Ibravra is the decision engine and digital knowledge hub for modern founders, operators, and cross-border businesses. We publish research-backed incorporation guides, interactive financial tools, and head-to-head software reviews.

Are Ibravra business tools and calculators free to use?

Yes, all interactive financial calculators, invoice generators, and business launch checklists are 100% free with no registration or credit card required.

How does Ibravra verify software reviews and guides?

All IBRAVRA content follows our strict Editorial Constitution and Post-AI Value Rule, requiring real practitioner experience, primary source statutory checks (IRS/FinCEN), and verifiable benchmarks.

Which is cheapest for a 25-person team: Cloudflare Tunnel, Tailscale, or ngrok?

Cloudflare, by a wide margin, at $0: its Zero Trust Free plan covers up to 50 users, so a 25-person team pays nothing for Tunnel plus Access. Tailscale Standard costs 25 multiplied by $8, which is $200 a month. ngrok pay-as-you-go costs $20 of monthly usage credit plus 22 users above the 3 included at $5 each, which is $130 a month before any usage overage. The ranking flips at 100 users, where Cloudflare pay-as-you-go at $700 a month undercuts Tailscale Standard at $800, while ngrok at $505 a month is cheapest on dashboard seats alone — but ngrok meters endpoints and traffic on top, so compare the full bill, not the seat line.

Is Cloudflare Tunnel really free?

There is no separate per-tunnel charge on Cloudflare's plans page; the tunnel's cost is the Zero Trust seat price. That is $0 for up to 50 users on the Free plan, $7 per user per month on pay-as-you-go with no user limit, and a custom annual price per user on Contract. The tunnel alone does not authenticate anyone: pair it with Cloudflare Access, or the hostname it publishes is public. Confirm in the dashboard whether crossing 50 users bills every seat or only seats above 50 — community reports say every seat becomes billable, and Cloudflare's own page does not spell it out.

Can ngrok replace a VPN for a whole team?

No. ngrok publishes a service to the internet; it does not build a private network between your team's devices. Its pay-as-you-go plan meters data transfer at $0.10 per GB beyond 5 GB, HTTP requests at $1 per 100,000 beyond 100,000, and TCP connections at $2 per 100,000 beyond 5,000, and it caps TCP connections at 600 per minute. A team that routes daily work through those meters pays per request for traffic a VPN carries flat. Use ngrok to expose a demo, a webhook receiver, or a staging app — not as the way your staff reaches the office network.

What happens when Tailscale Personal hits a seventh user?

Personal caps at 6 users for non-commercial use, so the seventh user forces a move to Standard at $8 per user per month. At 7 users that is $56 a month, and the plan also lifts the ACL group cap from 3 to 10 and adds SCIM provisioning. Personal is also non-commercial only: a business tailnet on the free plan is a licensing breach, not a bargain. Budget the Standard seat price from the first commercial user, not from the day you outgrow 6 seats.

What is the hard limit that breaks each tool first?

Cloudflare breaks on headcount: the Free plan is a hard 50-user ceiling, and log retention is 24 hours on Free and 30 days on pay-as-you-go. Tailscale breaks on policy complexity: ACL groups cap at 3 on Personal, 10 on Standard, and 300 on Premium, and ephemeral resources cap at 1,000 minutes a month on Personal and Standard. ngrok breaks on volume: the pay-as-you-go plan caps HTTP requests at 20,000 per minute and TCP connections at 600 per minute, and the Free plan shows an interstitial page on every HTTP endpoint.

Website & Hosting • 13 min read

Cloudflare Tunnel vs Tailscale vs ngrok: Remote Access, Priced Per User

One of these tools gives your team private access to internal apps, one builds a private network between your devices, and one publishes a local service to the public internet. They are not three versions of the same product — and at 5, 25, and 100 users, the cheapest of the three is not the same tool twice.

