GitHub
Meet WireRiftA small binary. A direct connection. Your infrastructure.InstallationNative binaries for your machine. No runtime to manage.Run your own serverThe public edge belongs to you.HTTP & WebSocket tunnelsShare web apps, receive webhooks, and keep WebSockets connected.TCP tunnelsA path for the protocols beyond HTTP.Security & accessLayer access controls around what you share.Traffic inspectorSee the request. Understand the response. Try it again.Under the wireOne connection. Many independent streams.Dashboard APIYour tunnels and traffic, programmatically.ConfigurationKeep your connections together in a readable config file.Docker deploymentGive your public edge a reproducible home.Local HTTPS developmentA trusted development edge, without a public domain.TroubleshootingGet back to a working connection.
Documentation, without the detour.ESC to close
Browse documentation
DOCUMENTATION / OPERATE

Security & access

Layer access controls around what you share.

Authenticate your client

Use the server's token to establish a client connection. Store tokens outside version control, use a protected configuration file or environment variables, and rotate credentials when access changes.

HTTP Basic Authentication

Protect an HTTP tunnel with a username and password. Serve the public edge over HTTPS when using credentials.

terminal
wirerift http 3000 --auth "user:YOUR_PASSWORD" \
  --server tunnel.example.com:4443 --token YOUR_TOKEN

IP and CIDR allowlists

Allow individual IPv4/IPv6 addresses or CIDR networks. Disallowed HTTP clients receive 403; disallowed TCP connections are dropped.

terminal
wirerift http 3000 --whitelist "203.0.113.50,192.168.0.0/16" \
  --server tunnel.example.com:4443 --token YOUR_TOKEN

PIN-protected previews

Require visitors to enter a PIN in the browser. WireRift also accepts the X-WireRift-PIN header. Browser authentication uses an HttpOnly HMAC cookie.

terminal
wirerift http 3000 --pin YOUR_PIN \
  --server tunnel.example.com:4443 --token YOUR_TOKEN

Treat both transport boundaries explicitly

Configure trusted certificates for the public HTTPS edge and separately enable TLS on the control plane. The default control connection uses plain TCP; use the tls:// server scheme to encrypt it. The dashboard should stay on loopback unless deliberately secured.

terminal
# Server: a certificate valid for your control hostname
wirerift-server --domain tunnel.example.com --token YOUR_TOKEN \
  --control-tls-cert cert.pem --control-tls-key key.pem

# Client: explicitly enable TLS
wirerift http 3000 --server tls://tunnel.example.com:4443 --token YOUR_TOKEN

Based on the upstream WireRift reference . Check the source for the latest options.

PreviousTCP tunnelsUp nextTraffic inspector