Why Leave Your Editor? Microsoft Dev Tunnels vs. ngrok in 2026

Developers exposing a local server to the internet used to mean one thing: download a CLI, create an account, paste an authtoken, and bounce between your editor and a separate terminal window. Microsoft has spent the last few years narrowing that gap by building port forwarding directly into VS Code’s Ports view, backed by its Dev Tunnels service. No extension required, no separate binary — just a right-click in a panel you already have open.

That doesn’t make ngrok obsolete. It makes the choice more interesting, because the two tools have converged on similar free-tier shapes while staying different in what they’re actually built for. This piece breaks down where Dev Tunnels genuinely wins, where the popular narrative about ngrok’s free tier is outdated, and where ngrok remains the only real option.

The Cost of Context Switching

Local development in the early 2020s was fragmented: write code in VS Code, run the app in the integrated terminal, then open a second terminal to run a tunneling tool for a public HTTPS URL. Every time you needed to test a Stripe webhook or share a preview link, you left your editor, checked whether your auth token had expired, and copy-pasted URLs into someone else’s dashboard.

VS Code’s Ports view collapses that into one place. If your app is already running in the integrated terminal, forwarding a port takes a right-click, not a new tool.

What ngrok’s Free Tier Actually Looks Like in 2026

For years “just use ngrok” was the default StackOverflow answer, and a lot of what people repeat about its free tier is now wrong. Two claims in particular get repeated constantly and don’t hold up against ngrok’s own current documentation:

“Free tunnels time out after a couple of hours.” Not anymore. ngrok’s docs state plainly that free endpoints have no timeout and can run indefinitely — you can even run one as a background service. This used to be true (sessions expired after 8 hours in ngrok’s earlier free tier), but ngrok removed the timeout entirely.

“You get a new random URL every time you restart.” Also outdated. Since 2023, every ngrok account — free included — gets one static “dev domain” (like your-name.ngrok-free.app) that’s tied to the account and stays fixed across agent restarts. Random per-session URLs are now something you’d have to opt into on a paid plan, not something the free tier forces on you.

What’s still real about the free tier, straight from ngrok’s current limits page:

Resource	Free tier limit
Data transfer out	1 GB / month
HTTP requests	20,000 / month
TCP connections	5,000 / month
Online endpoints	Up to 3 at once
Concurrent agents	3
Interstitial warning page	Yes, on HTML browser traffic
Custom/vanity domains	Not available (any tier below Pay-as-you-go)
TLS endpoints (self-terminated)	Not available

The interstitial page is real and does show a “this site is served by ngrok” warning the first time a browser hits your endpoint. But it explicitly does not affect API clients or webhook senders — programmatic requests skip it, and you can also bypass it in a browser by sending an ngrok-skip-browser-warning header or a non-default user agent.

ngrok’s paid tiers, as they’re actually priced

Plan	Price	What it unlocks
Free	$0	$5 one-time credit, 3 endpoints, 1GB/20k requests, dev domain only
Hobbyist	$8/mo billed annually ($10/mo monthly)	5GB data, 100k requests, no interstitial, ngrok-branded domain pool (not fully custom)
Pay-as-you-go	$20/mo base + usage	Unlimited endpoints, bring-your-own custom domains, wildcard endpoints, SSO/RBAC add-ons

One correction worth flagging: a genuinely custom domain like api.yourdomain.com isn’t a Hobbyist-tier feature. Hobbyist only unlocks domains from ngrok’s own branded pool. Bringing your own domain requires Pay-as-you-go, which starts at $20/month plus metered usage beyond the included credit.

Microsoft Dev Tunnels: What It Actually Is

Dev Tunnels ships with VS Code’s Ports view — no extension needed for basic forwarding. Start a local server, open the Ports panel, forward the port, and authenticate with the same GitHub or Microsoft account you’re probably already signed into. The agent makes an outbound SSH-based connection to a Microsoft-hosted relay in Azure; there’s no inbound firewall rule to configure and no local listener exposed.

A few things the “just switch to Dev Tunnels” pitch usually leaves out:

It’s still a public preview with no SLA. Microsoft’s own documentation is explicit: “This preview version is provided without a service-level agreement, and it’s not recommended for production workloads.” That’s a meaningfully different risk profile than a service with a published uptime commitment, and it matters if you’re pointing a payment provider’s webhook at it.

It has its own usage limits, not “no bandwidth throttling.” Per Microsoft’s published limits, which reset monthly:

Resource	Limit
Bandwidth	5 GB per user
Tunnels	10 per user
Ports per tunnel	10
Active connections	1,000 per port
HTTP request rate	1,500/min per port
Data transfer rate	Up to 20 MB/s per tunnel
Max request body size	16 MB

That 5GB is more generous than ngrok’s free tier, but it’s roughly what ngrok’s $8/month Hobbyist plan gives you — not the unlimited, throttle-free ceiling the “free forever” framing implies.

There’s a fixed 60-second HTTP timeout per request that you cannot configure. Any call that runs longer than 60 seconds fails, according to Microsoft’s own support guidance. For most webhook payloads this is fine, but it’s a real constraint if your handler does synchronous work that can run long.

