Two gigabytes free, every month.
Unlimited tunnels and unlimited agents on every plan — you're billed on bandwidth, not on how many things you run. No subscription unless you want one.
For a personal homelab or a side project.
- Unlimited tunnels & agents
- 2 GB/mo (hard cap)
- Firepuncher & service discovery
- WebSocket support
- SSO, PIN, HTTP Basic & allowlists
- 10/min free
- Log history (7 days)
- Custom domains
Same product, no ceiling. Buy credit when you need it.
- Everything in Free
- 2 GB free/mo, then €0.10/GB (credit-based)
- 10/min free, then credits
- Custom domains
- Custom tunnel codes
- Log history (Up to 30 days)
- Auto-recharge (optional)
- Credit packs from €1 to €25
Dedicated infrastructure and your own identity provider.
- Everything in Pay-as-you-go
- Dedicated relay server
- Custom bandwidth commitment
- SSO with your own IdP (SAML/OIDC)
- Log forwarding (syslog, webhook)
- Custom log retention
- Priority support
- SLA with uptime guarantee
Enterprise features are scoped per agreement and are not available on the self-serve plans.
You pay for bytes, and nothing else.
Not per tunnel
Run one endpoint or forty. Agents, tunnels, and firepuncher rules are unlimited on every plan.
Not per seat
Share an endpoint with your whole household or team. Viewers aren't billable.
Not a subscription
Pay-as-you-go is credit you buy when you need it. Stop using it and nothing recurs.
Every plan, side by side.
| Feature | Free | Pay-as-you-go | Enterprise |
|---|---|---|---|
| Tunnels | Unlimited | Unlimited | Unlimited |
| Agents | Unlimited | Unlimited | Unlimited |
| Bandwidth | 2 GB/mo (hard cap) | 2 GB free/mo, then €0.10/GB (credit-based) | Custom |
| Firepuncher | ✓ | ✓ | ✓ |
| Service discovery | ✓ | ✓ | ✓ |
| WebSocket support | ✓ | ✓ | ✓ |
| Webhook tunnels | Unlimited | Unlimited | Unlimited |
| Webhook requests | 10/min free | 10/min free, then credits | Custom |
| SSO (Google, GitHub) | ✓ | ✓ | ✓ |
| Email allowlist, PIN & HTTP Basic | ✓ | ✓ | ✓ |
| IP allowlist | ✓ | ✓ | ✓ |
| Share links | Up to 1h (1 active) | Up to 7d (unlimited) | Custom |
| Subdomain on hle.world | ✓ | ✓ | ✓ |
| Custom domain | — | ✓ | ✓ |
| Custom tunnel code | — | ✓ | ✓ |
| Log history | 7 days | Up to 30 days | Custom |
| Auto-recharge credit | — | ✓ | ✓ |
| Own IdP (SAML/OIDC) | — | — | ✓ |
| Dedicated relay | — | — | ✓ |
| Log forwarding | — | — | ✓ |
| Priority support & SLA | — | — | ✓ |
The ones we actually get asked.
What happens when I hit 2 GB on the free tier?
Tunnels stop serving traffic until the month resets, or until you add credit. Nothing is deleted and your endpoints stay configured — they just stop passing bytes. You'll get an email before you get there.
Does firepuncher traffic count toward bandwidth?
Yes — it's the same relay and the same meter. An SSH session is negligible; copying a disk image over scp is not.
How are webhooks charged?
Every account gets 10 webhook requests a minute free. On the free tier that's the ceiling. On pay-as-you-go, requests above it are charged at €0.01 each from your credit balance.
Is credit a subscription?
No. You buy a pack between €1 and €25, and it draws down as you use bandwidth beyond the free 2 GB. Auto-recharge is opt-in and off by default.
Does credit expire?
No. Buy €5 and use it over a year if that's how it works out.
Is there a limit on agents or endpoints?
No. Run an agent on every machine you own and declare as many endpoints as you like — you're billed on bandwidth, not on count.
Can I self-host the relay?
The client and shared library are MIT-licensed open source. The relay is proprietary and runs as a managed service. Enterprise gets a dedicated relay instance rather than a self-hosted one.
What if I need to stop?
Delete your account from Privacy & Data. Deletion takes about 24 hours and removes everything. There's nothing to cancel on the free tier and nothing recurring on pay-as-you-go.
Start on the free tier.
If 2 GB a month turns out to be enough — and for most homelabs it is — that's the whole story.