Usage Charges and Metrics in ngrok Plans
The table below summarizes how ngrok measures usage for billing and how each metric applies to the Free, Hobbyist, and Pay-as-you-go plans.
note
Prices and credit amounts are omitted for clarity. For up-to-date pricing, please visit the Pricing page.
Usage Metrics
| Feature or Metric | Free Plan | Hobbyist Plan | Pay-as-you-go Plan |
|---|---|---|---|
| Concurrent Endpoints Allowance Maximum number of endpoints you can run simultaneously. | Up to 3 endpoints at a time. | Up to 3 endpoints at a time. | No fixed limit (unlimited concurrent endpoints). Each endpoint you run is simply counted toward usage. |
| Active Endpoint Hours Counts each hour (clock-hour) in which an endpoint has any outgoing data transfer. | Dev domain endpoints do not accrue billable endpoint hours. Other endpoints consume your one-time free credit; each endpoint with data transfer out in a given hour counts as an active hour. | One named ngrok domain is included without hourly charges. Any additional endpoints (or hours beyond the included domain) are billed. | All endpoints are usage-based. Beyond the baseline, every endpoint that has data transfer out in an hour counts as one hour of usage. |
| Wildcard Domains Reserve a wildcard domain (e.g. *.example.com). Each subdomain counts separately. | Not available | Not available | Available (by request). Each unique subdomain that receives traffic is billed as its own endpoint. |
| Endpoint Protocols Endpoints use one of the supported protocols (HTTP/S, TCP, TLS), which determine how the endpoint processes connections | HTTP/S, TCP (requires verification), TLS not available. | HTTP/S, TCP, and TLS. | HTTP/S, TCP, and TLS. |
| Load Balancing (Endpoint Pooling) Combine multiple endpoints to a single domain or address for load balancing. | Yes, each endpoint in a pool is treated as a separate endpoint for billing. Regular limits apply. | Yes, each endpoint in a pool is treated as a separate endpoint for billing. Regular limits apply. | Yes; no limit. Each endpoint is billed separately. |
Domains and TCP Addresses
| Feature | Free Plan | Hobbyist Plan | Pay-as-you-go Plan |
|---|---|---|---|
| Dev Domain This is a constant domain, permanent to your account, that is exempt from endpoint-hour charges. | 1 | 1 | 1 |
| ngrok Branded Domains These are subdomains of ngrok managed domains. | Not available | 1 | Unlimited |
| Bring Your Own Custom Domains These are domains you purchase and add to ngrok so they can be used on your endpoints. | Not available | Not available | 1 included; additional domains are billed by the number of hours the domain was available on the account during the billing cycle. |
| TCP Addresses These enable you to create public TCP endpoints on a fixed address (for example, 1.tcp.eu.ngrok.io:12345). | Random shared addresses are available only after identity verification. | 1 reserved TCP address included. | Default allowance of up to 100 reserved addresses (more available by contacting support). |
Network Transfer
| Feature | Free Plan | Hobbyist Plan | Pay-as-you-go Plan |
|---|---|---|---|
| Data Transfer Out Total outbound data from ngrok to clients. Includes: data transmitted out of non-internal (public/k8s) endpoints, data sent via http-request, data sent via forward-external action, and data transmitted to a secure tunnel upstream. | Limited to 1 GB/month | 5 GB/month included with overages billed against your monthly credit | 5 GB/month included, then billed per GB with tiered discounts at scale. |
Traffic
| Feature | Free Plan | Hobbyist Plan | Pay-as-you-go Plan |
|---|---|---|---|
| HTTP(S) Requests Traffic from users visiting your endpoints. | Limited to 20,000 requests/month | 100,000 requests/month included with overages billed against your monthly credit. | 100,000 requests/month included, then billed per request with discounts at scale. |
| TCP/TLS Connections Connections established to your TCP or TLS endpoints. | Limited to 5,000 connections/month | 5,000 connections/month included with overages billed against your monthly credit. | 5,000 connections/month included, then billed per connection with discounts at scale. |
