Skip to main content
No, ngrok isn’t a virus. ngrok is developer tooling that connects applications and services across networks, and ngrok, Inc. signs every release. Some antivirus products flag ngrok as malware or a potentially unwanted application (PUA) anyway, because they group it with other tunneling tools. If your copy has a valid ngrok signature, the flag is a false positive, and ngrok works with antivirus vendors to correct it.

​
Choose your next step

​
Verify your copy

A valid signature proves that ngrok, Inc. built the file. Check the file your antivirus named, not another copy on your path. First, confirm where the file came from:
  • Official binaries come from the ngrok download page and are hosted at bin.equinox.io. ngrok owns Equinox, and no other software ships through it.
  • ngrok also publishes the agent through Homebrew (brew install ngrok), its apt repository at ngrok-agent.s3.amazonaws.com, and the Microsoft Store. The download page has install steps for each channel.
  • The current ngrok agent isn’t open source. Anything that claims to be ngrok source code, or tells you to build ngrok from source, is likely malicious. The original v1 project is still on GitHub, but it’s unmaintained and unrelated to the current agent.

​
On Windows

Run PowerShell with the path to the file:
Status should be Valid, and the subject should name ngrok, Inc. or ngrok LLC.

​
On macOS

The first command should report valid on disk and satisfies its Designated Requirement. The second should include these lines:
Older releases name ngrok LLC instead, with the same team ID.

​
On Linux

Linux has no operating system code signing, so compare the hash of the archive you downloaded with the one published for that version and platform in the release archive. The archive publishes SHA256 hashes for the .tar.gz and .zip files, not for the extracted binary.

​
If the signature checks out

Add an exception in your antivirus and report the false positive. Most products have a reporting option in the app or on their support site, and VirusTotal lists contacts for many vendors. Each report helps ngrok get the right classification. If the signature is missing or invalid, don’t run the file. Delete it and download a fresh copy from ngrok.com/download.

​
Found ngrok and don’t know why?

A developer, an administrator, or a software vendor may have installed ngrok to connect a local service. ngrok’s presence on its own doesn’t tell you whether that use is authorized. Find out with three checks:
  1. Find the process. On Windows, open Task Manager, find ngrok.exe, and open its file location. On macOS or Linux, run ps -ax -o pid=,user=,command= | grep '[n]grok'. Note the account it runs as and its arguments. Attackers sometimes rename the binary, so also look for processes with ngrok-style arguments such as http, tcp, or --authtoken, and check the file path your antivirus reported.
  2. Find the configuration. Run ngrok config check to print the config file path for the current user. A service can run as a different user with a different file, so check the service definition too. The config file and the arguments show which local services the agent exposes. The authtoken in the config file or the arguments identifies the ngrok account the agent connects to.
  3. Ask the owner. Take the process owner, the file path, and the exposed services to your IT team or to the vendor who deployed it.
If nobody can account for it, stop the service, keep the file and its config for your security team, and report it to ngrok with the endpoint URL and the authtoken, so ngrok can find the account. You can also email abuse@ngrok.com. ngrok investigates every report and bans accounts that abuse the network.