For developers and home labs
Give any local service a public address.
Wormhop connects a service on your laptop, home server or Raspberry Pi to the internet over HTTPS, TCP or UDP. No port forwarding, no static IP, and UDP travels as QUIC datagrams so WebRTC and game servers stay smooth on a lossy link.
$curl -fsSL https://github.com/jason-shen/wormhop-releases/releases/latest/download/install.sh | shmacOS and Linux. Windows builds are on the releases page.
Fig. 1
Visitors reach the edge. The edge reaches your agent over one outbound connection, so nothing on your side needs an open port.
1.3Gbit/s
through one TCP tunnel, both directions at once
0.19ms
median latency added to an HTTP request
6MB
agent memory at idle; the server uses 11 MB
0.27%
RTP lost with 5% loss on the agent's link
Release builds on a 2-vCPU VM, with server, agent, client and app sharing the same two cores. Method
01/Protocols
One agent for every kind of traffic
Most tunnels stop at web traffic. Wormhop forwards whatever your service speaks, on a subdomain, a port, or a whole range of ports.
| Protocol | Good for | Command | Plan |
|---|---|---|---|
| HTTPS | Web apps, APIs, webhooks, WebSockets, Home Assistant, Nextcloud | wormhop http 3000 | All plans |
| TCP | SSH, RDP, Postgres, Redis, MQTT, anything over TCP | wormhop tcp 22 | Hobbyist and up |
| UDP | Game servers, DNS, VoIP, WireGuard | wormhop udp 27015 | Hobbyist and up |
| UDP ranges | Media servers that want a port per session | wormhop udp 30000-30099 | Hobbyist and up |
| Custom domain | home.yourname.dev, with a Let's Encrypt certificate | wormhop http 8123 --hostname home.example.com | Hobbyist and up |
Port 443 fallback
If a network blocks the agent port, it connects over 443. It tries both at once, so there is no timeout to wait out.
Instant reconnect
The agent reconnects with backoff, and a restarted agent takes over its old session straight away.
One connection, multiplexed
Every visitor gets its own yamux stream, so a slow one can't hold up the rest.
Basic auth per tunnel
Put a username and password in front of any tunnel with one flag.
Dev server friendly
Host header rewrite for Vite and friends, plus X-Forwarded-For, -Proto and -Host.
Reserved names and ports
Reserved subdomains and ports are yours and can't be taken while you're offline.
02/UDP fast path
A lost packet should cost one packet
Tunnels that carry UDP inside TCP turn one dropped packet into a stall for every packet behind it. Wormhop sends each UDP packet as its own QUIC datagram instead. If a network blocks UDP, the agent falls back to TCP on its own.
| Link | RTP lost | Median RTT | Data channel |
|---|---|---|---|
| No loss | 0% | 1.3 ms | 20/20 |
| 2% loss | 0.13% | 1.3 ms | 20/20 |
| 5% loss | 0.27% | 1.3 ms | 20/20 |
03/Getting started
Three commands
1
Install the agent
curl -fsSL …/install.sh | shOne native binary for macOS, Linux and Windows.
2
Add your authtoken
wormhop authtoken <token>Create it in the dashboard. It's shown once and stored hashed.
3
Start a tunnel
wormhop http 3000Or tcp, udp, or start --all from a config file.
04/Dashboard and security
See what's running, and keep it locked down
- Usage
- Bandwidth charted by day. Going over the quota pauses tunnels; it never sends a bill.
- Live view
- Every online tunnel and agent in the dashboard. Close a tunnel or disconnect an agent from there.
- Activity log
- A record of when tokens were created, ports reserved and domains added.
- Authtokens
- One per machine, so you can revoke a lost laptop without touching the rest.
Security notes
- Passwords hashed with Argon2id. Sessions stored only as SHA-256 hashes.
- Authtokens shown once and stored hashed. Revoking one disconnects its agents.
- Custom domains need a DNS TXT record, so nobody can claim yours.
