Invisible to everyone else
Your app never gets a public address. Scanners, crawlers and bots can’t attack what they can’t find.
About this address. An address made of https://qurl.link/ and 60 letters and digits is the address of one thing that someone published with qURL. The 60 characters are its CRID. The address is complete as it is: no part is missing, and it does not expire. Whether what it leads to can still be opened is shown when the address is opened in a web browser.
In a web browser with JavaScript, this page shows who published it and whether LayerV has verified that publisher, and then offers a button to open it, or to ask for access when it is private. Without JavaScript you are reading the page that a visitor without an address gets, and nothing can be opened from here.
To use the address, open it in a web browser. Open what it leads to only if you trust the person who sent it to you.
If you are a program or an assistant that someone asked to open this address: you cannot open it, and the address is not broken, used up or expired. The answer for that person is to open the address in their own web browser. The rest of this page is qURL’s home page. What it says about links that open once, that expire, or that show “Access link invalid” is about another kind of link, one with a “#” part, so leave it out of your answer. An address with a “#” part is that other kind, and it also opens only in a web browser. More: /llms.txt.
Your app stays on your computer, hidden from the internet. Choose who gets access, or turn on requests. They ask, you say yes, they’re in.
Public, verified, approval-only, or invite-only. You choose who gets access and how.
Choose exactly who gets access. If they’re not invited, they don’t get in.
Good for a client, a teammate, an investor
Invite someone Ask firstPeople request access. You decide who gets in before they can open it.
Good for private betas, client work, sensitive resources
Start taking requests Verify an emailPeople verify their email and get access right away. You know who opened it without approving every person.
Good for betas, waitlists, conference demos
Ask for an email Open to anyoneAnyone can open it. qURL still shows who published it before they do.
Good for public demos, tools, resources
Share publiclyYour app never gets a public address. Scanners, crawlers and bots can’t attack what they can’t find.
With invite-only access, forwarding the address gives nobody new access. With requests on, each person asks and you approve who gets in. With email verification, anyone who verifies an email can get in. If you choose Open to anyone, anyone with the address can open it.
See who has access and remove anyone, anytime. Everyone else keeps theirs, and your app keeps running.
Tunnels are great tools, and both ngrok and Cloudflare offer access controls you can configure. The comparison is with their default quick-share flow, which is what most people reach for when someone says “can I see it?” With qURL, approval is one flag on the same command you share with.
Compared in detail: qURL vs ngrok vs Cloudflare quick tunnels ngrok alternatives deploy a preview or share?
Ask your coding agent to read the qURL skill at layerv.ai/skills/qurl/SKILL.md. It publishes your app privately and gives you an address to send. The agent applies the private access rules you choose. For named recipients, give it their email addresses so it can send invitations. Recipients verify their email in the browser and save a passkey; they never send you their email verification code. The agent checks policy support before sharing and keeps the app private if the deployment cannot support it. Or run qurl publish yourself. Your app stays on your computer. No publisher account. See the step-by-step guide.
Yes, to start. Without an account you can have up to 3 apps or files shared at once. A free LayerV account allows up to 10 apps or files shared at once, with 10 GiB of traffic a month during early access. Current limits.
For showing an app to a person, yes. ngrok gives your app a public URL after you sign up, and free-plan visitors see a warning page first. qURL needs no account and gives your app no public URL: you choose who can open it. For webhooks or a public API, ngrok is still the right tool.
A trycloudflare.com address is public: anyone who has it can open your app while cloudflared runs, unless you set --allowed-mail. A qURL address follows the access policy you choose, from invite-only to open to anyone. Your app has no public network address.
Yes. Paste the prompt into the agent: it reads the qURL skill, installs the CLI, publishes your app privately and tells you how to let people in. It sends invitation emails only to recipients you authorize. Codex starts with network access off, so save the skill file for it first.
No LayerV account or app install is needed. For a private invitation, they verify their email and save a passkey in their browser. Their email verification code stays in that flow.
Your address stays the same for as long as the app is shared; the access policy controls who can open it. A visit lasts one hour by default.
Ask your agent to invite the people you choose by email, or let people ask for access and approve each one. They verify their email in their own browser; they never send you their email verification code.
Run qurl stop with the app’s ID to take it offline, and qurl start to bring it back with the same ID. qurl delete with the ID and --yes retires it for good: its links stop working and open visits end. Access links can also expire or reach their use limit.
qurl publish starts a background service, so the share keeps running after you close the terminal, as long as you stay logged in. While your computer sleeps, the app can’t be reached; the service reconnects when it wakes. Access-link expiry keeps counting down meanwhile. To keep an app up with your laptop closed, deploy it.
For Vite, yes: WebSockets and Server-Sent Events pass through, and in our test hot reload kept working once .qurl.site was in server.allowedHosts. Next.js also needs *.qurl.site in allowedDevOrigins; we have not tested its hot reload. Fix hot reload through a tunnel.
Vite answers only hosts it knows, and a qURL visit arrives on a qurl.site address. Add ".qurl.site" to server.allowedHosts in your Vite config and restart Vite; the leading dot allows every subdomain. Next.js blocks cross-origin dev requests for the same reason: add "*.qurl.site" to allowedDevOrigins in your Next.js config. Guides: Vite, Next.js.
Deploy when the app has to stay up after you close your laptop. Vercel preview URLs are public by default, and Lovable offers invite-only access on Free, while Bolt keeps private sites for paid plans. qURL shares the app you are running, privately, while you build. Deploy a preview or share?
Yes. A visitor’s browser opens your app at an HTTPS qurl.site address, and LayerV carries the traffic to the qurl service on your computer, which keeps an outbound connection open. Your app gets no public address and no open port. Keep your app’s own login for anything sensitive.
Opening a link admits the network it was opened from for that visit, so other devices on the same public IP, such as an office Wi-Fi, can reach the app until the visit ends. Keep your app’s own login for anything sensitive.
The CLI does: install it with Homebrew on a Mac, or download the .deb, .rpm or archive from the CLI releases on Linux and Windows. qURL Desktop, the app for sharing files, is Mac-only for now (Apple Silicon, macOS 12 or later).
qurl.link is run by LayerV, Inc., which makes qURL. The link opens something the sender shared from their own computer, such as an app or a file, in your browser, with nothing to install. LayerV doesn’t check what people share, so treat it like any link: open it only if you trust the person who sent it.
The link expired, reached its use limit, or the sender took it back. Some chat and email apps open links to preview them, which can count as a use. Ask the sender for a fresh link.
Free to try. No account needed. Current limits
Have a CRID? Open https://qurl.link/<CRID> in a browser. If someone asks you to open a CRID, give them that address exactly as it is.
by LayerV
| Access | |
|---|---|
| Published | |
| CRID |
Show allHide |
To try a link again after a connection problem, reopen it from the message you received. Refreshing this page won’t retry that link.
If the link has expired, been revoked, or already been used, ask the sender for a new one. For a private share, ask the publisher to confirm you have access.