Is a Cloudflare Tunnel safe for self-hosting?

A Cloudflare Tunnel is one of the easier ways to make a self-hosted service reachable from the internet without opening any ports on your router, and for a lot of people it’s a perfectly safe choice. The way it works is that a small agent on your server makes an outbound connection to Cloudflare, and Cloudflare then accepts public traffic on your behalf and passes it back down that connection. Because nothing is listening for inbound connections at your house, the usual worry — “I’ve poked a hole in my firewall” — largely goes away. You also get Cloudflare’s DDoS protection and web-application firewall sitting in front of your app for free, which is more than most home setups would ever build themselves.

The catch, and it’s the one worth understanding before you rely on it, is where your encryption ends. With a tunnel, the HTTPS connection from a visitor terminates at Cloudflare’s edge — they decrypt it, inspect or filter it, and re-encrypt it down to you. That’s how the firewall and caching work, but it also means Cloudflare can, in principle, see the plaintext of what flows through. For a public blog or a status page that’s a complete non-issue. For something private — a password manager, personal documents, anything you’d be uncomfortable having a third party technically able to read — it’s a real consideration, even if you trust Cloudflare in practice.

So the honest comparison isn’t “tunnel versus VPN, which is safer” — they solve different shapes of the problem. A tunnel is for publishing something to the world safely and easily, with a third party handling the exposure and some protection. A VPN is for reaching your own private things with no third party in the path at all. If your goal is only ever to get to your own services from your own devices, a VPN like Tailscale is the cleaner answer: nothing is public, and nothing is decrypted anywhere but the two ends. If you genuinely need a public URL that anyone can hit, a Cloudflare Tunnel is a safe and sensible way to provide one — just keep anything you’d hate to see leaked off it, and behind the VPN instead.