By Enow A. Jovial • Published 2026-11-07

Cloudflare Tunnel vs Tailscale vs ngrok: Remote Access, Priced Per User

Three tools, three different jobs, one confused buyer. Cloudflare Tunnel publishes a private service through Cloudflare's edge without opening an inbound port. Tailscale builds a private WireGuard network between your devices. ngrok gives a local service a public URL in seconds. Ask which one is cheapest and you have already asked the wrong question: the right question is which job you are buying, and then what that job costs at your headcount.

Every price, limit, and allowance below comes from the vendors' own pricing pages as read on 7 November 2026. Where a vendor publishes no figure — throughput, for example — this guide says so instead of filling the gap with a guess.

> [!KEY TAKEAWAY]

> At 25 users the ranking is Cloudflare $0, ngrok $130 a month before usage, Tailscale Standard $200 a month. At 100 users it is ngrok $505 before usage, Cloudflare $700, Tailscale Standard $800. The cheapest tool changes with headcount because the vendors meter different things: seats, seats, and usage. Buy the meter that matches your usage, not the lowest headline.

Who this guide is for, and who should stop here

This guide is for a founder, IT lead, or solo operator choosing remote access for a team of roughly 5 to 100 people — internal apps reachable from outside the office without running a legacy VPN concentrator. Stop here if you need a consumer VPN to hide browsing: none of these three is that product. Stop here too if your compliance regime names a specific architecture — that is a procurement decision, not a pricing comparison. The Cloudflare Workers vs Vercel Edge Functions comparison covers the edge-compute side of the same Cloudflare platform.

How Cloudflare Tunnel actually works

Cloudflare Tunnel is a network connector that creates an outbound-only connection between your private network and Cloudflare, and no open inbound ports or firewall changes are required. That sentence, from Cloudflare's own documentation, is the whole architecture: you install the small cloudflared connector on a device inside your network, it dials out to Cloudflare and holds the connection open, and requests for your hostname travel down that existing connection. No listening port exists for a scanner to find, and your origin IP is never exposed.

The tunnel is transport, not authentication. Anything you publish through it is publicly reachable unless you put a login in front of it, and the login Cloudflare intends is Cloudflare Access: identity-aware rules that check the user against your identity provider before the request reaches your server.

Pricing follows the Zero Trust seat. Free costs $0 forever for teams under 50 users, with community support and logs up to 24 hours. Pay-as-you-go costs $7 per user per month with no user limit. Contract is a custom annual price per user. There is no separate tunnel line item on the plans page: you pay the seat price, and the tunnel rides along.

How Tailscale actually works

Tailscale builds a mesh network — a tailnet — in which every device gets a stable private address and connects directly to every other device over WireGuard. Two laptops negotiate a direct peer-to-peer connection, with a relay only when a direct path fails. Access is governed by ACLs, a policy file stating which users and devices can reach which resources, plus device posture checks that can require a minimum OS version or a managed device.

A subnet router advertises a whole office LAN into the tailnet, so a laptop at home can reach a printer or a server it has never seen. An exit node routes all of a device's traffic — including traffic to the public internet — through a designated machine, giving the team a single egress point or a fixed geography.

Pricing is seat-based. Personal is $0 free forever for non-commercial use, capped at 6 users, with unlimited user devices, up to 3 ACL groups, up to 50 tagged resources, and 1,000 minutes a month of ephemeral resources. Standard is $8 per user per month with unlimited users, SCIM provisioning, up to 10 ACL groups, and the same 1,000 ephemeral minutes. Premium is $18 per user per month with up to 300 ACL groups, 10,000 ephemeral minutes, just-in-time access, and network flow logs. Extra tagged resources cost $1 per month each.

How ngrok actually works

ngrok runs an agent next to your service and gives that service a public URL. A local app gets a link; a webhook receiver gets a stable endpoint.

Pricing is usage-based, and the usage credit is the meter. Free costs $0 and includes a one-time $5 usage credit, up to 3 online endpoints, 1 GB of data transfer, 20,000 HTTP requests a month, one team member, and an interstitial page on every HTTP endpoint. Hobbyist includes $10 of monthly usage credit, the same 3 endpoints, 5 GB of transfer, and 100,000 requests — and when the credit runs out, the endpoints stop until the next cycle. Pay-as-you-go includes $20 of monthly usage credit, unlimited online endpoints, 5 GB of transfer then $0.10 per GB, 100,000 requests then $1 per 100,000, TCP connections 5,000 then $2 per 100,000, and 3 team members included, then $5 per user. Single sign-on is a $10 per user per month add-on.

