Kestro does not replace cloudflared: it runs it. The same binary, the same network, your Cloudflare account for the stable address. The difference is all around: the address arrives copied, Vite answers on the first try, every request can be read and replayed in a window, and a DNS record is never overwritten by accident.
macOS 11+ · Windows soon
The same work, twice
This is not a caricature: it is the command Kestro itself executes, and the log cloudflared really writes.
Today
$ cloudflared tunnel --url http://localhost:3000 2026-08-05T09:12:41Z INF Thank you for trying… … forty lines of log … https://tuesday-violet-window.trycloudflare.com # the address: to spot, then copy by hand # Vite: 403 “Blocked request”. Add # --http-host-header localhost:3000 # and this terminal stays open all demo long
With Kestro
A switch, in the menu bar. The address is already in your clipboard. The Host header is rewritten by default. Every request reads, and replays, in its window. # the stable address: one subdomain typed, # tunnel and DNS created at the first gesture
Point by point
| cloudflared alone | With Kestro | |
|---|---|---|
| The programme opening the door | cloudflared, by Cloudflare | the same, run by Kestro |
| The ephemeral address | to spot in the log | the same, copied by default |
| The stable address | login, create, route dns, config, run | one subdomain typed, the rest is done |
| A Vite server behind it | the --http-host-header option, to know about | rewritten by default, X-Forwarded-Host kept |
| Seeing the requests that pass | no | dedicated window: headers, body, duration |
| Replaying a delivery | no | one click, against your server |
| Overwriting an existing DNS record | possible, through --overwrite-dns | never: a taken name is a refusal |
| A terminal during the demo | open from start to finish | none |
| In CI, on a server | yes, that is its home ground | no, Kestro is a desktop application |
| Cost | free | €29.99$29.99£25.99CHF 25.90CA$40.99A$45.99 once |
Surveyed 5 August 2026 · cloudflared 2025.x
What Kestro adds
None of them touches how the door opens: cloudflared is still doing the work. They are about everything around it.
The row stays at “opening…” until the address has appeared in cloudflared’s log, then it arrives copied to your clipboard. No lines to scroll through, no triple-click in a terminal.
Vite, webpack and Django keep an allow-list of hosts and refuse the public address. Kestro rewrites the Host header, keeps the real origin in X-Forwarded-Host, and forwards WebSockets: hot reload survives.
cloudflared says nothing about the traffic. The request window shows every passage, headers and body included, and replays it in one click against your server. In memory only: closing the share erases everything.
Never --overwrite-dns: a record already taken is a guardrail, not an obstacle, and a typo on www will not swallow your real site. Cloudflare’s refusals arrive translated, with the remedy on the line.
On your machine
Your connections run from your computer to your servers, never through us.
Nothing to create, no password.
SSH, Google Cloud, AWS: Kestro uses your own tools, locally.
We don’t know what you open, or when.
Your licence renews with us. Nothing else leaves.
When cloudflared alone is enough
Better said here than discovered after paying.
A tunnel that must run with nobody at the screen is bare cloudflared’s ground: a systemd service, a container, a remote machine. Kestro is a desktop application, and a public door that outlives the session is not its purpose.
One share a month, no client demo, no webhook to debug: the raw command does the job and costs nothing. Kestro pays for itself in gestures saved, not in new capabilities.
Kestro only runs on macOS 11 and later. The Windows version is in the works; there is no Linux version planned.
Pricing
A tool you open forty times a day shouldn’t send an invoice every month.
Kestro licence
1 computer · one-time
Or download it for free first →
Refunded within 14 days, no questions asked.
Questions we get asked
No, it runs it. Kestro executes the cloudflared binary installed on your machine, with the same commands you would have typed: tunnel --url for the ephemeral address, create then route dns then run for the stable one. There is no reimplementation and no home-grown protocol: the path between the web and your machine is Cloudflare’s.
Yes, and Kestro tells you so rather than failing silently: when the tool is missing, it names it and offers the install line (brew install cloudflared). Kestro never downloads a binary on your behalf.
No. Signing in happens in your browser, at Cloudflare, through cloudflared tunnel login: the certificate it deposits stays in ~/.cloudflared, on your machine. Kestro reads it to know your domain, and nothing passes through our servers.
Dev servers keep an allow-list of hosts, and the public address will never be on it: Vite answers 403 “Blocked request”, webpack “Invalid Host header”, Django 400. cloudflared can fix it if you know the option; Kestro applies the rewrite by default and keeps the real origin in X-Forwarded-Host.
Nothing in particular: your cloudflared and your ~/.cloudflared certificate are intact, and the named tunnels created for your stable addresses can be listed with cloudflared tunnel list. Kestro writes nothing else at Cloudflare, and you type your commands again as before.
No, and it does not ask for an account either. You download, you get 7 full days. No card is asked for until you decide to buy.