Paperboat compared
Paperboat overlaps with mesh VPNs, tunnels and SSH. Here is which tool we would pick, and why.
Claims about other products link to their own documentation and were checked in November 2026.
Our pick, by need
| If you need | We would use | Read more |
|---|---|---|
| A terminal on my machines that survives a closed laptop, plus SSH and files | Paperboat | Details |
| A public HTTPS link to localhost, now | Paperboat or ngrok. Cloudflare's quick tunnels if you want no account at all | Compare |
| One private network for every device I own, phones included | Tailscale. NetBird if you want to host all of it yourself | Compare |
| A production site behind a CDN and a firewall | Cloudflare Tunnel | Compare |
| An API gateway: traffic policies, OAuth and rate limits in front of my app | ngrok | Compare |
| Recorded sessions and access requests for compliance; Kubernetes and database access | Teleport | Compare |
| Company-wide access with device posture checks | Twingate or Cloudflare Zero Trust | Compare |
| Devices that must share one Ethernet-like network | ZeroTier | Compare |
| Terminals, tunnels and shared secrets for a small team, in one tool | Paperboat | Details |
Side by side
Choose up to two tools to stand beside Paperboat. The choice is kept in the address, so you can send the link.
Paperboat
Terminals
A shell on your machine that you can leave and come back to.
Keeps running when you disconnect
Paperboat: Yes, sessions keep running on the machine
Tailscale: No, a standard SSH session 1
ngrok: No 1
Cloudflare Tunnel: No 1
Teleport: No 1
NetBird: No 1
ZeroTier: No 1
Twingate: No 1
Cloudflare Zero Trust: No 1
Enterprise VPN: No 1
SSH + bastion: With tmux or screen 1
VS Code Tunnels: No; only while VS Code runs there 1
Shows the output you missed
Paperboat: Yes, replays what you missed on reconnect
Tailscale: No 1
ngrok: No 1
Cloudflare Tunnel: No 1
Teleport: Recorded sessions play back afterwards 2
NetBird: No 1
ZeroTier: No 1
Twingate: No 1
Cloudflare Zero Trust: No 1
Enterprise VPN: No 1
SSH + bastion: With tmux scrollback 1
VS Code Tunnels: No 1
From a browser
Paperboat: Yes, in the web console
Tailscale: Yes, SSH Console in the admin console (beta) 2
ngrok: No 1
Cloudflare Tunnel: With Cloudflare Access 2
Teleport: Yes, in the web UI 1
NetBird: Yes, SSH from the dashboard 1
ZeroTier: No 1
Twingate: No 1
Cloudflare Zero Trust: Yes, browser SSH and RDP 1
Enterprise VPN: Some, as browser access to apps 1
SSH + bastion: No 2
VS Code Tunnels: Yes, in vscode.dev 1
Share a live session
Paperboat: Yes, view-only or interactive, by invite
Tailscale: No 1
ngrok: No 1
Cloudflare Tunnel: No 1
Teleport: Yes, join sessions; moderation in Enterprise 2
NetBird: No 1
ZeroTier: No 1
Twingate: No 1
Cloudflare Zero Trust: No 1
Enterprise VPN: No 1
SSH + bastion: With a shared tmux session 1
VS Code Tunnels: No, one user at a time 1
Remote commands
Run one command on another machine and get its output and exit code.
Run a command on another machine
Paperboat: Yes, pb exec, with exit codes
Tailscale: Through ssh 1
ngrok: No 1
Cloudflare Tunnel: No 1
Teleport: Yes, tsh ssh host command 2
NetBird: Through ssh 1
ZeroTier: No 1
Twingate: Through SSH 1
Cloudflare Zero Trust: Through SSH 2
Enterprise VPN: No; SSH once connected 2
SSH + bastion: Yes, ssh host command 2
VS Code Tunnels: No 1
SSH
Use ssh and the tools built on it, without managing keys or opening ports.