The hard limits are published as rate limits, not as a throughput figure. On pay-as-you-go, HTTP requests cap at 20,000 per minute and TCP connections at 600 per minute; on Free, the caps are 4,000 HTTP requests and 100 TCP connections per minute. Run the same numbers through the ROI calculator before you commit a production workload to any usage-metered plan.

The decision table

| :--- | :--- | :--- | :--- | :--- |

Cloudflare and Tailscale charge per seat; ngrok charges per request, per gigabyte, and per connection, and its seat price buys dashboard members, not end users. A 100-person team pays Cloudflare $700 a month for 100 seats; the same 100 dashboard members on ngrok cost $505 a month before usage.

Worked math: the seat bill at 5, 25, and 100 users

The seat formula:

\text{Monthly Seat Bill} = \text{Users} \times \text{Price Per User Per Month}

\text{Annual Seat Bill} = \text{Monthly Seat Bill} \times 12

At 5 users, Cloudflare Free costs $0 and Tailscale Standard costs 5 multiplied by $8, which is $40 a month or $480 a year. At 25 users, Cloudflare Free still costs $0 and Tailscale Standard costs 25 multiplied by $8, which is $200 a month or $2,400 a year. At 100 users the Free plan is gone, so Cloudflare pay-as-you-go costs 100 multiplied by $7, which is $700 a month or $8,400 a year, against Tailscale Standard at $800 a month and Premium at $1,800 a month. That is a $100-a-month gap at 100 users — $1,200 a year.

ngrok runs on a different line: $20 of monthly usage credit and 3 team members included, then $5 per user. At 5 users that is $20 plus 2 multiplied by $5, which is $30 a month before usage overage. At 25 users it is $20 plus 22 multiplied by $5, which is $130 a month. At 100 users it is $20 plus 97 multiplied by $5, which is $505 a month or $6,060 a year — before usage. The comparison that matters is not $505 against $700. It is $505 plus the usage bill against $700 flat.

Worked math: what ngrok usage actually costs

The monthly bill is the larger of the $20 credit and the metered total:

\text{Usage} = \max(0, \text{GB} - 5) \times \$0.10 + \frac{\max(0, \text{Requests} - 100{,}000)}{100{,}000} \times \$1 + \frac{\max(0, \text{TCP Connections} - 5{,}000)}{100{,}000} \times \$2

\text{Monthly Bill} = \max(\$20, \text{Usage})

Light workload: 50 GB out, 1,000,000 HTTP requests, 100,000 TCP connections a month. Transfer is 50 minus 5, multiplied by $0.10, which is $4.50. Requests are 1,000,000 minus 100,000, divided by 100,000, multiplied by $1, which is $9.00. TCP connections are 100,000 minus 5,000, divided by 100,000, multiplied by $2, which is $1.90. Metered usage totals $15.40, inside the $20 credit, so the month bills $20.00.

Heavy workload: 500 GB out, 5,000,000 requests. Transfer is 500 minus 5, multiplied by $0.10, which is $49.50. Requests are 5,000,000 minus 100,000, divided by 100,000, multiplied by $1, which is $49.00. Metered usage totals $98.50, above the $20 credit, so the month bills $98.50. At this volume the $505 seat line for 100 dashboard members becomes $603.50, narrowing the gap to Cloudflare's $700 flat to $96.50 — before the SSO add-on at $10 per user per month, which alone would add $1,000 a month at 100 users. Usage meters compound; seat prices do not.

Throughput and concurrency: what is published, and what is not

Neither Cloudflare nor Tailscale publishes a throughput ceiling for these products, and our editorial analysis found no throughput figure on either vendor's pricing page. That absence is itself a finding: the binding constraint is the origin server, the device, and the link between them, not a vendor meter. A Tunnel carries what your origin can serve; a tailnet carries what two devices can push directly.

ngrok is the exception, and its limits are exact. Pay-as-you-go caps HTTP requests at 20,000 per minute and TCP connections at 600 per minute. Free caps at 4,000 HTTP requests and 100 TCP connections per minute.

