Open Source Alternatives
  • Alternatives
  • Categories
    Categories by size882 projects
    • Developer Tools461
    • AI & Machine Learning404
    • Web Development196
    • Business & Productivity191
    • Communication & Collaboration126
    • Security & Monitoring126
    • IT Management123
    • Product & Project Management106
    • Cloud & Hosting105
    • Data & Analytics104
    Browse all 21 categoriesLLMOps & AI Tooling, Design & Creative and 9 more
  • Blog
  • Advertise
SearchNotion, Slack, password manager.../
Submit
Open Source Alternatives
  • Alternatives
    • Developer Tools461
    • AI & Machine Learning404
    • Web Development196
    • Business & Productivity191
    • Communication & Collaboration126
    • Security & Monitoring126
    • Browse all 21 categories
  • Blog
  • Advertise
Submit your project

New open source projects by email

The projects we add and every new guide. Free, unsubscribe any time.

Open Source Alternatives LogoOpen Source Alternatives

Handpicked Open Source Alternatives to Paid Softwares

Product

  • Categories
  • Tag
  • Advertise

Resources

  • Blog
  • Collection
  • Submit

Company

  • Privacy Policy
  • Terms of Service
  • Refund Policy
  • Sitemap

Alternatives

  • Claude Code
  • Jira
  • Notion
  • Slack
  • Linear
  • Wispr Flow
  • All alternatives
© 2026 Open Source Alternatives. All rights reserved.
Open SourceAlternatives
Home/Categories/Web Development/portless
icon of portless

portless

Open source alternative to LocalCan

  • 12.7K stars
  • Apache-2.0
  • Active this week
  • Last commit 1 day ago

Last verified Oct 21, 2026

Run dev servers under named .localhost HTTPS URLs instead of port numbers. Automatic certificate trust, HTTP/2 by default, and no external routing.

Visit websiteGitHub12.7K stars
image of portless
TL;DR

portless is a local development reverse proxy that replaces raw port numbers with stable, named .localhost URLs. It handles what teams typically configure manually with mkcert and nginx, and covers the local-URL portion of what paid services like ngrok provide, but with no cloud routing and no account required. Apache 2.0 licensed, installed in one npm command. Best for frontend and full-stack developers running multiple local services who want HTTPS addresses without managing certificates by hand.

Read the full breakdownHide the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ
who it's for

Who portless is for#

Full-stack developers running multiple local services

When you run a frontend, API, and background worker simultaneously, portless gives each service a named address (api.myapp.localhost, docs.myapp.localhost) that does not change between sessions. You stop copying port numbers from terminal output, and bookmarks stop breaking when a service restarts on a different port.

Skip if:

If you run a single app at a time and a port number in the URL is not a friction point, portless adds setup overhead without a clear benefit.

Teams using git worktrees for parallel branches

portless automatically assigns a subdomain per worktree branch, so running the main checkout and a feature branch simultaneously produces two distinct HTTPS URLs with no manual configuration. The main worktree gets https://myapp.localhost and a linked worktree on fix-ui gets https://fix-ui.myapp.localhost.

Skip if:

If your team does not use git worktrees, or if developers work on one branch at a time, the worktree routing feature provides no value.

Developers needing HTTPS for local OAuth flows

Some OAuth providers (Google, Apple) reject http://localhost redirect URIs. portless serves all apps over HTTPS with a trusted local CA, so OAuth redirect URIs work in local development. With a custom TLD like dev.example.com, even strict providers that reject .localhost and .test URIs can be satisfied.

Skip if:

If your local development does not involve OAuth, secure cookies, or browser APIs restricted to secure origins, HTTPS on localhost adds no functional value.

Monorepo teams with multiple workspace packages

portless discovers workspace packages automatically from pnpm-workspace.yaml or the workspaces field in package.json, starts each package's dev script, and routes them to subdomains under a shared project name. A single portless command at the repo root replaces per-package port coordination.

