Both do the same job: a public https address onto a port of your machine, and an inspector to watch and replay what crosses it. The difference is in what you must create, pay for and leave behind. On one side an account, a token and a subscription; on the other an application in the menu bar, paid once.
macOS 11+ · Windows soon
The same work, twice
The left column follows ngrok’s documentation, step by step. The right one is what Kestro does at the same moment.
Today
$ ngrok config add-authtoken eyJhbGciOi… # the token comes from the dashboard: account required $ ngrok http 3000 Forwarding https://a1b2c3.ngrok-free.app # the client first lands on the page # “You are about to visit…” # and for demo.yourdomain.com: see “Pricing”
With Kestro
A switch, in the menu bar. The address is already in your clipboard. No account for the ephemeral address. Your domain, through your Cloudflare account. The visitor sees your site, directly.
Point by point
| ngrok | With Kestro | |
|---|---|---|
| The network carrying the address | ngrok’s | Cloudflare’s, through cloudflared |
| Account | required, even on the free plan | none for the ephemeral address |
| What your visitor sees | on the free plan, a warning page first | your site, directly |
| Your own domain | on a subscription | free, through your Cloudflare account |
| Request inspector | yes, local web page, with replay | yes, dedicated window, with replay |
| What is left behind afterwards | an account, a token, a dashboard | nothing: it all lives in memory, and is erased |
| A Vite server behind it | an option to know about (--host-header) | the Host header is rewritten by default |
| Around the door | the door, very well tooled | SSH and cloud tunnels, projects, services |
| In CI, on a server | yes, the agent runs anywhere | no, Kestro is a desktop application |
| Cost | a monthly subscription beyond the free plan | €29.99$29.99£25.99CHF 25.90CA$40.99A$45.99 once |
Surveyed 5 August 2026 · ngrok v3, free and paid plans
What Kestro adds
ngrok is a very good tool, and the request inspector was its idea: the difference lies elsewhere, in what you do not have to create, pay for, or leave behind.
The ephemeral address asks for no account, no token, no dashboard: traffic goes from the visitor to Cloudflare, then straight to your machine. Nothing passes through our servers, and we do not even know you are sharing.
demo.yourdomain.com goes through your Cloudflare account, free with your domain. Kestro creates the tunnel and the DNS record at the first switch, and never overwrites an existing one.
Requests live in memory, never on disk, never online: close the share and everything disappears. Replay works the same way: the delivery goes back to your server in one click.
The dev server you are exposing is often the one Kestro started. Projects, SSH and cloud tunnels, service monitoring: everything lives in the same application, behind the same shortcut.
On your machine
Your connections run from your computer to your servers, never through us.
Nothing to create, no password.
SSH, Google Cloud, AWS: Kestro uses your own tools, locally.
We don’t know what you open, or when.
Your licence renews with us. Nothing else leaves.
When ngrok stays the right choice
Better said here than discovered after paying.
Kestro is a desktop application: it needs an open session. The ngrok agent runs anywhere, headless, and that is what a scripted use needs.
ngrok can expose more than HTTP, and put authentication in front of the door: OAuth, IP allow-lists. Kestro exposes an HTTP port, and its protection is brevity: you open, you show, you close.
Kestro only runs on macOS 11 and later. The Windows version is in the works; there is no Linux version planned.
Pricing
A tool you open forty times a day shouldn’t send an invoice every month.
Kestro licence
1 computer · one-time
Refunded within 14 days, no questions asked.
Questions we get asked
No. The plumbing is cloudflared, Cloudflare’s own tool: traffic goes from the visitor to Cloudflare’s network, then straight to your machine. Nothing passes through our servers either, and since there is no Kestro account, we do not even know you are sharing a port.
Not for the ephemeral address: you click, an address on trycloudflare.com arrives, no account anywhere. The stable address does ask for a free Cloudflare account with your domain on it: that is what carries the subdomain you choose, and that is what replaces the subscription.
No. The address answers directly, ephemeral or stable: your client clicks and sees your site. That is the most visible difference in a demo: the “You are about to visit” page on ngrok’s free plan is crossed by every visitor before they reach you.
It is the same idea, and ngrok had it first: method, status, duration, headers, body, and replaying a request against your server. The differences: ours lives in an application window rather than a browser tab, everything stays in memory on your machine, and closing the share erases it all. There is no online dashboard, and no history that survives.
Yes, with no conflict: the two open independent doors. If your team has a well-tooled ngrok account (reserved domains, access policies), nothing forces a choice. Kestro stays useful for the quick account-free door, and for everything the panel holds next to it.
No, and it does not ask for an account either. You download, you get 7 full days. No card is asked for until you decide to buy.