webhook.co vs ngrok

Why people compare these two

If you are here, it is probably not because ngrok is bad at its job. The failure that sends people looking is the one where a provider retries a webhook at 03:00, the laptop is shut, and the event is simply gone — there is no queue behind the tunnel to have caught it. There is a quieter version too: going back for the payload of a request from last Tuesday and finding that the free plan keeps a day of traffic, and only metadata unless somebody had already turned on full capture.

The question that separates these two tools is not speed, price, or URL stability. It is what happens to an event when the thing meant to receive it is not there. ngrok answers that question honestly and in its own error catalogue: when the agent serving an endpoint is not running, the request fails with ERR_NGROK_3200 and the provider sees a failed delivery. There is no buffer to drain when you come back. That is not an oversight — a gateway's job is to route what is happening now, and ngrok's entire traffic-policy action catalogue is built for inspection, authentication and transformation at the edge, with nothing in it that stores an event for later. We do the other job: accept the request, store it, and let you replay it into a handler you are still writing, days later.

At a glance

Three things about ngrok that used to be true

Most comparison pages you will find about ngrok are repeating a version of it that no longer exists, so it is worth clearing this up before anything else — including the parts that make us look worse. Your free URL does not rotate any more: every account, free included, gets an automatically assigned dev domain that ngrok's own documentation says cannot be changed. Free endpoints do not time out; ngrok's free-plan limits page says so in bold, and points out you can run one as a background service indefinitely. And ngrok does verify webhook signatures — a verify-webhook traffic-policy action with a provider list of 69 entries at the time of writing, timestamp tolerance for replay protection, and a 403 on failure. If you picked us because you read that ngrok gives you a URL that changes every restart, you picked us for a reason that stopped being true.

What each tool does when your service is down

Point a provider at an ngrok endpoint and stop the agent. The next delivery gets an endpoint-offline error, the provider marks it failed, and whether you ever see that event again depends entirely on that provider's own retry policy — some retry for days, some retry three times, some never. ngrok's documented remedies are to start the agent, pin a URL, enable endpoint pooling or check the dashboard — recover the connection, rather than recover the traffic that arrived without one. Point a provider at us and stop your handler. The request is still accepted and stored, and you replay it when you are ready. Our outbound side retries eight times over roughly twenty-eight hours with jitter before dead-lettering, so a destination that is down for an afternoon does not lose anything.

Inspection, retention, and the 10 KB line

Both tools let you look at a request and send it again, and the differences are in the defaults. ngrok's cloud inspector keeps traffic for 24 hours on Free and 72 hours on its paid self-serve plans, and pay-as-you-go customers can buy an add-on extending that to 90 days — which matches our longest published window, so the ceiling is a tie rather than the gap the free tiers suggest. By default it stores only metadata about each request — headers and bodies require turning on Full Capture for the whole account, which their own docs warn also exposes that data to everyone on your team. Once on, capture truncates at 10 KB, and a truncated request cannot be replayed at all. That last detail matters more than it sounds: a Shopify order payload or a fat Stripe invoice can cross 10 KB without trying. We store the whole body by default and keep it for the retention window on your plan, because inspecting the payload is the product rather than a mode you switch on. Our limit is a different shape and worth stating plainly: we accept bodies up to 1 MiB and reject anything larger with a 413, so where ngrok would truncate a very large payload and still deliver it, we refuse it outright. Above 1 MiB their behaviour is better than ours.

Signature verification, and how far the lists go

This is a real comparison rather than a walkover. ngrok verifies at its edge, which is genuinely better placement than verifying in your own process — bad signatures never reach your compute. Their supported-provider table listed 69 entries when we counted it on the date below. Our registry covers 141 providers and is Apache-2.0, so you can read exactly how each one is verified rather than trusting that it is. The gap is the long tail: PayPal, Adyen, Salesforce, Discord, Vercel and Notion were all absent from ngrok's list on the date we checked. If your provider is on both lists, this row is a tie and you should decide on something else.

What ngrok does better

Getting traffic into a network that blocks inbound connections. An outbound-only agent inside your firewall, your Kubernetes cluster or a customer's VPC is a structural advantage that a hosted receiver cannot replicate, and ngrok markets that pattern deliberately. It is also not only a webhook tool: TCP, TLS and SSH ingress, an API gateway, OAuth and mutual-TLS enforcement, a web application firewall and rate limiting all sit in the same traffic policy, so if you already need a gateway then verification comes along free. It runs almost anywhere — five agent SDKs and builds down to unusual architectures — and it has the enterprise paperwork, the procurement process and the decade of production use that we plainly do not. If your problem is reaching a machine rather than keeping an event, ngrok is the right tool and we are not.

Where we fit instead

When the event has to survive you: a handler you are still writing, a laptop that closes, a deploy that fails. When you want the payload itself kept and searchable rather than a metadata trace of it. When you want the same capability from a CLI, a REST API, a dashboard and an MCP server without one of them being a second-class citizen. And when you would rather read the verification code than be told it works — the whole engine is Apache-2.0.

Moving from ngrok

Sources, and how to correct us

Every claim above about ngrok was read off the pages below on the date shown, not from memory. Products change faster than pages do — if something here is wrong or out of date, including if you work at ngrok, tell us and we'll fix it.

• ngrok error reference — ERR_NGROK_3200 — checked 2026-07-22
• ngrok docs — traffic inspection — checked 2026-07-22
• ngrok docs — verify-webhook traffic policy action — checked 2026-07-22
• ngrok docs — free plan limits — checked 2026-07-22
• ngrok docs — domains — checked 2026-07-22
• ngrok docs — agent SDKs — checked 2026-07-22
• ngrok docs — traffic policy actions — checked 2026-07-22

Other comparisons

• webhook.co vs webhook.site
• webhook.co vs Hookdeck
• All comparisons