Keys handled for you
Paperboat: Yes, keys and host trust handled
Tailscale: Yes, with Tailscale SSH 1
ngrok: No 1
Cloudflare Tunnel: With Cloudflare Access 2
Teleport: Yes, short-lived certificates 1
NetBird: Signs in with your identity provider 1
ZeroTier: No 1
Twingate: Yes, short-lived certificates (Privileged Access) 1
Cloudflare Zero Trust: Yes, short-lived certificates 2
Enterprise VPN: No 2
SSH + bastion: You manage keys on every host 3
VS Code Tunnels: Signs in with GitHub or Microsoft 1
ssh, scp, sftp and rsync
Paperboat: Yes, pb ssh, scp, sftp, rsync and plain ssh
Tailscale: Yes, over the private network 1
ngrok: Only as a TCP endpoint 1
Cloudflare Tunnel: Yes, with cloudflared on the client 3
Teleport: Yes, tsh and OpenSSH with tsh config 2
NetBird: ssh, scp and sftp 1
ZeroTier: Your own SSH over the network 1
Twingate: Yes, ssh, sftp and rsync 1
Cloudflare Zero Trust: Yes, through WARP or cloudflared 2
Enterprise VPN: Your own SSH once connected 2
SSH + bastion: Yes, the original 4
VS Code Tunnels: No; Remote-SSH is separate 2
VS Code Remote-SSH
Paperboat: Yes, through generated SSH host names
Tailscale: Yes, as plain SSH over the network 1
ngrok: No 1
Cloudflare Tunnel: With cloudflared as a proxy 3
Teleport: Yes, with tsh config 2
NetBird: As plain SSH over the network 1
ZeroTier: Your own SSH over the network 1
Twingate: As SSH to a resource 1
Cloudflare Zero Trust: As SSH through WARP 2
Enterprise VPN: Your own SSH once connected 2
SSH + bastion: Yes, with ProxyJump 5
VS Code Tunnels: It is VS Code's own alternative 2
Files
Send a file to a machine without setting anything up.
Send files to a machine
Paperboat: Yes, pb send, resumes if interrupted
Tailscale: Yes, Taildrop between your own devices 3
ngrok: No 1
Cloudflare Tunnel: No 1
Teleport: Through tsh scp 2
NetBird: No 2
ZeroTier: No 1
Twingate: Through sftp or rsync 1
Cloudflare Zero Trust: No 1
Enterprise VPN: No 2
SSH + bastion: scp or rsync 4
VS Code Tunnels: No 1
Environment variables
The secrets your programs need, delivered to the machine that runs them.
End-to-end encrypted variables
Paperboat: Yes, end-to-end encrypted
Tailscale: No 4
ngrok: No 1
Cloudflare Tunnel: No 1
Teleport: No 1
NetBird: No 2
ZeroTier: No 1
Twingate: No 2
Cloudflare Zero Trust: No 1
Enterprise VPN: No 2
SSH + bastion: No; SetEnv sends plain variables 5
VS Code Tunnels: No 1
Where they are available
Paperboat: Terminals, pb exec, scripts, plain SSH and VS Code
Tailscale: n/a
ngrok: n/a
Cloudflare Tunnel: n/a
Teleport: n/a
NetBird: n/a
ZeroTier: n/a
Twingate: n/a
Cloudflare Zero Trust: n/a
Enterprise VPN: n/a
SSH + bastion: n/a
VS Code Tunnels: n/a
Config sync
The same settings on every machine, from a repository you control.
Previews
A public link to a port on your machine, for as long as you need it.
Public link in one command
Paperboat: Yes, pb preview 3000
Tailscale: Yes, tailscale funnel 3000 5
ngrok: Yes, ngrok http 3000 2
Cloudflare Tunnel: Yes, quick tunnels on trycloudflare.com 4
Teleport: No, internal apps only 1
NetBird: No 2
ZeroTier: No 1
Twingate: No 2
Cloudflare Zero Trust: Through Tunnel, set up in the dashboard 3
Enterprise VPN: No 2
SSH + bastion: Only with ssh -R to a server you run 2
VS Code Tunnels: Yes, a forwarded port made public 3
See and replay requests
Paperboat: Yes, inspect and replay, in pb and the console
Tailscale: No 5
ngrok: Yes, traffic inspector with replay 2
Cloudflare Tunnel: No 1
Teleport: No 1
NetBird: No 2
ZeroTier: No 1
Twingate: No 2
Cloudflare Zero Trust: No 3
Enterprise VPN: No 2
SSH + bastion: No 2
VS Code Tunnels: In browser DevTools; no replay 4
Tunnels
A public address for a service that stays the same.