Rate Limits (per minute)
| Metric | Free Plan | Hobbyist Plan | Pay-as-you-go Plan |
|---|---|---|---|
| HTTP Request Rate Limit Number of requests allowed to your HTTP/S endpoint per minute. | 120 req/min | 360 req/min | 1,200 req/min (can be raised by contacting support) |
| TCP Connection Rate Limit Number of connections that can be opened to your TCP/TLS endpoint per minute. | 100 conn/min | 150 conn/min | 600 conn/min (can be raised by contacting support) |
TLS Features
| Feature | Free Plan | Hobbyist Plan | Pay-as-you-go Plan |
|---|---|---|---|
| Bring Your Own ngrok auto-provisions certificates for you; this option lets you manage them yourself. | Not available | Not available | Available as an add-on and billed by the number of hours the certificate was available on the account during the billing cycle. |
| End-to-End TLS (No Termination) Run end-to-end encrypted traffic through ngrok. | Not available | Not available | Available by contacting support |
| Mutual TLS (mTLS) Ensures both the client and server authenticate each other using digital certificates. | Not available | Not available | Available |
Traffic Policy
| Feature | Free Plan | Hobbyist Plan | Pay-as-you-go Plan |
|---|---|---|---|
| Traffic Processing Units (TPUs) Traffic Policy usage is measured in TPUs and then billed against your account in 100k blocks | Uses free credit | Uses monthly credit. | Unlimited usage billed against your account with volume discounts available. |
Traffic Identity
| Feature | Free Plan | Hobbyist Plan | Pay-as-you-go Plan |
|---|---|---|---|
| End-User Authentication (OAuth/OIDC) Authenticate users at the ngrok edge before they reach your network. Measured in Monthly Active Users (MAUs). | Limited to 3 MAUs/month | Limited to 5 MAUs/month | 5 MAUs/month included, then billed per active user with tiered discounts. An active user is a user who authenticates into an endpoint during a billing cycle. |
Traffic Observability
| Feature | Free Plan | Hobbyist Plan | Pay-as-you-go Plan |
|---|---|---|---|
| Traffic Inspector Retention The number of days to keep traffic logs for your account. | Limited to 24-hour retention | Limited to 72-hour retention | 72-hour retention included; increase to up to 90 days with an add-on. Retention accrues after upgrade; you will not have immediate access to 90 days of traffic data. |
| Exported Events Events exported from ngrok to third-party services such as AWS, Google Cloud, Microsoft Azure, or Datadog. | Billed per 2,000 events sent to outside systems. | Not available | Fully supported. Billed per 2,000 events. |
Secure Tunnels
| Feature | Free Plan | Hobbyist Plan | Pay-as-you-go Plan |
|---|---|---|---|
| Dedicated Agent Connect IPs Your own dedicated IP for your agents to connect to. | Not available | Not available | Available as an add-on per IP by contacting support. |
| Custom Agent Connect URLs Customize the domain your agent connects to. | Not available | Not available | Available as an add-on per URL. |
| Remote Agent Operations Remotely manage agents from the ngrok Dashboard. | Stop only. | Stop only. | Stop, restart, and update supported. |
Identity & Access
| Feature | Free Plan | Hobbyist Plan | Pay-as-you-go Plan |
|---|---|---|---|
| User Accounts (Seats) Team members who have access to the ngrok dashboard. | 1 user only. | 1 user only. | 3 users included; extra seats billed per user. Seats are billed monthly at the account’s high-water mark. |
| Service Users Use these users to manage credentials for integrations so they aren't deactivated as team members change. | Not available | Not available | Unlimited service users at no extra charge. |
| SSO & RBAC Bring your organization's identity provider and provide secure, role-based access control when using ngrok. | Not available | Not available | Supported as a pay-as-you-go add-on. |
| Identity Governance Suite (SCIM, Domain Control, JIT, SAML) Automate provisioning/deprovisioning and control account creation | Not available | Not available | Supported as a pay-as-you-go add-on. |
| Authtoken ACLs Limit the endpoints of specific authtokens for enhanced security | Not available | Not available | Included. |