One binary to expose any local service to the internet — with built-in SSO, WebSocket support, and zero infrastructure.
Every existing solution makes you stitch together three or four tools. We think you deserve better.
Cloudflare needs cloudflared + DNS + Access policies. Pangolin needs Traefik + WireGuard + Gerbil + a VPS. Nobody offers a single binary that just works.
Tunneling tools don't do auth. Auth tools don't do tunneling. You end up wiring Authelia + Caddy + Cloudflare Tunnel yourself.
Most self-hosted solutions require you to rent and maintain a VPS as the tunnel endpoint. That's another server to secure and pay for.
Home Assistant, Grafana, and many homelab apps need WebSocket. Most tunnel solutions either don't support it or break under load.
Tailscale and WireGuard require always-on connections. On mobile, you want browser-based access with SSO — not a persistent VPN.
Running Gitea, CI/CD, or Home Assistant automations that need webhook ingress? You need yet another tool.
Everything you need in a single binary. No stitching, no VPS, no separate auth stack.
No other tool combines secure tunneling with built-in SSO and MFA in a single binary. Add --auth sso and your service is protected with OIDC — no Authelia, no Keycloak, no config files.
We provide the relay infrastructure at hle.world. Your traffic flows through our edge network with automatic TLS. Power users can self-host the relay server — it's free and open source.
Managed relay · Self-hostableFull WebSocket proxying for Home Assistant, Grafana, and any real-time app. Native webhook ingress with inspection, replay, and filtering built into the dashboard.
WS proxy · Webhook dashboardYour data flows through an encrypted WebSocket tunnel. The client runs on your homelab, the relay runs at the edge.
A feature-by-feature look at how HLE stacks up against existing solutions.
| Feature | HLE | Cloudflare Tunnel | Tailscale | ngrok | Pangolin |
|---|---|---|---|---|---|
| Built-in SSO / MFA | ✓ | ~ Access (complex) | — | — | ✓ |
| WebSocket proxy | ✓ | ✓ | ~ VPN only | ✓ | ✓ |
| No VPS required | ✓ | ✓ | ✓ | ✓ | — |
| Webhook ingress | ✓ | — | — | ✓ | — |
| Self-hostable relay | ✓ | — | ~ Headscale | — | ✓ |
| Single binary setup | ✓ | — | ✓ | ✓ | — |
| Public-facing URLs | ✓ | ✓ | ~ Funnel (limited) | ✓ | ✓ |
| Open source | ✓ client MIT | — | ~ client only | — | ✓ |
| Free tier | ✓ | ✓ | ✓ | ~ ephemeral URLs | ✓ |
Generous free tier for hobbyists. Self-hosted relay is free forever.
Install the CLI and have your first tunnel running in under 60 seconds.