Permanent addresses
Paperboat: Yes, names that stay
Tailscale: Yes, on your tailnet's ts.net name 5
ngrok: Yes, a fixed dev domain; more on paid plans 3
Cloudflare Tunnel: Yes, named tunnels 2
Teleport: No public tunnels 1
NetBird: No 2
ZeroTier: No 1
Twingate: No, private resources only 3
Cloudflare Zero Trust: Yes, named tunnels 3
Enterprise VPN: No 2
SSH + bastion: On servers you run 2
VS Code Tunnels: Yes, persistent dev tunnels 5
Your own domains
Paperboat: Yes, on every plan
Tailscale: No, ts.net names only 5
ngrok: Yes, from Pay-as-you-go 4
Cloudflare Tunnel: Yes, on a domain using Cloudflare DNS 5
Teleport: No public tunnels 1
NetBird: No 2
ZeroTier: No 1
Twingate: Private names only 3
Cloudflare Zero Trust: Yes, on a domain using Cloudflare DNS 4
Enterprise VPN: No 2
SSH + bastion: On servers you run 2
VS Code Tunnels: No 5
Protocols
Paperboat: HTTP/1.1, HTTP/2, HTTP/3, WebSocket, raw TCP
Tailscale: HTTPS on ports 443, 8443, 10000 5
ngrok: HTTP, HTTPS, TCP, TLS 4
Cloudflare Tunnel: HTTP, HTTPS, TCP, SSH, RDP and more 5
Teleport: SSH, Kubernetes, databases, apps, desktops 1
NetBird: n/a
ZeroTier: n/a
Twingate: TCP, UDP and ICMP, privately 3
Cloudflare Zero Trust: HTTP, HTTPS, TCP, SSH, RDP and more 4
Enterprise VPN: n/a
SSH + bastion: TCP forwarding 2
VS Code Tunnels: HTTP, HTTPS, WebSocket 5
Private network
Your machines reach each other's ports without exposing them.
Machines reach each other
Paperboat: TCP ports and private names; not a full network
Tailscale: Yes, a WireGuard mesh 4
ngrok: No 1
Cloudflare Tunnel: With the WARP client 2
Teleport: No; access goes through its proxy 1
NetBird: Yes, a WireGuard mesh 2
ZeroTier: Yes, a virtual Ethernet network 1
Twingate: People reach resources, not machines each other 3
Cloudflare Zero Trust: Yes, routed through Cloudflare 5
Enterprise VPN: Into the company network 3
SSH + bastion: Port forwarding through the bastion 2
VS Code Tunnels: No 1
Encryption
Who could read your traffic on the way.
Between your own devices
Paperboat: End to end; direct when possible
Tailscale: End to end (WireGuard) 5
ngrok: n/a
Cloudflare Tunnel: Through Cloudflare's network 1
Teleport: TLS to Teleport's proxy 1
NetBird: End to end (WireGuard) 2
ZeroTier: End to end; its relays can't read traffic 1
Twingate: End to end, client to connector 4
Cloudflare Zero Trust: Through Cloudflare, which can inspect it 5
Enterprise VPN: To the gateway or the vendor's cloud 1
SSH + bastion: End to end through the jump host 2
VS Code Tunnels: End to end (SSH inside the tunnel) 1
Public links
Paperboat: TLS ends at Paperboat's edge
Tailscale: TLS ends on your device 5
ngrok: TLS ends at ngrok; end-to-end TLS optional 5
Cloudflare Tunnel: Traffic passes through Cloudflare's proxy 1
Teleport: n/a
NetBird: n/a
ZeroTier: n/a
Twingate: n/a
Cloudflare Zero Trust: Ends at Cloudflare 3
Enterprise VPN: n/a
SSH + bastion: Whatever you set up 2
VS Code Tunnels: TLS ends at Microsoft's service 6
Teams and access
Working with other people, and deciding who may do what.
