Expose Localhost to the Internet with a Public URL

"Expose localhost to the internet" is one of those phrases that hides a surprising amount of work. The naive version means opening a router port, pointing dynamic DNS at your home IP, and somehow getting a TLS certificate for a hostname you don't own. The result is brittle, insecure, and gone the moment your ISP rotates your address.

A tunnel does the opposite. Your machine makes an outbound connection to the Ngris edge, the edge gets a public hostname with TLS already terminated, and incoming requests are forwarded back down that connection to your local port. This is the same reverse-tunnel approach tools like ngrok use, so nothing is opened on your network, and the public URL is HTTPS from the first byte. This guide covers how to get that public URL, how to open it on a phone or another computer, why it works without port forwarding, and which local ports you can expose.

How to get a public URL for localhost

The whole flow is: install the agent, run one command against the port your app already listens on, and use the HTTPS URL it prints. There's no reverse proxy to stand up, no certificate to request, and nothing to configure on your router. The rest of this post expands each part, but if you only read one section, this is it.

One command

Install the agent and point it at the port your app already listens on:

# Install (macOS)
brew install ngris

# Expose the app running on port 3000
ngris http 3000

That's the whole flow. The agent prints a Forwarding line with the public URL, and any request to it is served by your local process. On Linux the install is curl -fsSL https://ngris.com/install.sh | sh; on Windows it's winget install Ngris. The edge terminates TLS and serves your traffic over HTTP/1.1, HTTP/2, and HTTP/3 (QUIC) — clients negotiate whichever they support.

Access localhost from another device (phone, tablet, another computer)

The reason localhost is hard to reach from elsewhere is that localhost only ever means "this machine." On your phone it resolves to the phone; on a colleague's laptop it resolves to their laptop. To access localhost from another computer over the internet — or from a phone on cellular data, or a tablet on a different network entirely — you need a real hostname that lives outside your machine.

The public HTTPS URL from ngris http 3000 is exactly that. It's a normal internet address, so you can open it in mobile Safari or Chrome to test your website on your phone from localhost, load it on a tablet, or paste it into a browser on a different machine on a different network. Because the edge serves it over HTTPS, mobile browsers that refuse plaintext will load it without complaint. To share your localhost with someone, you don't screenshare or ask them onto your Wi-Fi — you hand them the URL and they open it like any other site.

Expose localhost without port forwarding

Router port forwarding is the traditional way to make a local server reachable, and it's the wrong tool here. Forwarding a port opens an inbound hole in your network, exposes your machine's real IP, and leaves you to provision and terminate TLS yourself. On a laptop that moves between networks — or behind carrier-grade NAT where you don't control the router at all — it may not work no matter how you configure it. You'd also need dynamic DNS to track your changing address.

A tunnel avoids all of that by reversing the direction of the connection. The Ngris agent dials out to the edge; the edge answers the public hostname and forwards requests back down that same outbound connection to your local port. Nothing listens on your network, so there's no router port to forward, no inbound firewall rule to punch, and no dynamic DNS to maintain. Your machine's address stays private, and the public URL keeps working when you switch from office Wi-Fi to a coffee shop to a hotspot.

Reserved hostname vs ephemeral endpoint

Run ngris http 3000 with no --url and the server provisions an ephemeral endpoint: a randomly generated hostname that lives only for the duration of the agent process. That's ideal for a quick demo or a one-off share — the free way to expose localhost to the internet when you just need a link for the next ten minutes.

When you want a URL that stays the same across restarts — so a teammate's bookmark or a webhook registration keeps working — pass a reserved hostname with --url:

# Reserved hostname — stable across runs
ngris http 8080 --url blog.ngris.com

The same flag attaches a custom domain you own; Ngris provisions and renews the certificate automatically via Let's Encrypt. The full walkthrough is in the Endpoints & Tunnels docs, and if a stable address on your own domain is the goal, see putting a custom domain on localhost.

Any port, any framework

The command takes a port number, and a port is just a number. ngris http <port> works for any local HTTP dev server — whatever framework happens to be listening on it. There's nothing to auto-detect and nothing framework-specific to configure; you tell it the port and it forwards that port.

