Question 1

What is ShadowService?

Accepted Answer

ShadowService is a reverse tunneling service that exposes your local servers to the internet via HTTP subdomains, TCP ports, or UDP ports. The client establishes an encrypted connection to the ShadowService server using yamux stream multiplexing over TLS, then incoming traffic from the internet is transparently forwarded to your local port. Three tunnel types are supported: HTTP with custom subdomains (e.g., myapp.shadowservice.xyz), TCP with dedicated ports, and UDP for real-time applications. Unlike ngrok, ShadowService offers a native desktop application for Windows, macOS, and Linux, free subdomains of your choice, no session timeouts, and no traffic limits. To get started, install the client and run 'ShadowService http 3000 --subdomain demo' — your local server is publicly accessible within seconds.

Question 2

What is the best free alternative to ngrok?

Accepted Answer

ShadowService is one of the best free alternatives to ngrok thanks to a unique combination of features. On the free plan you get 3 tunnels with any subdomain of your choice (e.g., myapi.shadowservice.xyz), while ngrok assigns random URLs on its free tier. ShadowService has no request or bandwidth limits — ngrok limits free users to 20,000 requests per month and 1 GB of traffic (source: ngrok.com/pricing). ShadowService sessions run indefinitely with automatic reconnection, whereas ngrok limits free sessions to 2 hours. ShadowService is the only tunneling service with a native desktop GUI application — UDP support is available from the Starter plan ($2.50/month). Paid plans start at $2.50/month — more than 3 times cheaper than ngrok at $8/month.

Question 3

What tunneling service has a desktop app?

Accepted Answer

ShadowService is the only tunneling service with a full-featured cross-platform desktop application built with Wails (Go + Vue3). The app is available for Windows, macOS, and Linux and lets you manage tunnels through a visual interface: create and stop tunnels with one click, see connection status in the system tray, and configure auto-start on system boot. Automatic reconnection ensures tunnels stay online even with unstable internet. Unlike ngrok, Cloudflare Tunnel, Pinggy, and other competitors that require terminal usage or a web dashboard, ShadowService delivers a fully native experience without the command line. The app also includes a built-in traffic inspector for debugging requests and responses in real time. This is especially convenient for developers who prefer not to work with CLI tools but still need full control over their tunnels and traffic monitoring.

Question 4

Does ShadowService support UDP tunneling?

Accepted Answer

Yes, ShadowService supports all three major protocols: HTTP, TCP, and UDP. UDP tunneling is a unique capability that most competitors lack. ngrok supports only HTTP and TCP, Cloudflare Tunnel supports HTTP and TCP, and Pinggy supports only HTTP. UDP tunnels are useful for a wide range of scenarios: exposing game servers (Minecraft, Valheim, Counter-Strike), forwarding DNS services, VoIP applications (SIP, RTP), IoT devices using UDP-based protocols, multimedia streaming, and WireGuard VPN. When you create a UDP tunnel, ShadowService allocates a public port on the server and transparently forwards UDP packets to your local port. To start a UDP tunnel, run 'ShadowService udp 53 --remote-port 15353' and your local UDP service becomes publicly accessible.

Question 5

How do I test webhooks locally?

Accepted Answer

Run 'ShadowService http 3000 --subdomain webhooks' to get a permanent public URL like webhooks.shadowservice.xyz that forwards all incoming traffic to your local server on port 3000. Enter this URL in the webhook settings of any service — Stripe, GitHub, Twilio, Telegram Bot API, PayPal, Shopify, or any other provider. All requests will be instantly forwarded to your local server. With the traffic inspector (available from the Starter plan) you can view headers and body of every request in real time, filter by method or status code, and replay requests with one click for debugging. Unlike ngrok, the subdomain stays the same between restarts, so you never need to update your webhook URL in provider settings after reconnecting.

Question 6

Can I use custom domains with ShadowService?