“Persistent” URLs expire after inactivity. The default is 30 days without traffic; you can set a custom expiration, but the maximum window is also 30 days. Closing your laptop over a weekend and reopening it Monday is well inside that window, so the article’s webhook-survives-the-weekend claim holds. Leaving a tunnel completely idle for a month or more does not.

The anti-phishing interstitial exists here too. Dev Tunnels shows the same kind of first-visit browser warning that ngrok does — Microsoft’s own docs describe an interstitial anti-phishing page for HTML requests, skippable with a header (X-Tunnel-Skip-AntiPhishing-Page: True) or by using a non-HTML Accept header, exactly like ngrok’s ngrok-skip-browser-warning. This isn’t a Dev Tunnels advantage over ngrok — both tools handle it the same way, and both skip it for programmatic/API traffic.

None of this makes Dev Tunnels a bad choice for what it’s built for: ad hoc sharing, webhook testing during active development, mobile preview links. It does mean “zero-friction, zero-limits, and it just replaces ngrok” oversells it.

Head-to-Head

Cost. Dev Tunnels is free with no paid tier at all — but its usage caps land closer to ngrok’s Hobbyist plan than to “unlimited.” ngrok’s free tier is tighter (1GB/20k requests vs. Dev Tunnels’ 5GB), but $8/month removes those caps entirely if you outgrow free. Neither is a clean winner; it depends whether you’d rather live inside Dev Tunnels’ monthly caps for free or pay for higher, published ngrok limits.

Setup. Dev Tunnels wins outright if you’re already in VS Code — there’s genuinely nothing to install. ngrok requires a binary and an authtoken, though setup takes under a minute.

Security and access control. ngrok wins clearly here. Its Traffic Policy engine supports OAuth/OIDC/SAML at the edge, IP allowlisting, mutual TLS, and request-level rules — available even on paid tiers well below enterprise pricing. Dev Tunnels offers three access levels (Private, Org via Entra tenant, Public) plus Group Policy controls for Windows-managed fleets, which is meaningfully simpler and less configurable.

Custom domains. ngrok wins, but only from Pay-as-you-go ($20/month+) upward — Hobbyist doesn’t include bring-your-own domains, only a branded pool. Dev Tunnels has no custom domain option at any tier; you’re always on *.devtunnels.ms.

Persistence. Both now offer stable URLs by default — ngrok’s free static dev domain and Dev Tunnels’ persistent tunnel ID are functionally similar, with Dev Tunnels’ caveat being the 30-day inactivity expiration.

Production readiness. ngrok wins by default here: it has an SLA-backed paid tier and is explicitly marketed for production ingress. Dev Tunnels is in public preview without an SLA and is documented as being for development and testing, not production.

Security posture as a target. Both tools’ domains have been documented as abuse vectors. ngrok appears in the MITRE ATT&CK framework (software ID S0508) for use in phishing and command-and-control campaigns, and some enterprise security teams block ngrok domains outright as a result — ngrok has responded with the interstitial page, IP-based reporting, and enterprise controls to lock agents to approved accounts. Microsoft’s dev tunnels have separately been documented by red-team researchers as usable for the same kind of C2 redirection, since traffic to a Microsoft-owned domain is less likely to be flagged by security tooling than traffic to a known tunneling provider. Neither tool is inherently unsafe to use, but if you’re deploying either inside a security-conscious org, expect scrutiny either way.

Tunneling AI Agents and MCP Servers

This is a newer use case for both tools, and it’s worth calling out separately since it didn’t exist when “just use ngrok for webhooks” became conventional wisdom. Local Model Context Protocol (MCP) servers built for coding agents typically run over stdio or on localhost, and exposing them to a cloud-hosted agent requires the same kind of tunnel as any other local service.

ngrok now publishes a dedicated guide for this: running the ngrok agent in front of a local MCP server and layering its identity, Traffic Policy, and observability features on top so that every MCP request is authenticated and auditable before it reaches the server. Several open-source wrappers (ngrok-mcp-host being one example) automate spinning up an MCP server behind an ngrok tunnel and printing the config block a client like Claude Desktop or Cursor needs.

Microsoft’s documentation covers a narrower but related scenario: using the devtunnel CLI to expose a local MCP or REST API server so Microsoft 365 Copilot’s declarative agents can reach it during plugin development, with the persistent-tunnel option specifically recommended so you don’t have to keep updating the agent’s manifest with a new URL.

Neither tool has built MCP-specific infrastructure from scratch — both are applying their existing tunnel primitives to a new workload. If you need policy enforcement or audit logging on agent traffic, ngrok’s Traffic Policy layer is the more mature option today. If you’re already inside the VS Code/Copilot ecosystem for a quick local test, Dev Tunnels avoids installing anything extra.

Setting Up VS Code Port Forwarding

1. Start your local server in the VS Code integrated terminal (npm run dev, or equivalent).
2. Open the Ports view — it’s in the same panel as Terminal and Debug Console, or reachable via Ports: Focus on Ports View in the Command Palette.
3. Forward the port by clicking “Forward a Port” or typing the port number. First use prompts a GitHub or Microsoft sign-in.
4. Set visibility. New forwards default to Private (only your account can access them). For webhook testing, right-click the port, select Port Visibility, and switch to Public.
5. Copy the URL — it’ll look like https://random-string-3000.usw2.devtunnels.ms — and use it wherever you’d have pasted an ngrok URL.

