Plans and limits
What each JustTunnel plan tier includes — concurrent tunnels, reserved subdomains, workers, rate limits, and team pricing.
JustTunnel has four plan tiers: Free, Starter, Pro, and Team. The numbers below come straight from the server-side enforcer (internal/plan/limits.go) — they are what the API actually checks at tunnel-create, subdomain-reserve, password-set, and worker-attach time. The dashboard's pricing page is canonical for dollar amounts; this page is canonical for what each tier lets you do.
At a glance
| Free | Starter | Pro | Team | |
|---|---|---|---|---|
| Concurrent tunnels | 1 | 2 | 5 | 10 / seat |
| Reserved subdomains | — | — | 10 | 20 / team |
| Per-tunnel rate limit (req/min) | 60 | 300 | 1,000 | 2,000 |
| Inactivity reap | 2 hours | none | none | none |
| Password-protected tunnels | 1 | 2 | unlimited | unlimited |
| Worker tunnels | — | — | 1 | 2 / seat |
| Worker requests / month | — | — | 5,000 | 50,000 (pooled) |
| Worker rate limit (req/min) | — | — | 500 | 2,000 |
| Machine credentials | — | — | 1 | 10 / team |
| Team pricing | — | — | — | $15 / seat / month |
| Min / max team seats | — | — | — | 2 / 25 |
"per seat" means the limit scales with the team's seat count. "per team" means the cap is fixed for the team regardless of seat count. "pooled" means the budget is shared across the whole team rather than divided per seat.
Free
The default plan. Every account starts here.
- 1 concurrent tunnel. Trying to open a second tunnel returns
TUNNEL_LIMIT_REACHED(internal/plan/enforcer.go:53). - No reserved subdomains. You can request a specific name on each invocation (
--subdomain), but you cannot hold it across restarts. - 60 requests per minute per tunnel. The edge returns
429past the limit. - 2-hour inactivity reaper. A tunnel with no traffic for 2h is closed by the edge. Your CLI will reconnect if it's still running.
- 1 password-protected tunnel at a time.
- No workers.
Free is the right tier for a developer who wants to receive webhooks and demo work-in-progress on personal projects.
Starter
A small upgrade for individual developers who hit the free-tier ceilings.
- 2 concurrent tunnels.
- No reserved subdomains — same as Free.
- 300 requests per minute per tunnel.
- No inactivity reap — a tunnel left open stays open.
- 2 password-protected tunnels.
- No workers.
Pro
The first tier with reserved subdomains and worker tunnels.
- 5 concurrent tunnels.
- Up to 10 reserved subdomains. Names you reserve in the dashboard stay yours across restarts and across days you don't run a tunnel. See Subdomains.
- 1,000 requests per minute per tunnel.
- No inactivity reap.
- Unlimited password-protected tunnels (up to your concurrent-tunnel limit).
- 1 worker tunnel. Long-lived, supervised, with a stable team-derived URL. See Worker tunnels.
- 5,000 worker requests / month, with a per-worker rate limit of 500 req/min.
- 1 machine credential for non-interactive auth (CI, scripts).
Pro is the right tier for a freelancer or a solo founder running staging URLs that need to keep working.
Team
Everything Pro has, scaled up and shared across multiple humans, billed per seat.
- 10 concurrent tunnels per seat. A 5-seat team has 50 concurrent tunnels available across all members.
- Up to 20 reserved subdomains per team — note this is a team-wide cap, not per seat (
internal/plan/limits.go:14). - 2,000 requests per minute per tunnel.
- No inactivity reap.
- Unlimited password-protected tunnels.
- 2 worker tunnels per seat.
- 50,000 worker requests / month, pooled across the entire team (not per seat). Worker rate limit per worker: 2,000 req/min.
- 10 machine credentials per team.
- $15 per seat per month, 2-25 seats per team.
Team is the right tier when more than one person needs to open tunnels under the same identity, or when a worker tunnel should be team-managed rather than tied to one person's laptop.
Team contexts vs Team plan
These are two different things:
- Team contexts — the CLI's
team:<slug>identity. Free for any signed-in user, including users on the Free plan. Anyone can create a team and switch between contexts (verified ininternal/teams/service_test.go:111). - Team plan — the paid Stripe subscription with the limits above. A team without an active Team subscription has the limits of its owner's plan.
In practice: you can stand up a team and switch into it on Free, but you'll be running against Free-plan limits until the team upgrades. See Contexts for the CLI side and justtunnel context for the commands.
How limits are enforced
| Limit | Enforced at | What you see |
|---|---|---|
| Concurrent tunnels | tunnel create | TUNNEL_LIMIT_REACHED with an upgrade URL |
| Reserved subdomains | tunnel create (when --subdomain is set on a non-Pro plan) | RESERVED_SUBDOMAIN_NOT_ALLOWED |
| Reserved subdomain count | dashboard reserve flow | "Maximum of N reserved subdomains reached" |
| Password-protected count | tunnel create (when --password is set) | PLAN_LIMIT_REACHED |
| Per-tunnel rate limit | edge proxy | HTTP 429 |
| Inactivity reap (Free) | edge reaper | WebSocket close; CLI reconnect |
| Worker quota | worker create / worker install | Plan-limit error |
When billing lapses (e.g. payment fails on Pro and you drop to Free), tunnels and workers above the new tier's caps are quarantined automatically (internal/billing/downgrade.go). Existing reservations stop being held — the next requester wins the name.
Pricing
Dollar amounts are owned by the pricing page and the Stripe products configured server-side. The numbers in this doc reflect what the API enforces today; if pricing changes, the source of truth is GET /api/plans and the public pricing page.
Related
- Tunnel anatomy — what
MaxTunnelsand the inactivity reaper actually do. - Subdomains — reservation rules per tier.
- Worker tunnels — worker quotas and the per-team / per-seat split.
- Password protection — the password-protected-tunnel cap.
- Contexts — team contexts vs the Team plan.
justtunnel status— confirm your active plan from the CLI.