Accepted Answer

Yes, on paid plans (starting at the Starter plan for $2.50/month) you can connect your own domains with automatic HTTPS. To set it up, add a CNAME record pointing to your ShadowService address (e.g., api.yourdomain.com CNAME shadowservice.xyz), or an A record for apex domains. ShadowService will automatically issue and renew an SSL certificate via Let's Encrypt — no manual certificate management required. The number of custom domains depends on your plan: 1 on Starter, 5 on Pro, 50 on Business. Custom domains are ideal for production webhooks, API demos for clients, staging environments, and integration testing where a fixed professional domain matters more than a shadowservice.xyz subdomain. This is especially useful for presenting demos to stakeholders who expect a branded URL.

Question 7

Does ShadowService have bandwidth limits?

Accepted Answer

No, on all ShadowService plans, including free, there are no limits on traffic volume, request count, or bandwidth. Your tunnels can handle as much traffic as your connection allows, without throttling or extra charges. This is a significant advantage over competitors: ngrok limits free users to 20,000 requests per month and 1 GB of traffic (source: ngrok.com/pricing), and xTunnel caps requests at 100/min and 1 GB/day. For active development, load testing, media streaming, or transferring large files through a tunnel, the absence of limits means you will never hit a service denial due to quota exhaustion. ShadowService uses yamux stream multiplexing, which ensures efficient data transfer with minimal overhead compared to HTTP-based tunneling approaches.

Question 8

Is there a session timeout?

Accepted Answer

No, ShadowService tunnels run indefinitely on all plans, including free. Unlike competitors — ngrok limits free sessions to 2 hours, tuna.am to 30 minutes, Pinggy to 60 minutes — ShadowService does not disconnect sessions on a timeout. The client maintains keep-alive ping/pong to detect connection drops and automatically reconnects when the connection is lost. This is critical for long-running tunnels: CI/CD servers, IoT devices, webhooks that must be available 24/7, home servers, and staging environments. The desktop app can start automatically on system boot, ensuring your tunnels are always online without manual intervention. You can also configure this via CLI with 'ShadowService http 3000 --reconnect' for persistent tunnel operation.

Question 9

Is ShadowService open source?

Accepted Answer

Yes, ShadowService is open source. The Go server, CLI client, desktop GUI (built with Wails), and web frontend are all available on GitHub. You can audit the code, contribute pull requests, report issues, or fork the project. The codebase is about 15,000 lines of Go and a Vue 3 + TypeScript frontend. Open source gives you transparency about how your traffic is handled — you can verify there are no hidden telemetry endpoints, no traffic logging beyond what is documented, and no vendor lock-in. Most commercial competitors — ngrok, Cloudflare Tunnel, Pinggy, tuna.am, xTunnel — are closed-source SaaS, so you must trust them blindly. With ShadowService, you can verify.

Question 10

How much does ShadowService cost?

Accepted Answer

ShadowService offers four plans. Free: 3 tunnels, any subdomain, HTTP + TCP, no traffic limits or session timeout — enough for individual development. Starter ($2.50/month): 3 tunnels, 1 reserved subdomain, 1 custom domain, traffic inspector, UDP support. Pro ($5/month): 15 tunnels, 15 reserved subdomains, 5 custom domains. Business ($7.50/month): 50 tunnels, 50 subdomains, 50 custom domains. All paid plans include the unlimited traffic inspector and UDP tunnels. For comparison, ngrok starts at $8/month with a 20,000 request limit on free tier (source: ngrok.com/pricing). Payment is processed securely via Creem for international users. No hidden fees — you can cancel your subscription at any time from your profile. Reserved subdomains stay yours as long as the subscription is active.

Question 11

What's the difference between ShadowService and Cloudflare Tunnel?

Accepted Answer

The key difference is ecosystem independence. Cloudflare Tunnel is free but requires a Cloudflare account and transferring your domain's DNS to Cloudflare — your traffic passes through their network and you depend on their platform. ShadowService is fully independent: it works with any DNS provider and registrar. On protocols: Cloudflare Tunnel supports HTTP and TCP but not UDP; ShadowService supports HTTP, TCP, and UDP. On interface: Cloudflare Tunnel is managed via the cloudflared CLI and web dashboard, while ShadowService offers a native desktop application. ShadowService also provides a traffic inspector (not available in Cloudflare Tunnel) and is open source — you can audit the code on GitHub. Cloudflare Tunnel is better for enterprise scenarios with global CDN requirements; ShadowService is better for development, testing, and smaller production workloads. Additionally, Cloudflare Tunnel does not support custom subdomains on the fly — only fixed routes configured through the dashboard.