Members and roles
Paperboat: Yes, five roles; SSO and SCIM from 10 seats
Tailscale: Yes, owner, admin and other roles 6
ngrok: Yes, users from Pay-as-you-go 4
Cloudflare Tunnel: Through Cloudflare Zero Trust 2
Teleport: Yes, users and roles 1
NetBird: Yes, users and groups 3
ZeroTier: Owners and administrators 2
Twingate: Yes, users and admin roles 5
Cloudflare Zero Trust: Yes, seats in your organization 6
Enterprise VPN: Through your identity provider 1
SSH + bastion: Unix users on each host 3
VS Code Tunnels: Share with a tenant or GitHub org 5
Access rules, groups and tags
Paperboat: Yes, a policy file with groups, tags and deny rules
Tailscale: Yes, grants, ACLs, groups and tags 6
ngrok: IP policies; roles as a paid add-on 4
Cloudflare Tunnel: Through Access and Gateway policies 2
Teleport: Yes, roles and access requests 1
NetBird: Yes, policies and groups 1
ZeroTier: Network membership and rules 2
Twingate: Yes, groups, policies and approvals 5
Cloudflare Zero Trust: Yes, identity and device policies 7
Enterprise VPN: Yes, detailed central policy 3
SSH + bastion: sshd_config per host 3
VS Code Tunnels: Per tunnel and port 5
Tokens for automation
Paperboat: Yes, scoped API tokens that expire
Tailscale: Yes, API keys and OAuth clients 7
ngrok: Yes, API keys 4
Cloudflare Tunnel: Yes, Cloudflare API tokens 3
Teleport: Yes, bots with short-lived credentials 1
NetBird: Yes, access tokens for its API 2
ZeroTier: Yes, service account tokens 2
Twingate: Yes, API tokens 6
Cloudflare Zero Trust: Yes, Cloudflare API tokens 8
Enterprise VPN: Varies by vendor 1
SSH + bastion: No 3
VS Code Tunnels: Yes, tunnel tokens (24 hours) 6
Self-hosting
Which parts you can run on your own servers.
Run it yourself
Paperboat: Relays and tunnel servers
Tailscale: Your own DERP relays 8
ngrok: No 1
Cloudflare Tunnel: The connector only 2
Teleport: Yes, the whole platform 1
NetBird: Yes, the whole service 2
ZeroTier: Your own network controller 3
Twingate: Connectors only 7
Cloudflare Zero Trust: The connector only 3
Enterprise VPN: OpenVPN AS and Cisco gateways; Zscaler and Prisma are cloud 2
SSH + bastion: All of it, and you maintain it 6
VS Code Tunnels: No; the relay runs on Azure 7
Platforms
Where it runs.
Operating systems
Paperboat: Linux, macOS and Windows; no mobile apps
Tailscale: Linux, macOS, Windows, iOS, Android 9
ngrok: Linux, macOS, Windows, FreeBSD, Docker 6
Cloudflare Tunnel: Linux, macOS, Windows, Docker 3
Teleport: Linux, macOS, Windows clients 1
NetBird: Linux, macOS, Windows, iOS, Android 2
ZeroTier: Linux, macOS, Windows, iOS, Android and more 4
Twingate: Linux, macOS, Windows, iOS, Android, ChromeOS 8
Cloudflare Zero Trust: Linux, macOS, Windows, iOS, Android, ChromeOS 9
Enterprise VPN: Desktop and mobile clients 4
SSH + bastion: Everywhere OpenSSH runs 6
VS Code Tunnels: Where VS Code Server runs 1
Pricing
How you pay, and what is free.
How you pay
Paperboat: By relay and edge bandwidth; Team per seat
Tailscale: Per user: $8 or $18 a month 4
ngrok: Plan plus usage: $10 or $20 a month 4
Cloudflare Tunnel: Available on all plans 1
Teleport: By active users and protected resources 3
NetBird: Per active user: €6 or €12 a month 4
ZeroTier: Per device: from $18 a month 5
Twingate: Per user: $5 or $10 a month 9
Cloudflare Zero Trust: Per user: $7 a month 10
Enterprise VPN: By quote; OpenVPN AS per connection 5
SSH + bastion: Free software; you pay for the bastion 6
VS Code Tunnels: Free, with usage limits 8
Free plan
Paperboat: Every feature for personal use, 5 GB a month
Tailscale: Personal: 6 users, unlimited devices 4
ngrok: 3 endpoints, 1 GB out, 20k requests 4
Cloudflare Tunnel: Quick tunnels need no account 4
Teleport: Community Edition for small companies 1
NetBird: 5 users and 100 machines 4
ZeroTier: Personal: 10 devices, one network 5
Twingate: Starter: 5 users 9
Cloudflare Zero Trust: Up to 50 users 10
Enterprise VPN: OpenVPN AS: 2 connections 5
SSH + bastion: Free 6
VS Code Tunnels: 10 tunnels, 5 GB a month per user 8
Sources
What each product does, from its own documentation, as of November 2026. “No” means its documentation describes no such feature. Found something out of date? The other product's page wins; tell us and we fix ours.