Skip if:

Single-package repositories and non-JavaScript projects get no value from the monorepo workspace discovery feature, since it is specific to npm, yarn, pnpm, and bun workspaces.

the problem

The problem it solves#

Local development workflows accumulate port numbers. Port 3000 is the frontend, 8080 is the API, 3001 is the admin panel, and 5555 is whatever that background service started last week. When two services compete for the same port, startup fails or you hunt through logs to find which process to kill. When you switch projects, you copy port numbers from terminal output into browser tabs.

The HTTPS problem is separate and harder. Browsers restrict certain APIs to secure origins. Some OAuth providers reject http://localhost redirect URIs entirely. Cookies that require the Secure attribute do not work over plain HTTP. Setting up local HTTPS the right way means installing mkcert, configuring a reverse proxy, and maintaining certificate trust across team members' machines: work most teams skip and then debug later.

how portless solves it

How it solves it#

Named .localhost HTTPS URLs

Every app gets a stable .localhost address instead of a raw port. HTTPS and HTTP/2 are enabled by default: portless generates a local CA, adds it to your system trust store, and binds port 443 on first run. No browser certificate warnings, no manual certificate setup required.

Framework auto-detection and port injection

portless assigns a random port (4000-4999) via the PORT environment variable. Frameworks that respect PORT (Next.js, Express, Nuxt) work immediately. For frameworks that ignore it (Vite, Astro, React Router, Angular, Expo, React Native), portless auto-injects the correct --port and --host flags, reaching through package.json script definitions.

Git worktree subdomain routing

In a linked git worktree, portless automatically prepends the branch name as a subdomain. The main checkout gets https://myapp.localhost; a worktree on branch fix-ui gets https://fix-ui.myapp.localhost. No configuration changes are needed between worktrees, and no URL collisions occur.

Monorepo workspace discovery

A single portless.json at the repo root covers all workspace packages. portless discovers packages from pnpm-workspace.yaml or the workspaces field in package.json (npm, yarn, bun). Running portless from the repo root starts all packages that have a dev script, each at its own subdomain.

OS startup service installation

Install the proxy as a launchd (macOS), systemd (Linux), or Task Scheduler (Windows) startup service so named URLs are available after every reboot. The service remembers its configuration: port, TLS mode, custom TLD, and LAN mode are all persisted and reused without repeating flags.

Tailscale and ngrok sharing integration

Add --tailscale to share a local app with teammates on your Tailscale network, or --funnel to expose it publicly via Tailscale Funnel. The --ngrok flag opens an ngrok tunnel alongside the local .localhost URL. Both integrations clean up their registrations automatically when the app exits.

strengths · trade-offs

Strengths and trade-offs#

Strengths

  • No external traffic routing by defaultportless binds only to loopback addresses (127.0.0.1 and ::1) by default. No app traffic passes through any cloud service or external server. LAN mode requires an explicit --lan flag, and internet exposure requires explicitly enabling Tailscale Funnel or ngrok. Sensitive local data never leaves your machine without your intent.
  • Zero manual certificate managementThe local CA is generated and trusted automatically on first run, including WSL setups where both the Linux trust store and the Windows Root store are updated. On Linux, certificate trust is handled for Debian, Arch, Fedora, and openSUSE. No mkcert commands, no nginx configuration, and no browser security exceptions to click through.
  • Settings persist across restartsportless remembers port, TLS mode, custom TLD, and LAN settings from the most recent proxy run. A system restart or reboot does not silently revert to defaults. Explicit environment variables (PORTLESS_PORT, PORTLESS_HTTPS, PORTLESS_TLD) always take priority over persisted settings when you need to override.
  • Apache 2.0 license with no usage restrictionsportless is Apache 2.0 licensed. You can use it in commercial projects, modify it, redistribute it, and run it in team environments without licensing fees or usage restrictions. The license does not require publishing modifications.

