TOOLS / BROWSER-FIRST / TUNNEL V1.0localhost.
localhost.
Now shareable.
Connect an installed 2XBR BRIDGE for a native browser-controlled path, or keep using the portable agent fallback. TUNNEL gives localhost a temporary public HTTPS subdomain that carries real HTTP, uploads, streaming responses and WebSocket/HMR traffic over the existing TUNNEL v1 wire.
Open TUNNEL →LOCAL http://127.0.0.1:3000
PUBLIC https://r7k4…2xbr.host
ACCESS PASSWORD PROTECTED
STATUS HTTP + WEBSOCKET
CHECKING RELAYHTTP + WEBSOCKET60 MIN MAXNO ACCOUNT
01 / LOCAL TARGET
http://localhost:
TUNNEL v1 intentionally exposes loopback only. It cannot be used as a generic proxy into your LAN.
SECURITY MIGRATION HOLDPublic TUNNEL creation is intentionally paused.
The isolated production boundary is 2xbr.host. Controlled operator acceptance can run while the global public switch remains disabled; ordinary WEB/BRIDGE creation stays blocked until promotion gates are complete.
Prefer the signed 2XBR CLI.
The historical portable agent remains available for migration/advanced use, but pipe-to-shell installation is no longer a recommended trust path. New signed CLI/BRIDGE builds target https://2xbr.host.
LOCALHOSTHTTP / 3000→OUTBOUND AGENTSTREAM / NO STORAGE→2XBR RELAYEPHEMERAL→PUBLIC HTTPSHTTP + WS
Root-relative assets, redirects and WebSocket routes keep their natural URL shape instead of being forced underneath `/t/something/`.
Request and response bodies move through bounded streams. The relay coordinates active bytes; it does not become another file-sharing product.
Uploads, SSE/streaming responses and WebSocket upgrades are carried over the multiplexed control channel so modern dev servers and HMR are part of the v1 contract.
Random one-session routes expire, concurrency/body sizes are capped, registration is rate-limited, and the agent refuses non-loopback targets.
ACCESS MODEL
A public URL is still public.
The random route is intentionally hard to guess, but anybody who receives an unprotected URL can reach the local app until expiry. Use --protect for dashboards, admin screens or anything you would not post publicly.
URL ENTROPY 96 BIT SOURCEDEFAULT UI PROTECTEDLOCAL TARGET LOOPBACK ONLYCONNECT METHOD REJECTEDSERVER STORAGE NONENGINX ACCESS LOG OFF