Does ngrok have an official status page?
Yes, the official ngrok status page is status.ngrok.com.Why am I required to add a payment method to use TCP endpoints on the free tier? Will I be charged?
To combat abuse on the platform, you must add a valid payment method to your account before you can use TCP endpoints on the free tier. ngrok doesn’t charge this card. If you remove this card from your account, you lose access to TCP endpoints until you add another payment method. Valid payment methods include credit or debit cards. You can’t use prepaid cards to enable TCP endpoints.Is ngrok a virus?
No, ngrok is not a virus. ngrok is developer tooling, and ngrok, Inc. signs every release. Some antivirus products flag it anyway because attackers sometimes use tunneling tools for phishing or back doors. ngrok bans the accounts involved and works with antivirus vendors to correct the classification. If your antivirus flagged ngrok, verify your copy, then report the false positive. If you found ngrok on a machine and don’t know why it’s there, see what to check.Does ngrok own bin.equinox.io?
Yes.
ngrok owns Equinox, which hosts ngrok agent downloads, and no other software ships through it.
Start from the official download page or an installation method in the agent installation guide.
How do I verify the ngrok binary is signed?
Check the signature on the file itself. The verification steps cover Windows, macOS, and Linux, and list the signer and team ID to expect. The release archive publishes a SHA256 hash for every release.How does ngrok secure the distribution of binaries?
ngrok signs each release in three ways:- Each macOS and Windows release is signed with a code-signing certificate that the operating system verifies. The certificate names ngrok as the publisher.
- Each release is also signed with a private key that only the release pipeline holds.
When you run
ngrok update, the agent verifies the new version against a certificate authority bundled into the executable before it installs anything. - The same CI/CD pipeline uploads releases to Equinox, and only that pipeline holds the upload credentials.
Is an ngrok link safe to open?
An ngrok hostname tells you which network served the page, not who made it. Treat an ngrok link like any other link: confirm who sent it and what you expect to find before you enter credentials or download a file. Free-tier endpoints show a browser warning that names ngrok before the page loads. The warning isn’t a verdict that the site is malicious, and its absence isn’t a verdict that the site is safe, since paid endpoints don’t show it. Report a suspicious link through the abuse reporting page.What does ngrok do about phishing and malware?
ngrok flags suspicious activity with automated systems, investigates with human review, bans abusive accounts, and works with security vendors and ISPs to take down phishing and malware campaigns. To report abuse, email abuse@ngrok.com with the full endpoint URL, what you observed, and when. Security vendors that file many reports can use the abuse reports API. The abuse reporting page explains what to include and what happens after you report.I found ngrok on my computer. What should I check?
A developer, an administrator, or a software vendor may have installed ngrok to connect a local service. Find out who installed it and what it connects before you remove or allowlist it. The three checks cover finding the process, reading its configuration, and who to ask. If your vendor asked you to install it, the end customer guide covers what to agree on first.Does ngrok have built-in protections, rate-limits, or safeguards that help prevent unexpected traffic?
Yes. ngrok’s proprietary firewall protects all ngrok customers’ Endpoints and other resources. You can also take additional measures to help protect your Endpoints against bad actors.Can I choose a different port to receive traffic on my ngrok domains?
No. ngrok accepts traffic on port 80 for HTTP endpoints, 443 for HTTPS endpoints, and port 443 for TLS endpoints. This behavior isn’t configurable. TCP endpoints use the port of the TCP address that was assigned when you acquired the TCP address. This port is assigned and not configurable.Will the ngrok agent work if my network changes?
Yes. The ngrok agent is robust to all network changes. If you switch Wi-Fi networks or your modem restarts and you have a dynamic IP that changes, the ngrok agent automatically detects this condition and re-establishes connectivity with the ngrok cloud service. You don’t need to take any manual action to restart or reconfigure the agent.What information is stored about my use of ngrok?
See the Terms of Service and Data Processing Agreement for more information.Does ngrok support CORS?
Yes, applications exposed via ngrok’s HTTP endpoints work with CORS. Your application must serve the appropriate CORS headers, or you can use ngrok’s response headers module to add the appropriate CORS headers. Setting the correct CORS headers is non-trivial, but for very simple examples you can try:--basic-auth) doesn’t yet support configuring options passthrough.