Security

SSH

SSH is widely used to provide secure login access to servers. It's end-to-end encrypted, so regardless of client encryption or mode, the tunnel from localhost.run back to your app is fully encrypted.

HTTPS

HTTP is unencrypted, so apps should demand HTTPS. localhost.run generates HTTPS endpoints for every HTTP tunnel and handles certificates and decryption.

Proxy headers that most frameworks detect automatically are added, so requiring HTTPS is usually a single setting in your app. See HTTP tunnels.

TLS passthru

Want to use your own certificates? In TLS passthru mode localhost.run doesn't decrypt your traffic — it passes it as-is down your encrypted tunnel and your app handles decryption.