# How to share a localhost app securely > You have an app on localhost:3000 and someone else needs to open it. The options are a tunnel from your laptop, a VPN-style share, a preview deploy, or moving the app to a machine that is already on the internet. Which is right depends on whether your laptop can stay open and whether the visitor may be anonymous. Part of the reachpad guides: https://reachpad.dev/guides. Rendered page: https://reachpad.dev/guides/share-localhost-app. Last checked 2026-08-23. ## The short version If the app must keep working after you close your laptop, run it somewhere else: a reachpad workspace, where one command turns the port into a link. If your laptop will stay open and the visitor must not sign in to anything, a tunnel from the laptop is simpler. If the app is finished and has a build, a preview deployment is the right shape. The word secure needs unpacking. Every option below moves the app from a private network to a public one. The differences are who can open the link, whether it carries a credential, and what happens to it when you stop paying attention. ## The options side by side | | Needs your laptop open | Who can open it | Survives a reboot | | --- | --- | --- | --- | | [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) | Yes | Anyone, or whoever passes an Access policy you configure | If you run it as a service | | [ngrok](https://ngrok.com/docs) | Yes | Anyone with the URL, or OAuth-gated on paid plans | No, unless scripted | | [Tailscale Funnel](https://tailscale.com/kb/1223/funnel) | Yes | Anyone, over TLS, on a tailnet hostname | Yes, it is a node setting | | [Vercel preview](https://vercel.com/docs/deployments/environments#preview-environment-pre-production) | No | Anyone with the URL, or team members with protection on | Yes | | [reachpad port link](https://reachpad.dev/docs/ports) | No | Anyone signed in to reachpad who has the link | Files yes, process no: restart the app after a pause | The first three keep the app on your machine and punch a hole to it. The last two move the app. Moving it is more work once and less work every day after, which is the whole trade. ## Doing it on reachpad ```bash reachpad create demo reachpad attach git clone && cd && npm install npm run dev -- --port 3000 reachpad ports expose 3000 ``` The link is on app.reachpad.dev and carries no port, no workspace id and no account name. It is not a private URL: anyone signed in to reachpad who has it can view. Revoke it with `reachpad ports revoke 3000 `. If the app was written by an agent in the workspace to begin with, the clone step disappears, which is the case [share a Claude Code app](https://reachpad.dev/guides/share-claude-code-app) covers. ## What each option leaks - **A tunnel exposes your machine.** Everything the app can reach, the visitor's requests can reach through it. Keep the app bound to one port and do not tunnel a dev server that has a debug endpoint open. - **A public URL with no gate is public.** Cloudflare Access, ngrok's OAuth option and Tailscale's tailnet-only serve mode all add a sign-in; use one for anything past a demo. - **A reachpad link is gated by sign-in but not by invitation.** It is safe against a stranger guessing it and not safe against a recipient forwarding it. For a named list of people, [share the workspace](https://reachpad.dev/docs/sharing) by email instead. - **Secrets in the environment are visible to the app, and so to anyone who can make the app print them.** This is true of every option and is a property of the app, not the transport. ## When reachpad is the wrong answer - The visitor cannot or will not create a reachpad account. Use a Cloudflare Tunnel with an Access policy, or a preview deployment. - The app depends on hardware or files on your machine, a local GPU, a mounted drive. Tunnel it from where it lives. - The app is finished. Deploy it, and compare hosts on [reachpad vs Vercel](https://reachpad.dev/compare/vercel). ## Related - [How to share an app built with Claude Code without deploying it](https://reachpad.dev/guides/share-claude-code-app) - [The easiest way to share a small internal tool with five coworkers](https://reachpad.dev/guides/share-internal-tool) - [reachpad vs Cloudflare Tunnel](https://reachpad.dev/compare/cloudflare-tunnel) 166 hours 40 minutes of agent work is shared across up to 10 workspaces, with no card required.