ESP32 remote access, compared

There are several good ways to reach an ESP32 from outside its network. They differ mostly in one thing: whether something has to run next to the ESP32, or the ESP32 can do it alone.

Facts about other products are taken from their own documentation in November 2026 and linked below; plans and limits change, so check them before you decide. Pinscope is ours, so read this with that in mind.

Port forwarding

Open a port on the router and point it at the ESP32. Nothing to install and nothing to pay. It needs access to the router, an address that does not change, and a public address at all, which many mobile and fibre providers no longer give (see CGNAT). The ESP32 is then open to the whole internet, usually without encryption, and has to handle every visitor itself.

Good for: a board at home, on your own router, for yourself.

ngrok

A mature tunnel service: an agent on a computer forwards a public address to anything that computer can reach, including an ESP32 on the same network. The agent runs on Windows, macOS and Linux, not on the ESP32, so a computer or a Raspberry Pi has to stay on next to the board. The free plan gives one assigned domain, 1 GB of transfer and 20,000 HTTP requests a month, and shows a warning page to browser visitors until they click through (ngrok's free plan limits). A page that polls every five seconds makes about 17,000 requests a day for a single visitor, so a dashboard left open uses up the free requests quickly.

Good for: showing something running on your computer, inspecting and replaying requests, and anything that is not an ESP32.

Cloudflare Tunnel

cloudflared runs on a computer on the same network and connects out to Cloudflare, which serves your hostname and passes requests to the ESP32. It runs on Windows, macOS, Linux and in Docker. A lasting tunnel needs a domain whose DNS is on Cloudflare; quick tunnels without a domain are meant for development (Cloudflare Tunnel docs). You get Cloudflare's network in front of the device, with its access rules and protection.

Good for: a home lab that already has a server and a domain on Cloudflare, and many devices behind one gateway.

Tailscale

A private network between your devices, built on WireGuard. Every device you use joins it, and then reaches the others as if they were on one LAN, with any port and no public address. There is no official Tailscale client for the ESP32; community projects such as MicroLink run one, recommended on an ESP32-S3 with PSRAM. The usual pattern is a Tailscale node, a computer or a Raspberry Pi, next to the ESP32, forwarding to it. Visitors who are not in your network need Funnel on that node.

Good for: your own devices, reached only by you and your team, on every port.

Pinscope

A component that runs on the ESP32 itself and keeps one outbound connection to the Pinscope service, which gives the device's web server an HTTPS address. Nothing runs next to the board, and the connection needs 9.4 KB of RAM on the chip. The same connection carries the device's log, metrics, crash reports and firmware updates. The free plan covers three devices and 1,000 MB of device traffic a month, with share links for guests; a public page and an address you choose are on paid plans. See pricing.

What it does not do: it only runs on the ESP32 family, it serves HTTP and WebSockets on up to four ports rather than any protocol, and the service sits in the path, so the HTTPS connection ends at Pinscope, not on the device.

Good for: ESP32 devices on networks you do not control, with nothing else on site, and when you also want logs, crashes and updates.

Side by side

	Runs on the ESP32	Needs a computer next to it	Needs your own domain	Open to visitors without an account
Port forwarding	Nothing to run	No	No	Yes
ngrok	No	Yes	No	Yes, after a warning page on the free plan
Cloudflare Tunnel	No	Yes	Yes, for a lasting address	Yes
Tailscale	Community clients, S3 with PSRAM	Usually	No	Only through Funnel
Pinscope	Yes, 9.4 KB	No	No	Share links on every plan; public pages on paid plans

How to choose

The board is at home and only you use it: port forwarding or Tailscale.
A computer already runs next to the board: ngrok or Cloudflare Tunnel will reach it, and everything else on that network.
The board is alone, on someone else's network: something has to run on the ESP32 itself. That is the case Pinscope is built for.

Try it

Three devices are free, and no card is needed. Create an account, or read the five-minute guide first.