The whole flow is also reachable from the keyboard: Cmd/Ctrl+Shift+P → Ports: Forward a Port.

Which One Should You Actually Use

Stick with ngrok if you need edge authentication (OAuth/OIDC/SAML) in front of a local service, a genuinely custom domain, request-level traffic policies, or anything you’d call production-adjacent. Its paid tiers exist because that feature set has real value, not just because the free tier is stingy.

Reach for Dev Tunnels if you’re already in VS Code, want a quick public link for a design review or a webhook test during active development, and don’t need it to survive being untouched for a month. The zero-install path is real and it’s the biggest practical advantage Dev Tunnels has.

Don’t assume either one replaces the other outright. Dev Tunnels being in public preview with no SLA is a real constraint if you’re wiring up something you’ll depend on; ngrok’s free-tier limits being less severe than reputation suggests doesn’t mean they’re generous enough for a heavy sprint. Pick based on what the specific task needs — persistence, security policy, or just getting a URL in front of a teammate for five minutes — rather than which one is newer.

---

Changelog

Corrections and additions made during fact-checking, with sources:

1. Removed inaccurate claim that ngrok’s free tier has session timeouts. ngrok’s official Free Plan Limits documentation states free endpoints have no timeout and can run indefinitely as a background service. (This was true of ngrok’s older free tier — an 8-hour session limit existed before 2023 — but it no longer applies.) Source: ngrok Free Plan Limits

2. Removed inaccurate claim that free ngrok URLs randomize on every restart. Every ngrok account, including free, has received a static “dev domain” tied to the account since August 2023; it persists across agent restarts. Sources: ngrok Free Plan Limits, ngrok blog: Static dev domains for all ngrok users

3. Verified and retained the 1GB/month and 20,000 requests/month free-tier figures, and added the full current quota table (TCP connections, concurrency, rate limits) from ngrok’s official pricing page. Source: ngrok Pricing

4. Corrected ngrok custom domain claim. The original draft implied paid tiers broadly unlock custom domains; in practice only Pay-as-you-go ($20/month+) includes bring-your-own domains. The $8/month Hobbyist tier only unlocks a pool of ngrok-branded domains. Source: ngrok Pricing

5. Verified ngrok pricing figures ($8/month Hobbyist billed annually, $10/month billed monthly; Pay-as-you-go at $20/month base plus metered usage) against ngrok’s current official pricing page rather than third-party aggregators, several of which quoted stale numbers. Source: ngrok Pricing

6. Added missing caveat that Dev Tunnels is in public preview with no SLA, per Microsoft’s own documentation, and is explicitly described as not recommended for production workloads. Source: What are dev tunnels? — Microsoft Learn

7. Added Dev Tunnels’ actual usage limits (5GB/month bandwidth, 10 tunnels, 10 ports/tunnel, 1,500 req/min per port, etc.), which contradicts the original draft’s framing of “no tight bandwidth throttling.” Source: Dev tunnels service limits — MicrosoftDocs/azure-docs

8. Added the fixed 60-second HTTP timeout on Dev Tunnels requests, which the original draft did not mention and which matters for the webhook-testing use case it recommends. Source: Microsoft Q&A: Do Dev Tunnels Have an HTTP Timeout Issue?

9. Added the 30-day inactivity expiration on “persistent” Dev Tunnels URLs, correcting the implication that persistence is unconditional. Source: Dev tunnels FAQ — Microsoft Learn

10. Corrected the framing that only ngrok shows an interstitial warning page. Dev Tunnels shows an equivalent first-visit anti-phishing interstitial for browser/HTML traffic, skippable via header, and does not show it for API traffic — functionally symmetric with ngrok’s behavior, not a Dev Tunnels advantage. Sources: Dev tunnels security — Microsoft Learn, Dev tunnels in Visual Studio 2022 — Microsoft Learn

11. Verified that VS Code port forwarding requires no extension for basic use — this claim in the original draft was accurate. Source: Port Forwarding — VS Code docs

12. Added a new section on tunneling MCP servers and AI agent traffic, extending the article with current material relevant to both tools’ documented support for this use case. Sources: Using ngrok as your MCP gateway, Debug MCP and API plugins locally — Microsoft Learn

13. Added a security note on both tools’ domains being documented abuse vectors (ngrok is catalogued in MITRE ATT&CK as software S0508; Microsoft dev tunnels have been documented by independent red-team researchers as usable for C2 redirection), for balance — the original draft only framed security as an area where ngrok wins on features, without noting either tool’s abuse history. Sources: Huntress: Abusing Ngrok, ngrok: How ngrok Actively Combats Phishing Attacks

14. Rewrote the conclusion to remove absolute “winner” framing and “the future is native” hype language, replacing it with task-based, trade-off-honest guidance.

15. Removed all front matter/metadata from the original draft and reformatted as clean Markdown.