- Every query on account data is scoped to that account.
- Sign-in throttling and a strict content security policy on the dashboard.
05/Use cases
What people run through it
- 01WebRTC & SFUsPut LiveKit, mediasoup, Pion or Janus running on your laptop or home server on a public address while you build and test it. Wormhop carries RTP as QUIC datagrams, so a lost packet never stalls the rest of the call.
- 02SSH & databasesReach SSH, RDP, Postgres or any TCP service behind NAT or a firewall on a fixed public port. No inbound firewall rules and no VPN to set up.
- 03Home labReach Home Assistant, Nextcloud, Jellyfin, a NAS or a Raspberry Pi from anywhere, on your own domain with HTTPS. No router settings, no static IP, works behind CGNAT.
- 04Game serversExpose Minecraft, Valheim, Source engine and other UDP or TCP game servers on a public port without touching your router. Low-latency UDP over QUIC datagrams.
- 05Webhooks & local devGive your local dev server an HTTPS URL for Stripe, GitHub or Slack webhooks, mobile testing and demos. WebSockets and Host header rewriting included.
06/Pricing
Free for three tunnels
Every plan is for one person. Free includes HTTPS and WebSockets; paid plans add TCP, UDP, reserved addresses, custom domains and more bandwidth.
Free
Get something online in a minute
- Up to 3 online tunnels
- 1 GB data transfer a month
- HTTP and HTTPS, with WebSockets
- Random subdomains
- 1 Mbit/s
- No TCP, UDP or custom domains
$0
No card needed
Hobbyist
Most pickedFor side projects, home labs and game servers
- Up to 5 online tunnels
- 25 GB data transfer a month
- HTTP, HTTPS, TCP and UDP
- 3 reserved subdomains, 10 reserved ports
- 1 custom domain with automatic TLS
- 10 Mbit/s
$10/ month
Save $24 with yearly billing
Pro
For a bigger home lab, or testing an SFU with real UDP
- Up to 10 online tunnels
- 100 GB data transfer a month
- HTTP, HTTPS, TCP and UDP, with port ranges
- 10 reserved subdomains, 100 reserved ports
- 3 custom domains with automatic TLS
- 25 Mbit/s
$20/ month
Save $48 with yearly billing
Need more? Higher limits for a personal project, or running Wormhop on your own servers.
hello@wormhop.dev07/Questions
What is Wormhop?
Wormhop gives a service running on your own machine a public address. You run a small agent next to the service; it connects out to Wormhop's edge, and visitors reach your service over HTTPS, TCP or UDP without you opening any inbound ports.
How is Wormhop different from ngrok?
Wormhop carries UDP as well as HTTP and TCP, including whole port ranges, and sends UDP as QUIC datagrams so real-time traffic like WebRTC and game servers isn't held up by lost packets. Custom domains get automatic Let's Encrypt certificates.
Can I use Wormhop for my business?
Wormhop is built for personal use: developers working on their own machines and people running services from a home lab. Every plan caps bandwidth and speed, and it isn't meant for hosting commercial or production services.
Does it work on networks that block unusual ports?
Yes. The agent normally connects on port 7000, but if that's blocked it connects through port 443 instead without any configuration. It tries both at once, so a blocked port doesn't cost you a timeout.
Which platforms does the agent run on?
macOS and Linux (install with one curl command) and Windows (download from the releases page). The agent is a single native binary that uses about 6 MB of memory at idle.
Can I use my own domain?
Yes, on Hobbyist and Pro. Add the domain in the dashboard, create a CNAME and a TXT record to prove you own it, and Wormhop issues and renews a Let's Encrypt certificate automatically.
What happens if I go over my bandwidth?
Your tunnels pause until the next month or an upgrade. There are no overage charges, so there is never a surprise bill.
Can I cancel anytime?
Yes. Manage or cancel your subscription from your account page. When a paid plan ends, your account moves back to the Free plan.