# reachpad vs Cloudflare Tunnel

> Both end with a URL someone else can open to see the app on port 3000. A tunnel keeps the app on your laptop and connects the URL to it. A reachpad workspace is where the app runs, so the URL points at a machine that does not close when you do.

Part of the reachpad comparisons: https://reachpad.dev/compare. Rendered page: https://reachpad.dev/compare/cloudflare-tunnel. Last checked 2026-08-23.

## Side by side

|  | Cloudflare Tunnel | reachpad |
| --- | --- | --- |
| Where the app runs | Your machine, or any machine you run `cloudflared` on | A reachpad workspace |
| Needs your machine up | Yes | No |
| Who can open it | Anyone, or whoever passes a Cloudflare Access policy | Anyone signed in to reachpad who has the link |
| Anonymous visitors | Yes | No |
| Your own domain | Yes, on a zone you hold at Cloudflare | No |
| What else it exposes | Whatever the tunnel is configured to route, on a machine that has your files | One port of a workspace |
| Setup | Install `cloudflared`, authenticate, name a tunnel, route a hostname | `reachpad ports expose 3000 <workspace-id>` |
| Where the agent works | Your machine | In the workspace, and keeps working while you are away |

> Note: Cloudflare documents tunnels at [developers.cloudflare.com](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/). The rows above describe it as documented on 23 August 2026.

## The difference that matters

A tunnel is the right tool when the app must stay where it is. The GPU is on that machine, the files are on that machine, the corporate network is behind that machine. Cloudflare Tunnel is the most complete version of that tool: a stable hostname, a certificate, an Access policy in front, all without an inbound port.

reachpad is for when there is no reason the app should be on your machine at all. An agent wrote it; it could as well have written it on a machine that stays up. Then the link is not a hole to your laptop but the address of the process, and the agent can keep changing the app after you have gone to bed.

The security framing is different too. A tunnel exposes a path into a machine that holds everything you own, so the discipline is in what you route. A reachpad link exposes one port of a workspace that holds one project, and requires a reachpad sign-in on the other end.

## When Cloudflare Tunnel is the right answer

When the app depends on something only your machine has. When the visitor must not create an account anywhere, or must be gated by your own identity provider through Access. When you already run Cloudflare for the domain and want the app on a hostname you own. If any of those hold, tunnel it, and keep your laptop open.

## Trying reachpad

166 hours 40 minutes of agent work is shared across up to 10 workspaces, with no card required. The [quickstart](https://reachpad.dev/docs/quickstart) is six commands and the last one is a link you can send.