guide
How to share a localhost app securely
You have an app on localhost:3000 and someone else needs to open it. The options are a tunnel from your laptop, a VPN-style share, a preview deploy, or moving the app to a machine that is already on the internet. Which is right depends on whether your laptop can stay open and whether the visitor may be anonymous.
The short version
If the app must keep working after you close your laptop, run it somewhere else: a reachpad workspace, where one command turns the port into a link. If your laptop will stay open and the visitor must not sign in to anything, a tunnel from the laptop is simpler. If the app is finished and has a build, a preview deployment is the right shape.
The word secure needs unpacking. Every option below moves the app from a private network to a public one. The differences are who can open the link, whether it carries a credential, and what happens to it when you stop paying attention.
The options side by side
| Needs your laptop open | Who can open it | Survives a reboot | |
|---|---|---|---|
| Cloudflare Tunnel | Yes | Anyone, or whoever passes an Access policy you configure | If you run it as a service |
| ngrok | Yes | Anyone with the URL, or OAuth-gated on paid plans | No, unless scripted |
| Tailscale Funnel | Yes | Anyone, over TLS, on a tailnet hostname | Yes, it is a node setting |
| Vercel preview | No | Anyone with the URL, or team members with protection on | Yes |
| reachpad port link | No | Anyone signed in to reachpad who has the link | Files yes, process no: restart the app after a pause |
The first three keep the app on your machine and punch a hole to it. The last two move the app. Moving it is more work once and less work every day after, which is the whole trade.
Doing it on reachpad
$ reachpad create demo$ reachpad attach <workspace-id>$ git clone <your repo> && cd <your repo> && npm install$ npm run dev -- --port 3000$ reachpad ports expose 3000 <workspace-id>
The link is on app.reachpad.dev and carries no port, no workspace id and no account name. It is not a private URL: anyone signed in to reachpad who has it can view. Revoke it with reachpad ports revoke 3000 <workspace-id>. If the app was written by an agent in the workspace to begin with, the clone step disappears, which is the case share a Claude Code app covers.
What each option leaks
- **A tunnel exposes your machine.** Everything the app can reach, the visitor's requests can reach through it. Keep the app bound to one port and do not tunnel a dev server that has a debug endpoint open.
- **A public URL with no gate is public.** Cloudflare Access, ngrok's OAuth option and Tailscale's tailnet-only serve mode all add a sign-in; use one for anything past a demo.
- **A reachpad link is gated by sign-in but not by invitation.** It is safe against a stranger guessing it and not safe against a recipient forwarding it. For a named list of people, share the workspace by email instead.
- **Secrets in the environment are visible to the app, and so to anyone who can make the app print them.** This is true of every option and is a property of the app, not the transport.
When reachpad is the wrong answer
- The visitor cannot or will not create a reachpad account. Use a Cloudflare Tunnel with an Access policy, or a preview deployment.
- The app depends on hardware or files on your machine, a local GPU, a mounted drive. Tunnel it from where it lives.
- The app is finished. Deploy it, and compare hosts on reachpad vs Vercel.
Related
- How to share an app built with Claude Code without deploying it
- The easiest way to share a small internal tool with five coworkers
- reachpad vs Cloudflare Tunnel
166 hours 40 minutes of agent work is shared across up to 10 workspaces, with no card required.
Written on 23 August 2026. Something out of date or unfair? The other guides, or this page as raw markdown: /guides/share-localhost-app.md