!ngrok pricing page: pay-as-you-go $20 of monthly included usage, unlimited endpoints, 3 team members included A demo that spikes past 600 new TCP connections a minute does not slow down gracefully; it hits the cap.

Auth, SSO, and the audit trail

Cloudflare Access checks identity before the request reaches the origin, with single sign-on on the Zero Trust plans and logs kept 24 hours on Free, 30 days on pay-as-you-go, and up to 6 months on Contract. Tailscale offers single sign-on with any identity provider on every plan, SCIM provisioning from Standard upward, device posture checks, and network flow logs on Premium — the audit trail is a paid-tier feature. ngrok puts single sign-on and role-based access behind a $10 per user per month add-on applied to all users. SSO costs $0 extra on Tailscale and $10 per user per month on ngrok — $1,000 a month at 100 users.

Operator boundaries: who must not use which

Do not use ngrok as your team's remote access: it exposes services to the public internet and meters every request. Do not use Tailscale Personal for commercial work: non-commercial only, capped at 6 users. Do not run Cloudflare Tunnel without Access in front of anything sensitive: the tunnel is transport, and a public hostname with no Access policy is public. Do not stay on Cloudflare Free past 50 users: the plan caps at 50 users. The Railway vs Render vs Fly.io hosting pricing playbook covers the hosting bill that usually sits next to the remote-access bill.

> [!FOUNDER]

> "Founders compare these three as if they were three prices for the same thing. They are not. Cloudflare sells you a door with a guard. Tailscale sells you a private road between your own machines. ngrok sells you a public address for one afternoon. Price the door, the road, and the address separately — and never pay per request for traffic your team generates every minute of every day."

> — Enow A. Jovial, Founder & Chief Executive Officer

> [!WARNING]

> Confirm the Cloudflare seat count in the dashboard before you pay. Community reports say that moving from Free to pay-as-you-go makes every seat billable, not just the users above 50 — so a 51-user team may be billed 51 multiplied by $7, which is $357 a month. Cloudflare's own plans page does not spell this out.

The switch points

Three numbers decide the switch. First, 6 users: Tailscale Personal ends, and Standard begins at $8 per seat. Second, 50 users: Cloudflare Free ends and pay-as-you-go begins at $7 per seat. Third, the ngrok usage crossover: a pay-as-you-go workload bills $20 a month while metered usage stays under $20, and every dollar above that is billed in full. The team outgrowing ngrok Free should price pay-as-you-go against Cloudflare Free: at 25 users, $0 against $130 before usage.

> [!TIP]

> Run the free tiers in parallel for two weeks before choosing: one app behind Cloudflare Tunnel with Access, five machines on a Tailscale tailnet, one staging app on ngrok's Free plan. The test costs nothing, and it answers the question no pricing page can: which tool your team actually opens every morning.

Launch protocol: pick, prove, then pay

[x] Name the job before the tool. Private team access, a private device network, or a public demo URL — one sentence, written down first.

[x] Count the seats on each meter. Per user on Cloudflare and Tailscale; per dashboard member plus usage on ngrok. Count both at 5, 25, and 100.

[x] Install the free tier first. Cloudflare Free to 50 users, Tailscale Personal to 6, ngrok Free with 3 endpoints — with Access or an ACL in front of anything sensitive.

[x] Measure the peak minute, not the monthly average. ngrok's 600 TCP connections and 20,000 HTTP requests per minute are peak limits.

[x] Price SSO before you need it. Included on Cloudflare and Tailscale; $10 per user per month on ngrok. Add it to the 100-user bill now.

[x] Set the switch rule in writing. The headcount or usage figure that moves you off the free tier.

The cheapest setup is the one whose meter matches your usage. Price the meter, prove it free for two weeks, and switch on a number you wrote down before you needed it.