Trade-offs

  • -Pre-1.0: state format may change between releasesportless is explicitly pre-1.0. The state directory format (~/.portless) may change between releases, which can require re-running portless trust after an update to re-establish certificate trust. Teams that install it per-project risk different contributors running different versions with incompatible state, which is why the README recommends the global install.
  • -Requires Node.js 24 or laterThe minimum runtime is Node.js 24+. Projects on earlier Node.js versions cannot run portless without upgrading the runtime. This requirement is higher than many current CI baselines and older project setups, which may add friction for teams not already on Node 24.
  • -Port 443 needs elevated privileges on macOS and LinuxBinding port 443 requires root on macOS and Linux. portless handles this with auto-elevation via sudo on first run, but it does require confirming a privilege prompt. In locked-down corporate environments or containers that restrict privilege escalation, you must use --no-tls or a higher port via --port.
versus alternatives

portless vs alternatives#

portless vs ngrok

Both portless and ngrok give local development servers a stable URL, but they solve different problems. ngrok is a commercial tunneling service that exposes local apps to the public internet via ngrok's cloud infrastructure. portless is an open source local proxy that gives apps stable .localhost addresses without routing traffic through any external server.

Featureportlessngrok
LicenseApache 2.0Proprietary
Traffic routingLocal only (loopback)Via ngrok cloud servers
Named local URLsYes (.localhost, .test, custom TLD)Free tier: random subdomain
Persistent subdomainsYes (local, always stable)Paid tiers only
HTTPSAuto-trusted local CAngrok-managed certificates
Internet exposureOptional (--ngrok or --funnel flags)Core feature
Git worktree routingYes (automatic)No
Monorepo supportYesNo

portless is the better choice when you want stable local URLs without depending on an external service, need no account, and want no bandwidth limits. The local CA approach means HTTPS works in development including for OAuth flows that require a secure origin.

ngrok is still the better choice when you need to share a local app with someone outside your network, receive webhooks from external services in real time, or demo a work-in-progress to a client on a public URL. For those cases, portless integrates with ngrok via the --ngrok flag, so you can have both a stable local .localhost URL and an ngrok tunnel running at the same time.

portless vs manual local HTTPS setup

The alternative to portless without any external service is to configure mkcert, a reverse proxy (nginx or Caddy), and /etc/hosts entries by hand. This approach is free, but it requires installing and maintaining multiple tools, breaks when ports change, and needs to be repeated per project. portless replaces that entire setup with one npm install and one command per app.

install · quick start

Quick start#

bash
Install portless globally via npm for the recommended setup.
```bash
npm install -g portless
```
tech stack · detected from GitHub

What it's built on#

Languages
JavaScriptTypeScript
Frameworks
Next.jsReact
frequently asked

FAQ#

Is portless free to use?

Yes. portless is Apache 2.0 licensed and free to use, modify, and redistribute for any purpose, including commercial projects. There is no hosted service, no paid tier, and no account required. You run it entirely on your machine.

Does portless work on Windows?

Yes. portless supports macOS, Linux, and Windows. On Windows, the local CA is added to the system trust store via certutil, and the OS startup service uses Task Scheduler. On WSL, portless updates both the Linux trust store and the Windows Root store so browsers on both sides trust the HTTPS certificates.

How does portless handle HTTPS certificates?

On first run, portless generates a local Certificate Authority (CA) and adds it to your system trust store. All apps served through the proxy use certificates signed by this CA, so no browser security warnings appear. You can supply your own certificates via --cert and --key flags if preferred, for example to use certificates generated by mkcert.

Does portless expose my app to the internet?

No. By default, portless binds only to localhost (127.0.0.1 and ::1), so no traffic leaves your machine. LAN mode (--lan) makes apps accessible on your local network via mDNS under .local addresses. Public internet exposure requires explicitly adding the --funnel flag for Tailscale Funnel or --ngrok for an ngrok tunnel.

