> ## Documentation Index
> Fetch the complete documentation index at: https://ngrok.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Is ngrok a virus?

> No. ngrok is developer tooling signed by ngrok, Inc. Learn why antivirus software sometimes flags it, how to verify your copy, and what to check if you find ngrok on a machine unexpectedly.

No, ngrok isn't a virus.
ngrok is developer tooling that connects applications and services across networks, and ngrok, Inc. signs every release.

Some antivirus products flag ngrok as malware or a potentially unwanted application (PUA) anyway, because they group it with other tunneling tools.
If your copy has a valid ngrok signature, the flag is a false positive, and ngrok works with antivirus vendors to correct it.

## Choose your next step

| Your situation | What to do |
| - | - |
| You installed ngrok on purpose and your antivirus flagged it. | [Verify your copy](#verify-your-copy), then add an exception and report the false positive. |
| You found ngrok on a machine and don't know why it's there. | [Find out who installed it and what it connects](#found-ngrok-and-dont-know-why). |
| Your vendor asked you to install ngrok. | Read the [end customer guide](https://ngrok.com/docs/gateway/site-to-site-connectivity/end-customers.md) for what to confirm before you install. |

## Verify your copy

A valid signature proves that ngrok, Inc. built the file.
Check the file your antivirus named, not another copy on your path.

First, confirm where the file came from:

* Official binaries come from the [ngrok download page](https://ngrok.com/download) and are hosted at `bin.equinox.io`.
  ngrok owns Equinox, and no other software ships through it.
* ngrok also publishes the agent through Homebrew (`brew install ngrok`), its apt repository at `ngrok-agent.s3.amazonaws.com`, and the [Microsoft Store](ms-windows-store://pdp/?ProductId=9mvs1j51gmk6).
  The [download page](https://ngrok.com/download) has install steps for each channel.
* The current ngrok agent isn't open source.
  Anything that claims to be ngrok source code, or tells you to build ngrok from source, is likely malicious.
  The [original v1 project](https://github.com/inconshreveable/ngrok) is still on GitHub, but it's unmaintained and unrelated to the current agent.

### On Windows

Run PowerShell with the path to the file:

```powershell theme={null}
$sig = Get-AuthenticodeSignature -LiteralPath "<PATH_TO_NGROK_EXE>"
$sig.Status
$sig.SignerCertificate.Subject
```

`Status` should be `Valid`, and the subject should name ngrok, Inc. or ngrok LLC.

### On macOS

```sh theme={null}
codesign --verify --strict --verbose=2 "<PATH_TO_NGROK>"
codesign --display --verbose=4 "<PATH_TO_NGROK>"
```

The first command should report `valid on disk` and `satisfies its Designated Requirement`.
The second should include these lines:

```
Authority=Developer ID Application: ngrok, Inc. (TEX8MHRDQ9)
TeamIdentifier=TEX8MHRDQ9
```

Older releases name `ngrok LLC` instead, with the same team ID.

### On Linux

Linux has no operating system code signing, so compare the hash of the archive you downloaded with the one published for that version and platform in the [release archive](https://dl.equinox.io/ngrok/ngrok-v3/stable/archive).
The archive publishes SHA256 hashes for the `.tar.gz` and `.zip` files, not for the extracted binary.

```sh theme={null}
sha256sum "<PATH_TO_NGROK_ARCHIVE>"
```

### If the signature checks out

Add an exception in your antivirus and report the false positive.
Most products have a reporting option in the app or on their support site, and [VirusTotal lists contacts](https://docs.virustotal.com/docs/false-positive-contacts) for many vendors.
Each report helps ngrok get the right classification.

If the signature is missing or invalid, don't run the file.
Delete it and download a fresh copy from [ngrok.com/download](https://ngrok.com/download).

## Found ngrok and don't know why?

A developer, an administrator, or a software vendor may have installed ngrok to connect a local service.
ngrok's presence on its own doesn't tell you whether that use is authorized.
Find out with three checks:

1. Find the process.
   On Windows, open **Task Manager**, find `ngrok.exe`, and open its file location.
   On macOS or Linux, run `ps -ax -o pid=,user=,command= | grep '[n]grok'`.
   Note the account it runs as and its arguments.
   Attackers sometimes rename the binary, so also look for processes with ngrok-style arguments such as `http`, `tcp`, or `--authtoken`, and check the file path your antivirus reported.
2. Find the configuration.
   Run `ngrok config check` to print the config file path for the current user.
   A service can run as a different user with a different file, so check the [service definition](https://ngrok.com/docs/gateway/agent/service.md) too.
   The config file and the arguments show which local services the agent exposes.
   The authtoken in the config file or the arguments identifies the ngrok account the agent connects to.
3. Ask the owner.
   Take the process owner, the file path, and the exposed services to your IT team or to the vendor who deployed it.

If nobody can account for it, stop the service, keep the file and its config for your security team, and [report it to ngrok](https://ngrok.com/abuse) with the endpoint URL and the authtoken, so ngrok can find the account.
You can also email [abuse@ngrok.com](mailto:abuse@ngrok.com).
ngrok investigates every report and bans accounts that abuse the network.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.