutorial base.
  • Feature depth: 4/5. Traffic policy, OAuth, edges, MCP support.
  • Support quality: 2/5. Premium refund reportedly unresolved for a month.
  • Security posture: 3/5. VA-approved with security page; widely abused by threat actors.
  • $50M Funding First fundraise, venture-backed
  • Yes Free tier Includes free static domains per docs
  • 15 G2 reviews Seller reviews on G2
  • 10x cheaper Traffic Policy price Recent ngrok announcement

Pricing

Free

$0

  • Random public URLs
  • Free static domains per docs

Paid (per-device/per-customer)

Not listed in sources

  • Custom domains
  • More client sessions

Security

Legitimate, VA-approved service — but heavily abused by phishers and malware operators, so security teams often block it.

  • Phishing abuseExperts documented attackers using ngrok tunnels in phishing campaigns targeting financial organizations.⁶
  • Named in CISA advisoryCISA's joint advisory on Russian military cyber actors references ngrok[.]com infrastructure.⁷
  • Botnet coverMalware authors hid cryptomining botnet traffic behind ngrok's ever-shifting proxy domains.⁸

What users say

Developers prize the instant localhost tunnels but complain about paid-tier costs, session limits, and slow support.

“I currently use Ngrok for hosting. What are the possible issues I ...”
Reddit, r/admincraft
“What is the number of Client sessions for paid ngrok?”
Reddit, r/selfhosted
“Don't buy the premium - Still waiting for almost a month for ...”
GitHub issue, ngrok repo

Companies that use it

  • Shopify
  • Zoom (developer platform)15
  • Auth0 (marketplace integration)
  • US Department of Veterans Affairs11

Companies that could

  • Shopify Uses Cloudflare (proposed replacement in Shopify CLI issue #1070) instead
Full analysis

Based on ~40 public sources. List prices and review ratings are thin — no dollar figures found; 15 G2 reviews cited.

Fantastic free localhost tunnels for devs; paid costs climb, phishers abuse it, firewalls often block it.

Methodology

Based on ~40 public sources. List prices and review ratings are thin — no dollar figures found; 15 G2 reviews cited.

Sources

  1. review
  2. review
  3. review
  4. review
  5. review
  6. security
  7. security
  8. security
  9. security
  10. security
  11. official
  12. official
  13. official
  14. news
  15. news

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.