comparison
reachpad vs Cloudflare Tunnel
Both end with a URL someone else can open to see the app on port 3000. A tunnel keeps the app on your laptop and connects the URL to it. A reachpad workspace is where the app runs, so the URL points at a machine that does not close when you do.
Side by side
| Cloudflare Tunnel | reachpad | |
|---|---|---|
| Where the app runs | Your machine, or any machine you run cloudflared on | A reachpad workspace |
| Needs your machine up | Yes | No |
| Who can open it | Anyone, or whoever passes a Cloudflare Access policy | Anyone signed in to reachpad who has the link |
| Anonymous visitors | Yes | No |
| Your own domain | Yes, on a zone you hold at Cloudflare | No |
| What else it exposes | Whatever the tunnel is configured to route, on a machine that has your files | One port of a workspace |
| Setup | Install cloudflared, authenticate, name a tunnel, route a hostname | reachpad ports expose 3000 <workspace-id> |
| Where the agent works | Your machine | In the workspace, and keeps working while you are away |
Cloudflare documents tunnels at developers.cloudflare.com. The rows above describe it as documented on 23 August 2026.
The difference that matters
A tunnel is the right tool when the app must stay where it is. The GPU is on that machine, the files are on that machine, the corporate network is behind that machine. Cloudflare Tunnel is the most complete version of that tool: a stable hostname, a certificate, an Access policy in front, all without an inbound port.
reachpad is for when there is no reason the app should be on your machine at all. An agent wrote it; it could as well have written it on a machine that stays up. Then the link is not a hole to your laptop but the address of the process, and the agent can keep changing the app after you have gone to bed.
The security framing is different too. A tunnel exposes a path into a machine that holds everything you own, so the discipline is in what you route. A reachpad link exposes one port of a workspace that holds one project, and requires a reachpad sign-in on the other end.
When Cloudflare Tunnel is the right answer
When the app depends on something only your machine has. When the visitor must not create an account anywhere, or must be gated by your own identity provider through Access. When you already run Cloudflare for the domain and want the app on a hostname you own. If any of those hold, tunnel it, and keep your laptop open.
Trying reachpad
166 hours 40 minutes of agent work is shared across up to 10 workspaces, with no card required. The quickstart is six commands and the last one is a link you can send.
Checked against published documentation on 23 August 2026. Something out of date or unfair? The other comparisons, or this page as raw markdown: /compare/cloudflare-tunnel.md