Cruma vs ngrok
ngrok and Cruma both give a service on your machine a public HTTPS address. A small agent makes an outgoing connection, so nothing needs to be opened on your router. This page compares them feature by feature. Every claim about ngrok links to ngrok's own pricing page or documentation.
Side by side
As of November 2026, based on ngrok's public pricing page and documentation. Plans and features change; check the linked sources for the current details.
| Cruma | ngrok | |
|---|---|---|
| Start without an account | Yes. Anonymous tunnels run for up to 3 hours per session, with 1 GiB of traffic per session (Rate limits). | No. "The ngrok service requires that you sign up for an account to connect with an agent" (docs). |
| Free tier traffic | Free account: up to 3 GiB a day. Visitors get an HTTP 429 page at the cap until 00:00 UTC (Rate limits). | Free: up to 1 GB of data transfer (pricing). |
| Paid plans | Basic $5/month, Pro $10/month (Pricing). | Hobbyist $10/month, Pay-as-you-go $20/month (pricing). |
| Paid traffic | No monthly cap. A full-speed allowance (750 GB on Basic, 1.5 TB on Pro) refills continuously; sustained heavy use beyond it continues at a reduced rate (Rate limits). | 5 GB included. Pay-as-you-go then charges $0.10 per GB; Hobbyist stops at its included usage credit (pricing). |
| Your own domain | Basic and Pro: add a CNAME at any DNS provider (Custom domains). | Pay-as-you-go: bring your own domain, at $0.01 per active hour (docs, pricing). |
| Free address that stays the same | An anonymous address stays the same across restarts while the agent's cache is kept; a registered tunnel keeps its <tunnel-id>.tun.cruma.io address (Rate limits). | Every account, including free, gets a static dev domain such as your-name.ngrok-free.dev (docs). |
| Browser warning page | On anonymous and free tunnels; Basic and Pro remove it (Rate limits). | On Free HTTP/S endpoints; Hobbyist and Pay-as-you-go remove it (pricing). |
| End-to-end TLS | On Basic and Pro, the agent gets a certificate for your custom domain automatically and TLS ends on your machine (Security). | TLS can terminate at the agent or your upstream service so "the ngrok cloud service can not see payload"; TLS endpoints are on Hobbyist and Pay-as-you-go, zero-knowledge TLS on Pay-as-you-go (docs). |
| Request inspection | Desktop app and terminal UI; request logs stay on your machine (Watching your traffic). | A local inspector at localhost:4040 with replay in the agent CLI (docs), and a cloud Traffic Inspector with 24 hours of retention on Free and 72 hours on paid plans (docs). |
| Access control | Built into the agent per route: IP filters, a login form, Basic auth, API keys, JWT, and any OAuth2/OIDC provider (Security). | Traffic Policy adds JWT validation, OAuth, OIDC and basic auth, and can block IP addresses (docs); OAuth/OIDC/SAML sign-ins cover 3 monthly active users on Free and 5 on paid plans (pricing). |
| Serve a folder | cruma serve ./www (Common scenarios). | ngrok http file:///path (docs). |
| Non-web traffic | TCP ports on Basic and Pro; on Pro, an IPv6 tunnel for any TCP or UDP traffic. People connecting need IPv6 (TCP ports and IPv6). | TCP and TLS endpoints (docs); TCP on Free needs credit card verification (pricing). |
| Endpoints | Several hostnames on one tunnel; the tier sets the limits (Rate limits). | Up to 3 online endpoints on Free and Hobbyist, unlimited on Pay-as-you-go (pricing). |
Where Cruma differs
- You can start without signing up. Run one command and get a public address, no account needed. Register for free when you want to drop the 3-hour limit. See Quick start.
- End-to-end TLS on your own domain from $5 a month. On Basic, point a CNAME at your tunnel and the agent gets its own certificate. Cruma forwards the encrypted stream and can't read it, and the keys never leave your machine. See Custom domains and Security.
- Paid traffic isn't metered. Basic and Pro have a full-speed allowance that refills continuously instead of a per-GB charge. See Rate limits.
- The agent is a web server and reverse proxy. Besides tunnelling, it serves folders, starts and restarts your apps, and runs a firewall and sign-in in front of them, all configured in a desktop app or one config file. See Common scenarios and The desktop app.
- Coding agents can drive it. Claude Code, Codex and other agents connect over MCP (
cruma mcp) and ask before they make anything public. See Coding agents.
When to pick ngrok instead
- Your users connect to raw TCP over IPv4. Cruma's TCP ports and IPv6 tunnel need clients with IPv6; over IPv4, a TCP route works only if the client connects with TLS (TCP ports and IPv6). ngrok offers TCP endpoints (docs).
- You want to embed the tunnel in your own program. ngrok documents agent SDKs alongside its CLI (docs).
- Your team shares traffic in a hosted dashboard. ngrok points to its cloud Traffic Inspector for cross-endpoint traffic and team sharing (docs), with retention up to 90 days as an add-on (docs). Cruma keeps request logs on each machine.
- You need a formal SLA. Cruma is run by a small team and has no formal SLA today (Rate limits).
Get started
Install the agent from Downloads, or from a terminal:
- macOS (Apple Silicon):
brew install --cask umbra-yurei/brew/cruma - Linux:
curl -fsSL https://files.cruma.io/files/tunnel-agent/install/linux-install.sh | bash - Windows:
winget install 9NXKT3W34HVL --source msstore
Then share a local port:
cruma proxy http 3000
You get a public HTTPS address right away, with no account. Create a free account when you want the tunnel to keep running.