OpenTunnel

OpenTunnel is a CLI and SDK from Anomaly that creates end-to-end encrypted public URLs for apps running on your machine, making them reachable from anywhere. A first route creates a tunnel with a random hostname, and traffic is forwarded through a relay to local services.

What It Is

OpenTunnel exposes local services such as APIs, webhooks receivers, or dev apps on public URLs under opentunnel.xyz. Users add a route with the CLI (for example, mapping a local port) and get back an HTTPS URL. The SDK (@opentunnel/client) lets applications connect a tunnel programmatically and define named routes, which become subdomains of the tunnel hostname.

How the Encryption Model Works

The first route generates a tunnel hostname and a private key on your machine; the key never leaves it. The CLI requests a certificate bound to the tunnel, and the relay only sees the public half and renews the certificate for the same key. A service on your machine keeps an encrypted bridge open to the relay. Visitors reach the public URL, the relay reads only the hostname from the TLS handshake and forwards the encrypted stream, and your machine terminates TLS and proxies to local apps.

Privacy Tradeoffs to Know

The project documents that tunnel hostnames are public: anyone with the URL can reach your services, and the certificate is published to certificate transparency logs. Route names are not logged because the certificate is a wildcard, but they are guessable, so they should not be treated as authentication. Sensitive services should authenticate on their own.