zrok: Zero-Trust localhost Tunneling for Public and Private Sharing
zrok is an open-source sharing tool by NetFoundry that exposes local services to collaborators or the internet. It supports two modes: public sharing, which generates an HTTPS URL anyone can access, and private sharing, which creates a token-based connection that never produces a public endpoint. The security layer is OpenZiti, an open-source zero-trust networking platform, which means traffic is routed through an encrypted overlay network rather than directly through the public internet.
Problems with traditional tunneling tools
Tools like ngrok make a local service publicly accessible by forwarding traffic from a public URL to a local port. This is fast for webhooks and quick demos, but comes with practical and security tradeoffs.
Ephemeral URLs are regenerated each session on free tiers, requiring webhook URLs, documentation links, and anything else referencing that endpoint to be updated every time.
Session limits close free tunnels after a period of inactivity, which is disruptive during long debugging sessions.
Request rate limits on free plans can be hit quickly when testing APIs or serving content.
Browser warnings appear for users visiting an ngrok tunnel for the first time, adding friction to client demos.
Beyond usability, any public tunnel exposes a development machine to automated scanners and bots that continuously probe public URLs for vulnerabilities. For a service with database access or sensitive business logic, this is an unnecessary risk.
How zrok's zero-trust model works
zrok is built on OpenZiti, which creates a private overlay network rather than forwarding a public port.
When you share something privately with zrok, no public endpoint is created. The connection exists only between authenticated participants in the overlay network. Traffic does not touch the public internet unless you explicitly choose a public share. This reduces the attack surface to zero for private shares: there is no URL to scan, no public port to probe.
Public and private sharing
Public sharing generates an HTTPS URL that forwards to your local service. This is appropriate for webhook testing with services like GitHub, Stripe, or Twilio, and for demos where the recipient does not have zrok installed.
Private sharing provides a share token instead of a URL. The recipient uses their own zrok client to create a local connection to your share. They access your service at a localhost address on their machine, which is proxied through the encrypted overlay to your service. No public endpoint is created at any point.
The private model works as follows: you share a service and receive a token, you send that token through a secure channel to a trusted collaborator, they run zrok access private <token> on their machine, and a local port on their machine proxies to your service through the overlay network. No one else can access the connection.
Installation and setup
Installing the binary
On macOS with Homebrew:
On Linux:
On Windows with Scoop:
Verify the installation:
Creating an account
Register with the free zrok.io service:
Enter an email address when prompted. A verification email arrives with a link to activate the account.
Enabling the environment
The verification page displays an enable command containing a unique token. Copy and run it:
This stores the environment identity on the local machine. It only needs to be done once per device.
Sharing a local service
The following examples assume a service is running at http://localhost:3000.
Public share
zrok outputs a public HTTPS URL such as https://sfnblbt17596.shares.zrok.io. Anyone with that URL can access the service. Press Ctrl+C to stop the share.
Private share
Instead of a URL, zrok outputs a share token such as d6zu50wi2cm8. Send this token to the collaborator through a secure channel.
On the recipient's machine (with zrok installed and enabled):
Their terminal shows a local proxy address such as http://127.0.0.1:9191 -> d6zu50wi2cm8. Opening http://127.0.0.1:9191 in their browser connects them to your local service through the encrypted overlay. No public URL exists at any point.
Final thoughts
The private sharing mode is the most significant differentiator from ngrok and similar tools. For collaboration on work-in-progress code, API endpoints with sensitive logic, or anything that should not be publicly accessible, private shares eliminate the risk entirely rather than relying on obscurity.
zrok is also self-hostable. If you need full control over the infrastructure rather than using the zrok.io public service, the project's documentation covers deploying your own instance.
The project is available at github.com/openziti/zrok and documentation at docs.zrok.io.
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.