localtunnel and loca.lt: the tunnel password, reliability and alternatives

localtunnel gives localhost a free public loca.lt URL with one command, and the 'tunnel password' its browser page asks for is the public IP address of the machine running lt. In our October 29, 2026 test, it was also slow and uneven.

How localtunnel works

Run lt (or npx localtunnel) with your local port and the client asks the public server at https://localtunnel.me for a tunnel, then prints a random loca.lt URL. The URL stays up while your lt session runs, and lt reconnects on its own when your local server restarts.

--subdomain asks for a specific name (if it's available), and --local-host sends traffic to another host and rewrites the Host header. There's also a Node.js API: tunnel.url holds the URL, and the tunnel emits request, error and close events.

You can also self-host the open-source server: it needs a domain with wildcard DNS, ships as the Docker image defunctzombie/localtunnel-server, and the client connects to it with --host.

# One-off, no install
npx localtunnel --port 3000

# Or install the lt command and ask for a subdomain
npm install -g localtunnel
lt --port 3000 --subdomain my-app-test

# Use your own localtunnel server
lt --port 3000 --host https://tunnels.example.com

The loca.lt tunnel password page

When a browser opens a loca.lt link (tested October 29, 2026), localtunnel answers with HTTP 511 and a page titled 'Tunnel website ahead!'. It shows the public IP address of the machine running lt and asks the visitor to type it in, so the localtunnel password is your own public IP, visible to anyone who opens your link in a browser.

A visitor only sees the reminder page once per client public IP every 7 days, and if you open https://loca.lt/mytunnelpassword on the machine running the tunnel, it prints your IP as plain text.

To skip the page without typing the IP:

• Send a bypass-tunnel-reminder request header with any value, such as bypass-tunnel-reminder: 1.
• Send a custom, non-standard User-Agent header.
• Webhook and IPN requests from non-browser clients skip it automatically, but a provider that sends a browser User-Agent will hit the page.

# On the machine running lt: print the tunnel password
curl https://loca.lt/mytunnelpassword

# Skip the reminder page from a script or test client
curl -H "bypass-tunnel-reminder: 1" \
  https://<name>.loca.lt/webhook

Is loca.lt down? Our live test

In our test on October 29, 2026 from one cloud sandbox, lt took 32 seconds to hand out a URL. Out of 12 test requests sent through that tunnel, 7 got through in 9 to 19 seconds, and 5 timed out after 25 seconds. From the same sandbox that day, Serveo, localhost.run, Pinggy and a Cloudflare quick tunnel all answered in under 1 second.

On the GitHub repo, the latest npm release is 2.0.2 from 2021, the last push was on August 29, 2025, and 168 issues are open. loca.lt itself now redirects to the project site, which says the service is run and maintained by @TheBoroer.

One test is a snapshot, not an uptime record. But if it behaves like it did for us, a webhook sender may time out before your local app gets the request.

localtunnel alternatives compared

Every option below is free to start; they differ in accounts, URL persistence and limits.

• Use a Cloudflare quick tunnel (cloudflared tunnel --url http://localhost:3000) when you want speed and no account, keeping in mind that the trycloudflare.com URL changes on every run.
• Use ngrok Free when you need the same URL across restarts, since an account gives you 1 static dev domain (see our ngrok vs Cloudflare Tunnel comparison or other ngrok alternatives).
• Use a webhooks.sh bin when you only need to inspect what a webhook sender posts and don't need to run local code yet.

Skip the tunnel when you only need the webhook

A tunnel only works if your machine, your local server and the tunnel are all up when the webhook fires. If you just want to see what a provider sends, you can test webhooks without a tunnel by pointing the sender at a free webhooks.sh bin instead.

1. Create a free bin in your browser at view.webhooks.page or by running curl -X POST https://webhooks.sh/v1/bins.
2. Paste the https://<bin>.webhooks.page/ ingest URL into your webhook provider's settings.
3. Watch requests arrive live in the browser with their HTTP method, path, query string, headers, and body.

A free bin lasts 48 hours, takes up to 100 requests a day with bodies up to 100KB, and always replies with HTTP 200 and a small JSON body like {"ok":true,"delivery_id":"..."}, so it won't run your local handler code or return custom responses. To keep the URL past 48 hours, claim the bin with a free Google sign-in for 30 days of rolling history. To run your handler against real payloads, Solo ($12 a month) adds the wsh CLI, which relays live deliveries to localhost (wsh listen <endpoint> --to localhost:3000) and replays captured requests.

# Free bin: no signup, lasts 48 hours
curl -X POST https://webhooks.sh/v1/bins

# Solo: relay a named endpoint to your local app
wsh listen <endpoint> --to localhost:3000

FAQ

What is the localtunnel password?

It's the public IP address of the machine running lt. The reminder page displays that IP under 'This tunnel is hosted by:' and asks the browser visitor to type it in to continue. On the machine running the tunnel, you can also run curl https://loca.lt/mytunnelpassword to print it as plain text.

How do I bypass the localtunnel reminder page?

Send a bypass-tunnel-reminder request header with any value, or set a custom, non-standard User-Agent header. Webhook requests from non-browser clients pass straight through. In a browser, a visitor only has to complete the page once per client public IP every 7 days.

Is loca.lt down?

It was up when we tested it on October 29, 2026, but slow: 7 of 12 test requests took 9 to 19 seconds, and the other 5 timed out after 25 seconds. Other free tunnels answered in under 1 second from the same sandbox.

Is localtunnel still maintained?

The latest npm release is 2.0.2 from 2021, and the GitHub repository has 168 open issues with its last push on August 29, 2025. The public server still runs, and the project site says it's maintained by @TheBoroer.

Is it safe to share a loca.lt link?

The browser reminder page shows the tunnel host's public IP address to every visitor, and the page itself notes that localtunnel is not an anonymizing service. Don't share a loca.lt link with anyone who shouldn't have your public IP.

What is the best free alternative to localtunnel?

If you want a fast tunnel with no signup, use a Cloudflare quick tunnel, which allows up to 200 in-flight requests and gives you a new URL each run. For a URL that survives restarts, ngrok Free includes 1 persistent dev domain once you sign up. If you only need to inspect incoming webhook payloads, a free webhooks.sh bin needs no signup, lasts 48 hours, and accepts 100 requests a day.