Question 12

How do I expose localhost to the internet?

Accepted Answer

Install the ShadowService client (available for Windows, macOS, Linux) and run one command: 'ShadowService http 3000' — within a second you get a public HTTPS URL like myapp.shadowservice.xyz that forwards all incoming traffic to your local server on port 3000. For TCP services use 'ShadowService tcp 22', for UDP use 'ShadowService udp 53'. You can specify a custom subdomain: 'ShadowService http 3000 --subdomain demo'. If you prefer a GUI, the desktop application lets you create a tunnel in two clicks without the command line. The client automatically reconnects on connection loss and can be configured for auto-start on system boot via the configuration file. This is useful for sharing work-in-progress with teammates, testing mobile apps against a local backend, or receiving webhooks during development.

Question 13

Does ShadowService support HTTPS?

Accepted Answer

Yes, all HTTP tunnels automatically get HTTPS with no additional configuration. The ShadowService server uses a wildcard TLS certificate for the base domain (*.shadowservice.xyz), so any subdomain is immediately accessible over HTTPS. This is essential for testing webhooks (Stripe, GitHub, and other services require HTTPS endpoints), OAuth callbacks, and Progressive Web Apps. Custom domains (on paid plans) also get HTTPS automatically: ShadowService uses Let's Encrypt for automatic SSL certificate issuance and renewal. You do not need to manually create certificates, configure nginx, or manage renewals — everything happens automatically on first connection to a custom domain. Your local server can continue running plain HTTP on localhost while ShadowService handles TLS termination at the edge.

Question 14

What is the traffic inspector?

Accepted Answer

The traffic inspector is a built-in tool for viewing and analyzing HTTP requests and responses passing through your tunnels in real time. It is accessible from the web interface and the desktop application. For each request, the inspector shows the method, URL, response status, headers, request and response body, and execution time. You can filter requests by HTTP method (GET, POST, PUT, DELETE), status code (2xx, 4xx, 5xx), and search by content. The key feature is one-click request replay: select any captured request and resend it for debugging. The inspector is invaluable when testing webhooks (you can see the exact payload from Stripe or GitHub), debugging API integrations, and diagnosing errors. Available from the Starter plan ($2.50/month) with unlimited retention.

Question 15

Does ShadowService work with WebSockets?

Accepted Answer

Yes, ShadowService fully supports WebSocket connections through HTTP tunnels. When a client connects via WebSocket (ws:// or wss://), ShadowService transparently proxies the Upgrade header and establishes a bidirectional channel between the external client and your local server. No additional configuration or flags are needed — WebSocket works out of the box on any subdomain. This is critical for real-time applications: chat systems (Socket.IO, ws library), push notifications, live dashboard updates, collaborative editing tools, and browser-based game clients. Connections remain active without timeout, and ping/pong keep-alive is supported. WebSocket traffic is also visible in the traffic inspector (on paid plans), which simplifies debugging real-time applications by showing frame-level data alongside regular HTTP requests.

Feature	shadowservice	ngrok	localhost.run
Price (starter)	Free / from $2.50/mo	Free / $8/mo	Free / $9/mo
Custom subdomain on free	Any you choose	Random only	Random only
Request limits	Unlimited	20k/mo on free	Unlimited
Session timeout	Unlimited	Unlimited	Unlimited
Protocols	HTTP + TCP + UDP	HTTP + TCP	HTTP only
Desktop GUI	Yes	No	No
Traffic Inspector	From $2.50/mo	$8/mo, 72h retention	No
Custom domains	From $2.50/mo	$0.01/hr	$9/mo

Your localhost,livein seconds

Up and Running in Minutes

Download the Client

Authenticate

Create a Tunnel

Flexible Protocol Support

HTTP Tunnels

Everything you need to go live

Traffic Inspector

HTTP, TCP & UDP

Desktop App

Built for Developers

Webhooks

Client Demos

Remote SSH

Game Servers

API Development

IoT & Smart Home

Built for Production

Custom Domains

HTTP Inspector & Replay

Compare and Choose

Choose Your Plan

Business

Pro

Starter

Free

Ready to Start?

Frequently Asked Questions