# React / Next.js / Node — expose localhost 3000
ngris http 3000

# Vite dev server
ngris http 5173

# Angular
ngris http 4200

# Django
ngris http 8000

# Flask
ngris http 5000

# Spring / Tomcat
ngris http 8080

So exposing a Vite dev server, a Next.js dev server, or a Django development server to the internet is the same one command with a different number — 5173, 3000, or 8000. If your API isn't just a demo and you want auth and inspection in front of it, the companion post on exposing a local API to the internet goes deeper.

HTTP/2 and HTTP/3, automatically

You don't configure protocol negotiation. Every HTTPS endpoint advertises HTTP/3 via the alt-svc header, and clients negotiate whichever protocol (HTTP/1.1, HTTP/2, or HTTP/3/QUIC) they support. Real client IPs survive the hop, so your logs and the traffic inspector see the original address regardless of the negotiated version.

Is it safe to expose localhost?

A public URL means your local process is reachable from the internet, so treat it like any public endpoint: only expose what you mean to, and shut the agent down when you're done. An ephemeral endpoint disappears the moment you stop the agent, which keeps the exposure window small by default.

When you need more than a raw tunnel, the edge is a full gateway: you can layer authentication, rate limits, and a Coraza-powered WAF as traffic policies, and put internal apps behind identity-aware SSO/OIDC so only your people reach them. That's a whole topic of its own — the expose a local API guide walks through locking an endpoint down.

What the free plan gives you

The Free plan includes 5 endpoints at no cost — enough to keep a few stable URLs around for the apps you tunnel most often, with no credit card to start. When you outgrow it, Pro adds custom domains, SSO, and AI features; see pricing for the full comparison.

Frequently asked questions

How do I get a public URL for localhost?

Install the Ngris agent (brew install ngris on macOS) and run ngris http 3000, pointing it at the port your app already listens on. The agent prints a Forwarding line with a public HTTPS URL that any browser can open — no reverse proxy, DNS, or certificate setup required.

How do I expose a local dev server without ngrok?

Ngris is a drop-in alternative — run ngris http 3000 to turn any local dev server into a public HTTPS URL. Like ngrok it opens an outbound tunnel, so there is no port forwarding, and the Free plan includes 5 endpoints with no credit card.

Is it safe to expose localhost to the internet?

A public URL makes your local process reachable, so only expose what you intend to and stop the agent when you're done; an ephemeral endpoint disappears the moment the agent stops. For more control you can layer authentication, rate limits, a Coraza WAF, and identity-aware SSO/OIDC at the edge as traffic policies.

How do I expose localhost without port forwarding?

The Ngris agent dials out to the edge, and the edge forwards requests back down that outbound connection to your local port. Because nothing listens on your network, there is no router port to forward, no inbound firewall hole, and no dynamic DNS to maintain.

How do I access localhost from my phone or another computer?

The public HTTPS URL from ngris http 3000 is a real internet address, so you can open it in a mobile browser, on a tablet, or on another computer on a different network. Since the edge serves it over HTTPS, mobile browsers that block plaintext will load it without issue.

How do I share my localhost with someone?

Run ngris http against your local port and hand the person the public HTTPS URL the agent prints. They open it like any other website — no screenshare and no need to be on your Wi-Fi. For a link that survives restarts, reserve a stable hostname with the --url flag.

Can I expose a Vite, Next.js, or Django dev server?

Yes. ngris http <port> works for any local HTTP dev server, since a port is just a number and there is nothing framework-specific to configure. Use ngris http 5173 for Vite, ngris http 3000 for Next.js, or ngris http 8000 for Django.

Is there a free way to expose localhost to the internet?

Yes. The Free plan includes 5 endpoints with no credit card required, and an ephemeral endpoint (ngris http 3000 with no --url) gives you a public URL for a quick share. Pro adds custom domains, SSO, and AI features.

New to the CLI? The Getting Started guide walks through install, authentication, and your first endpoint step by step.