Softwr

Networking · head to head

Headscale vs ngrok

Headscale logo

Headscale

Networking

Open source reimplementation of the Tailscale coordination server for a single organisation

From
Free
Rated
-
Full reviewWebsite
ngrok logo

ngrok

Networking

Reverse tunnel service that gives a local or private service a public URL without opening a firewall

From
Free
Rated
-
Full reviewWebsite

The short version

  • Each has a real cost: Headscale the clients are proprietary software maintained by a company with no obligation to Headscale, so a client update can change protocol behaviour and break your control server until volunteers catch up.; ngrok free HTTP endpoints show a browser interstitial before the page loads, which breaks first impressions in demos and confuses anyone you send the link to.
  • They diverge on capability: Headscale covers Self hosted control server, ngrok covers Outbound agent tunnels.
  • Prices and features above were last checked on 31 August 2026.

Where they differ

Only the attributes on which Headscale and ngrok actually diverge.

Attributes where Headscale and ngrok differ
AttributeHeadscalengrok
Pricing modelOpen source, no licence feePer user per month
PlatformsLinux, DockerLinux, macOS, Windows, Docker, Kubernetes

Identical on both: starting price (Free), free tier (Yes), user rating (Not yet rated), category (Networking).

What each one covers

Drawn from each product's published feature list. An absence here means we hold no record of it - not that the product lacks it.

Only in Headscale

  • Self hosted control server
  • Access control policies
  • User separation
  • Pre-authentication keys
  • Subnet routers and exit nodes
  • Own or shared DERP

Only in ngrok

  • Outbound agent tunnels
  • Static domains
  • Traffic policy
  • Request inspection
  • Kubernetes ingress
  • TCP and TLS endpoints

What people use each for

The jobs each tool is most often brought in to do.

Headscale

  • Running a mesh network where no third party may hold the device registrynot ngrok
  • A homelab or personal fleet where paying per user for a hosted control plane is not worth itnot ngrok
  • Air gapped or restricted environments that cannot reach an external coordination servicenot ngrok
  • Keeping the Tailscale client experience while removing the vendor from the trust pathnot ngrok

ngrok

  • Receiving webhooks from a payment or messaging provider on a laptop during developmentnot Headscale
  • Demonstrating a work in progress application to someone outside the network without deploying itnot Headscale
  • Publishing a service inside a private network or Kubernetes cluster without a public load balancernot Headscale
  • Giving a partner a temporary authenticated endpoint into an internal APInot Headscale

Where each one falls short

Documented limitations, not opinions. Every one is a constraint you would hit in normal use.

Headscale

  • The clients are proprietary software maintained by a company with no obligation to Headscale, so a client update can change protocol behaviour and break your control server until volunteers catch up.
  • Features that live on the vendor side, including the admin console, Funnel and app connectors, do not exist here and cannot be added, so feature comparisons against Tailscale are misleading.
  • There is no official web interface, so day to day administration is a command line tool or one of several unofficial front ends of varying quality and maintenance.
  • It is deliberately single tenant, so a managed service provider cannot use one deployment to serve several customer networks.
  • Upgrades have required database migrations and policy format changes between releases, and with no support contract a failed migration on the control server is your problem alone.

ngrok

  • Free HTTP endpoints show a browser interstitial before the page loads, which breaks first impressions in demos and confuses anyone you send the link to.
  • All traffic passes through ngrok infrastructure, so you inherit its latency and an ngrok incident takes every published endpoint down at once with no local failover.
  • Pricing is per user seat plus allowances, so a platform team publishing many endpoints ends up buying seats for people who never open the dashboard.
  • Bandwidth is metered on paid tiers, so a workload that quietly grows into serving real traffic produces overage rather than a flat bill.
  • Traffic policy configuration is specific to ngrok, so the authentication and routing logic you accumulate at the edge has to be rebuilt if you later move to a conventional ingress.

Pricing, plan by plan

Headscale

Free
  • HeadscaleFree
    • Full functionality, no node limit
    • Official Tailscale clients on every platform
    • No vendor account required

ngrok

Free
  • FreeFree
    • One static domain
    • HTTP endpoints with a browser interstitial
    • Limited simultaneous connections
  • Personal$undefined/month
    • Removes the interstitial warning page
    • Additional reserved domains
    • TCP endpoints
  • Pro$undefined/month
    • Per user billing with team accounts
    • Traffic policy rules and edge authentication
    • Higher bandwidth allowances
  • Enterprise$undefined/year
    • Custom terms and volume pricing
    • Dedicated capacity options
    • Compliance and audit requirements

Which should you pick?

Choose Headscale if

  • You need self hosted control server.
  • You want to start without paying.
  • You work on Linux, Docker.
  • You also want access control policies.
Headscale review

Choose ngrok if

  • You need outbound agent tunnels.
  • You want to start without paying.
  • You work on Linux, macOS, Windows, Docker, Kubernetes.
  • You also want static domains.
ngrok review

Questions people ask

Is Headscale or ngrok better?
Neither clearly leads. Headscale starts at Free and ngrok at Free, and user ratings are close enough to be indistinguishable. Choose on capability and platform support.
Which is cheaper, Headscale or ngrok?
Headscale starts at Free and ngrok at Free.
Does Headscale or ngrok run on more platforms?
Headscale runs on Linux, Docker. ngrok runs on Linux, macOS, Windows, Docker, Kubernetes.
Can I use Headscale for free?
Both have a free tier, so you can try either at no cost before committing.
What is Headscale best used for?
Headscale is most often used for running a mesh network where no third party may hold the device registry, a homelab or personal fleet where paying per user for a hosted control plane is not worth it, air gapped or restricted environments that cannot reach an external coordination service, keeping the tailscale client experience while removing the vendor from the trust path. Of those, running a mesh network where no third party may hold the device registry and a homelab or personal fleet where paying per user for a hosted control plane is not worth it are not what ngrok is typically brought in for.
What can Headscale do that ngrok cannot?
Headscale covers Self hosted control server, Access control policies, User separation, Pre-authentication keys. ngrok covers Outbound agent tunnels, Static domains, Traffic policy, Request inspection.

Answered from the vendors’ own pages

Headscale: Is Headscale made by Tailscale?

No. It is an independent community project. Tailscale acknowledges it but does not support it, and the clients it relies on are the vendor ones.

ngrok: Can I use it in production?

It is sold for that now, with static domains, policy rules and a Kubernetes operator. The question is whether you accept a third party on the traffic path for every request.

Headscale: What do I lose compared with the hosted service?

The admin console, the vendor relay network unless you use the public DERP servers, and hosted only features such as Funnel and app connectors.

ngrok: Why does my free URL show a warning page?

Free HTTP endpoints carry an interstitial. Removing it requires a paid plan, and it is the most common reason people upgrade.

Headscale: Can I still use the public relay servers?

Yes, the default configuration can use them, though many self hosters run their own DERP to remove that dependency.

ngrok: Does it work for SSH or a database?

Yes through TCP endpoints, which are a paid feature.

Headscale: Is it suitable for a company network?

For a technical team, yes. There is no vendor to escalate to, so it needs someone on staff who is willing to own the control server.

ngrok: What is the self hosted alternative?

A reverse proxy on a server you own with a tunnel back to the service, or one of the self hosted tunnel projects. All of them cost more setup time than the thing they replace.

Share

Related pages

More on Headscale

More on ngrok

Keep looking

Other head to heads