Cloudflare vs ngrok vs Tailscale vs Dev Tunnels

Most tunnel comparisons come from an afternoon of testing against a hello-world server. Mine come from a less voluntary place: CodeMote's connection between your browser and your dev machine rides on one of these four providers, so their failure modes stopped being trivia and started being my bug reports. These are the notes that survived.

The use case throughout: a long-lived encrypted connection from a machine you own, outbound only, so browsers elsewhere can reach it without any ports opened. If that model is new to you, the outbound-only post explains it.

Cloudflare quick tunnels

cloudflared quick tunnels have the lowest barrier of anything in this space: no account, no token, one binary, and a trycloudflare.com URL a couple of seconds later. That's why it's CodeMote's default provider. A first-run experience that begins with "create an account at a third party" loses people before anything works.

Two limitations to know about. The URL changes every time the tunnel restarts, so nothing durable can point at it. And quick tunnels are a best-effort free service; within a workday I've found them dependable, but for connections that need to stay up across several days I've seen them degrade, and I moved those cases to other providers.

ngrok

ngrok is the oldest tool here and the maturity shows. Connections hold for days, reserved domains keep your URL stable across restarts, and the inspection dashboard is genuinely useful when something misbehaves. When I need a tunnel to survive a multi-day run, ngrok is one of the two providers I trust with it.

The cost is literal: the free tier requires an account and authtoken and its limits are tight enough that steady use pushes you to a paid plan. Whether that's fair depends on how central the tunnel is to your day. For a lot of people it is, and they pay it without complaint; I just wouldn't call it the frictionless option.

Tailscale

Tailscale is a different kind of thing: no public URLs at all, just a private WireGuard mesh where your devices see each other directly. Strongest privacy posture of the four, since nothing is exposed to the public internet, and in my experience the most stable connections over long periods.

The mirror image of that strength: every connecting device has to be enrolled in your tailnet. Your laptop and phone, fine. A borrowed machine, a colleague who just wants a link, not fine. I use Tailscale when the set of devices is small and mine; the moment other people enter the picture, I switch to something with URLs.

Microsoft Dev Tunnels

Dev Tunnels (the service behind VS Code's port forwarding) is technically capable: persistent tunnel IDs, proper WebSocket support, reasonable performance. Two of its behaviors cost me real debugging time, so I'll pass them on.

First, anonymous access is off by default per tunnel. If you don't grant it explicitly, unauthenticated clients hit a Microsoft login wall, and depending on what your client is, the error can be very unhelpful.

Second, tunnel IDs are globally unique and owned by the account that created them. I once logged in with a different Microsoft account on the same machine and my existing tunnel URL just stopped being mine. Nothing explained why; the tunnel name simply belonged to the other account now. If you live in one Microsoft account, none of this bites you. If you have several, it will.

What I'd pick, by situation

For a demo, a day of phone testing, or any first contact with tunneling: Cloudflare. Zero setup wins here.

For infrastructure that stays up for days: ngrok or Tailscale. In my logs those are the only two that consistently hold week-long connections without ceremony.

For a private mesh of your own devices: Tailscale.

For stable URLs without paying: Dev Tunnels, if the account handling doesn't scare you off after the previous section.

The honest conclusion after living with all four is that there's no winner, just fits. Which is also why CodeMote treats the tunnel as swappable: it starts on Cloudflare so the first run needs nothing, and moving to ngrok, Tailscale or Dev Tunnels is a settings change. The provider that's right for your demo week is often wrong by the time the setup becomes daily infrastructure.

If you want to test the differences with a real workload, npx codemote-cli start on any machine you own gives you a workspace to swap providers under. Beta signup is on the homepage.