tunl (tunl.online) is a zero-install reverse tunneling platform powered by standard OpenSSH. It allows developers to expose local development servers, APIs, WebSockets, and webhooks to the public internet over secure HTTPS without installing any proprietary CLI agent or daemon.

How does tunl create an SSH tunnel without installing any CLI?

tunl uses native OpenSSH remote port forwarding (ssh -R). Since OpenSSH is preinstalled on macOS, Linux, and Windows 10/11, you can simply run 'ssh -R 80:localhost:3000 -p 2222 tunl.online' directly in your command line.

How does tunl compare to ngrok and Cloudflare Tunnel?

Unlike ngrok or Cloudflare Tunnel (cloudflared), tunl requires zero CLI downloads, zero background daemons, and zero account registration for ephemeral tunnels. It uses standard OpenSSH cryptographic keys instead of proprietary authentication tokens.

Yes, tunl is free to use. You can start anonymous ephemeral tunnels immediately with no credit card or account. Registering an SSH key allows you to claim persistent custom subdomains at no cost during developer preview.

Can I reserve a custom persistent subdomain on tunl.online?

Yes! Log in and register your OpenSSH public key (Ed25519 or RSA). Once registered, your custom subdomain (e.g., my-app.tunl.online) is tied to your key fingerprint and reserved exclusively for you.

Does tunl support WebSockets, Next.js HMR, and webhook callbacks?

Yes, tunl fully supports HTTP/1.1 protocol upgrades including WebSockets, Server-Sent Events (SSE), and Vite/Next.js Hot Module Replacement, as well as webhook payloads from Stripe, GitHub, Shopify, and Slack.

Free OpenSSH Reverse Tunnels · tunl.online

Expose localhost to the internet with one SSH command.

Your machinelocalhost:3000

SSH

tunl control planeport 2222

HTTPS

Public Internetmy-app.tunl.online

GET/

200 OK291ms

POST/api/webhooks/stripe

200 OK34ms

GET/api/v1/users

200 OK12ms

Free to use · No credit card or account required for basic tunnels

How it works

tunl uses standard SSH remote port forwarding. Your local server connects to tunl over an SSH session, and tunl routes public HTTPS traffic back through that connection.

1. Local Machinelocalhost:3000

Any HTTP server — Next.js, FastAPI, Express, or Django. Running on any local TCP port.

2. SSH Transporttunl.online:2222

Standard OpenSSH reverse port forward (ssh -R). Encrypted end-to-end with Ed25519 key pairs.

3. Public Endpointhttps://my-app.tunl.online

Public HTTPS endpoint with TLS certificates. Accessible globally for webhooks, teammates, and mobile testing.

1. Local Machinelocalhost:3000

Any HTTP server running on any local port.

SSH -R 80

2. SSH Transporttunl.online:2222

Standard OpenSSH. Encrypted transport layer.

HTTPS TLS

3. Public Endpointhttps://my-app.tunl.online

Public HTTPS endpoint with TLS. Accessible anywhere.

Standard SSH. Nothing extra.

Most tunneling utilities require installing a custom CLI agent. tunl relies on the standard OpenSSH client already installed on your system.

No proprietary client stack

No CLI binary to download
No background daemon process
No API tokens for basic tunneling
No local configuration files
No custom package manager updates

Native system capabilities

OpenSSH preinstalled on macOS, Linux, and Windows 10/11
Ed25519 & RSA public key authentication
Encrypted SSH transport layer
Outbound client connection over TCP port 2222
Standard OpenSSH port forwarding syntax

Use Cases

Practical developer workflows where exposing localhost to the internet is required.

Webhook development

Receive Stripe, GitHub, or Shopify callbacks on localhost. Avoid manual deployments during integration testing.

$ ssh -R 80:localhost:3000 -p 2222 tunl.online

Share work in progress

Share a live HTTPS endpoint with teammates or clients directly from your local development build.

Mobile app testing

Connect physical mobile devices to local API servers running on your development workstation.

OAuth callback development

Configure OAuth provider redirect URIs to a tunl HTTPS domain during local authentication development.

