Cloudflare Zero Trust (Access, the WARP client and Tunnel together) puts a company's apps and networks behind Cloudflare, with identity policies and web filtering. Paperboat is a tool for working on your own machines, end to end encrypted, without moving your DNS.
Checked against Cloudflare Zero Trust's own documentation and pricing, November 2026. Sources are listed under the table.
Cloudflare Zero Trust secures a whole company: who may reach which app, from which device, with web filtering and logs.
Paperboat is one install per machine and a sign-in. There is no network, gateway or proxy to plan, and nothing to keep running besides the machines themselves.
With WARP, your traffic goes through Cloudflare, which applies policies and can inspect it.
Paperboat encrypts between your own devices end to end and connects them directly when it can; relays forward traffic they can't read. Only public links end TLS at Paperboat's edge.
Access can render SSH in the browser; the session ends when the tab or connection does.
Paperboat terminals run on the machine and keep running when your laptop sleeps or the network drops. When you come back, from the same computer, another one or a browser, you see what happened while you were away, and you can let someone watch or type along.
$ pb devboxPublic hostnames on Cloudflare need the domain's DNS on Cloudflare.
Paperboat asks for two CNAME records at whichever DNS provider you already use.
$ pb tunnel route add api --name web --to http://127.0.0.1:3000 --wait
$ pb tunnel domain add api api.example.com --route webEvery answer in the Cloudflare Zero Trust column carries a number that links to the page of theirs that says it. Put a second tool beside it
A shell on your machine that you can leave and come back to.
Run one command on another machine and get its output and exit code.
Use ssh and the tools built on it, without managing keys or opening ports.
Send a file to a machine without setting anything up.
The secrets your programs need, delivered to the machine that runs them.
The same settings on every machine, from a repository you control.
A public link to a port on your machine, for as long as you need it.
A public address for a service that stays the same.
Your machines reach each other's ports without exposing them.
Who could read your traffic on the way.
Working with other people, and deciding who may do what.
Which parts you can run on your own servers.
Where it runs.
How you pay, and what is free.
What each product does, from its own documentation, as of November 2026. “No” means its documentation describes no such feature. Found something out of date? The other product's page wins; tell us and we fix ours.
www.cloudflare.com/plans/sase-zero-trust.md, November 2026
Not as a whole: it connects the machines it is installed on, not whole networks, and has no web filtering.
Install Paperboat here, then on a second machine. Free for personal use, no card needed.
$ curl -fsSL https://get.pprbt.dev/install | bash > irm https://get.pprbt.dev/install.ps1 | iex