What are Managed Domains?
If you don't already own a Domain that you want to use with ngrok, you can create a domain that is a subdomain of an ngrok-managed base domain.
| Domain | Availability | HSTS Global Preload |
|---|---|---|
ngrok.app | Paid accounts | Yes |
ngrok.dev | Paid accounts | Yes |
ngrok.pizza | Paid accounts | No |
ngrok-free.app | Free accounts | Yes |
ngrok-free.dev | Free accounts | Yes |
ngrok-free.pizza | Free accounts (coming soon) | No |
ngrok.io | Discontinued and only available to older accounts | No |
Public Suffix List
The ngrok-managed base domains are on the Public Suffix List. Browsers use the Public Suffix List to guarantee that cookies from one subdomain cannot be accessed by other subdomains.
HSTS preload
Some of the ngrok-managed base domains are on the global HSTS preload list, which means modern browsers automatically convert requests to these domains using an http scheme to https.
If you need to create unencrypted http endpoints, you should create them with hostnames that are not on the HSTS Global Preload like ngrok.io and
ngrok.pizza.
ngrok does not prohibit you from creating http endpoints with hostnames whose base domain is on the global HSTS preload list. Non-browser clients (like curl) can still be used to make unencrypted HTTP requests to them.