Staging demos

Demonstrate feature prototypes and dynamic UI state without deploying to temporary cloud servers.

Remote device & IoT testing

Test webhooks and remote HTTP requests from embedded hardware or IoT devices against localhost.

Capabilities

Tunnel Infrastructure

Automatic HTTPS & TLS: Automatic TLS termination on public endpoints. Every tunnel receives an HTTPS domain with valid SSL certificates.
WebSocket & SSE Protocol Upgrade: Full HTTP/1.1 connection upgrade support for WebSockets, Server-Sent Events, and Vite/Next.js Hot Module Replacement.
Request Telemetry & Inspection: Inspect incoming HTTP headers, payloads, methods, and status codes in real time from the tunl dashboard.
Persistent Subdomains: Reserve fixed subdomain aliases (e.g. my-app.tunl.online) linked directly to your SSH public key.
Custom DomainsNew: Attach your own domains (e.g. api.yourbrand.com) directly to active tunnels with automated TLS via CNAME and TXT verification.

Security & Access Control

OpenSSH Key Authentication: Authenticate using standard Ed25519 or RSA public key cryptography. Zero API tokens or static passwords required.
IP Address Allowlisting: Restrict access to active tunnel endpoints by specifying authorized CIDR blocks or client IP ranges in your dashboard settings.
Scoped Port Forwarding: Forwarding is strictly scoped to the designated local TCP port (e.g. 3000). No local file system or network access is exposed.
Key Revocation & Management: Register, verify fingerprints, and revoke authorized SSH keys instantly from the web console.

In developmentTCP port forwarding · Team workspaces · Custom rate limits

Comparison & Alternatives

tunl vs Traditional Tunneling Tools

Why developers choose tunl.online over proprietary agents like ngrok or cloudflared.

Feature	tunl (tunl.online)	ngrok	Cloudflare Tunnel
Zero CLI Download Uses standard preinstalled OpenSSH client directly from your terminal	Yes	No	No
No Signup Required Run tunnels immediately without signing up or creating an account	Yes	No	No
Public Key Authentication Secure cryptographic authentication using Ed25519 & RSA SSH keys	Yes	No	No
Automatic HTTPS / TLS Instant SSL certificates and TLS termination on public tunnel URLs	Yes	Yes	Yes
Persistent Custom Subdomains Claim reserved static subdomains tied directly to your SSH key	Free in Preview	Paid Tier Only	Requires Domain
Custom Domains Route traffic from your own domain (e.g. api.yourbrand.com) directly to local tunnels	Free in Preview	Paid Tier Only	Complex DNS Setup
WebSocket & SSE Protocol Upgrades Full HTTP/1.1 connection upgrades for Vite, Next.js HMR, and sockets	Yes	Yes	Yes
Real-time Traffic Telemetry Inspect HTTP headers, payloads, status codes, and latency in web UI	Yes	Yes	Audit Logs

Pricing

Start tunneling immediately without an account. Register an SSH key to reserve persistent subdomains.

Ephemeral TierFree Forever

$0/ month

Instant 1-command tunneling for quick debugging, testing, and webhook inspection.

Random subdomain per SSH connection
Automatic HTTPS & TLS termination
WebSocket & SSE protocol upgrades
No account or registration required

Reserved TierDeveloper Preview

$0/ preview access

Persistent custom subdomains linked directly to your registered OpenSSH public key.

Everything included in Ephemeral
Persistent static subdomain (name.tunl.online)
OpenSSH Ed25519 key authentication
Traffic inspector & web dashboard
Custom domain support (.yourdomain.com)

Frequently Asked Questions

Everything You Need to Know About tunl

Common questions about zero-install SSH reverse tunneling, security, and custom subdomains on tunl.online.

tunl (tunl.online) is a zero-install reverse tunneling platform powered by standard OpenSSH. It allows developers to securely expose local development servers, APIs, WebSockets, and webhooks to the public internet over HTTPS without installing any proprietary CLI binary or background daemon.

Start your first tunnel

No signup required. Execute standard SSH in your terminal to get an immediate HTTPS endpoint.