Tailscale
ngrok
Cloudflare Tunnel
- developers.cloudflare.com/tunnel/
- developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/
- developers.cloudflare.com/tunnel/setup/
- developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/trycloudflare/
- developers.cloudflare.com/tunnel/routing/
Teleport
NetBird
ZeroTier
Twingate
- www.twingate.com/docs/ssh-privileged-access-overview
- www.twingate.com/docs/faq
- www.twingate.com/docs/resources
- www.twingate.com/docs/understanding-relays
- www.twingate.com/docs/users
- www.twingate.com/docs/api-overview
- www.twingate.com/docs/connector-deployment
- www.twingate.com/docs/clients
- www.twingate.com/pricing
Cloudflare Zero Trust
- developers.cloudflare.com/cloudflare-one/setup/
- developers.cloudflare.com/cloudflare-one/tutorials/ssh/
- developers.cloudflare.com/tunnel/
- developers.cloudflare.com/tunnel/routing/
- developers.cloudflare.com/cloudflare-one/connections/connect-networks/private-net/
- developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/
- developers.cloudflare.com/cloudflare-one/policies/access/
- developers.cloudflare.com/api/
- developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/
- www.cloudflare.com/plans/sase-zero-trust.md
Enterprise VPN
SSH + bastion
VS Code Tunnels
- code.visualstudio.com/docs/remote/tunnels
- code.visualstudio.com/docs/remote/remote-overview
- code.visualstudio.com/docs/debugtest/port-forwarding
- learn.microsoft.com/en-us/azure/developer/dev-tunnels/overview
- learn.microsoft.com/en-us/azure/developer/dev-tunnels/cli-commands
- learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
- github.com/microsoft/dev-tunnels
- learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits
Each comparison
What differs, what each costs, when to choose the other one, and how to move.
- Paperboat vs Tailscale Tailscale connects your devices into one private WireGuard network, with detailed access rules and clients for every platform.
- Paperboat vs ngrok ngrok puts a local service on a public URL, with traffic tools such as a request inspector and policies.
- Paperboat vs Cloudflare Tunnel Cloudflare Tunnel connects a service to Cloudflare's network, so it can be reached on your Cloudflare domain with Cloudflare's protection in front.
- Paperboat vs Teleport Teleport is an access platform for companies: SSH, Kubernetes, databases and internal apps behind short-lived certificates, with session recording and audit.
- Paperboat vs NetBird NetBird is an open-source WireGuard network between your devices, with access policies and a management server you can run yourself.
- Paperboat vs ZeroTier ZeroTier makes your devices act as if they shared one Ethernet network, with broadcast and bridging.
- Paperboat vs Twingate Twingate gives a company's people access to private resources without a VPN, through connectors you deploy and policies tied to your identity provider.
- Paperboat vs Cloudflare Zero Trust Cloudflare Zero Trust (Access, the WARP client and Tunnel together) puts a company's apps and networks behind Cloudflare, with identity policies and web filtering.
- Paperboat vs Enterprise VPN Zscaler Private Access, Palo Alto Prisma Access, Cisco Secure Client (AnyConnect) and OpenVPN Access Server connect employees to a company network with central policy.
- Paperboat vs SSH + bastion Plain OpenSSH through a bastion (jump) host is the classic way in, with tmux to keep work running.
- Paperboat vs VS Code Tunnels VS Code Remote Tunnels opens a remote machine in VS Code or vscode.dev through Microsoft's dev tunnels service, and VS Code can forward ports, also publicly.
Start with the machine in front of you
Install Paperboat here, then on a second machine. Free for personal use, no card needed.
$ curl -fsSL https://get.pprbt.dev/install | bash > irm https://get.pprbt.dev/install.ps1 | iex