Can I use portless in a CI environment?

portless is not designed for CI. In non-interactive environments (no TTY or CI=1), portless exits with a descriptive error rather than prompting, so task runners like turborepo and CI pipelines fail early with a clear message instead of hanging. Use portless in local development only.

also worth a look

Similar open-source tools#

Void Cloud

Alternative toVercel

Full-stack Vite toolkit with one-command Cloudflare deployment

  • 507 GitHub stars
  • MITLicence MIT

Obtainium

InIT Management

Android app updates direct from GitHub and F-Droid

  • 20,630 GitHub stars
  • GPL-3.0Licence GPL-3.0

Cloudflare Os

Alternative toDust

Open source AI workspace with sandboxed apps and Gatekeeper security

  • 11,537 GitHub stars
  • Apache-2.0Licence Apache-2.0

Firebase Ios Sdk

Alternative toAWS Amplify

Open source Apple SDK for Firebase auth, data, push and crashes

  • 6,974 GitHub stars
  • Apache-2.0Licence Apache-2.0

opendisplay

Alternative toDuet Display

Turn any iPhone, iPad, or spare Mac into a free second Mac monitor

  • 5,812 GitHub stars
  • GPL-3.0Licence GPL-3.0

JellyBoxPlayer

Alternative toSymfonium

Native Jellyfin and Emby music player for every platform

  • 750 GitHub stars
  • AGPL-3.0Licence AGPL-3.0
by category

Open source tools in these categories#

196

Web Development

freeCodeCamp, superpowers, Skills for Real Engineers
463

Developer Tools

REA (Reverse Engineer Anything), superpowers, Skills for Real Engineers
107

Cloud & Hosting

dify, RuView, rtk

Featured

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

  • 12,712 GitHub stars
  • AGPL-3.0Licence AGPL-3.0
  • #Email

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

  • 4,904 GitHub stars
  • Apache-2.0Licence Apache-2.0
  • #AI Agents

Omnara

Alternative toCClaude Managed Agents

Open-source agent deployment API. Self-host or use Omnara Cloud.

  • 2,957 GitHub stars
  • Apache-2.0Licence Apache-2.0
  • #AI Agents
Feature your project

New open source projects by email

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

/
  • Claude Code to OpenCode
  • Jira to Windshift
  • Notion to AppFlowy
  • Slack to Mattermost
  • Linear to GitLab
  • Wispr Flow to Handy
  • CapCut to Concat
  • Grok Bot to rakazo
  • Superhuman to Inbox Zero
  • Airtable to AITable
  • Muse to OpenClaw
  • GitHub Copilot to Cline
  • Datadog to Netdata
  • Microsoft Teams to Rocket.Chat
  • Pinecone to Qdrant
  • Zapier to n8n
  • Devin AI to OpenHands
  • Firebase to Supabase
  • 1Password to KeePassXC
  • Confluence to Docmost
  • Contentful to Strapi
  • Adobe Premiere Pro to Shotcut
  • ChatGPT to AnythingLLM
  • LangSmith to Langfuse
  • Claude Code to OpenCode
  • Jira to Windshift
  • Notion to AppFlowy
  • Slack to Mattermost
  • Linear to GitLab
  • Wispr Flow to Handy
  • CapCut to Concat
  • Grok Bot to rakazo
  • Superhuman to Inbox Zero
  • Airtable to AITable
  • Muse to OpenClaw
  • GitHub Copilot to Cline
  • Datadog to Netdata
  • Microsoft Teams to Rocket.Chat
  • Pinecone to Qdrant
  • Zapier to n8n
  • Devin AI to OpenHands
  • Firebase to Supabase
  • 1Password to KeePassXC
  • Confluence to Docmost
  • Contentful to Strapi
  • Adobe Premiere Pro to Shotcut
  • ChatGPT to AnythingLLM
  • LangSmith to Langfuse