piko vs Wiredoor
Self-hosted tunnels for private services compared
piko and wiredoor route public traffic to services that cannot accept inbound connections, using tunnels initiated from the private side. piko centers on HTTP(S) and TCP routing through outbound connections, while wiredoor uses WireGuard tunnels and also supports UDP, access controls, and certificate management.
piko: Route Traffic to Services Behind Outbound Tunnels
Piko is a Go reverse proxy for securely exposing services that cannot accept public inbound connections. It suits teams that need a self-hosted tunnel with clustering and Kubernetes-friendly deployment for production traffic.
Wiredoor: Self-Host Ingress over WireGuard
Wiredoor is a self-hosted ingress platform built on WireGuard and NGINX for exposing HTTP, TCP, and UDP services on private networks. It connects Linux, Windows, and macOS client nodes, plus Docker and Kubernetes gateways, to a server you control.
| piko | Wiredoor | |
|---|---|---|
| Language | Go | TypeScript |
| License | MIT | Apache-2.0 |
| Stars | 2.2k | 1.6k |
| Forks | 89 | 77 |
| Last analyzed | Oct 3, 2026 | Oct 16, 2026 |
Key differences
- piko is written in Go and licensed under MIT; wiredoor is written in TypeScript and licensed under Apache-2.0.
- piko routes HTTP(S) by hostname or an `x-piko-endpoint` header and supports TCP forwarding; wiredoor routes HTTP by domain and path, and supports TCP and UDP.
- piko provides an agent and Go SDK, with clustered server deployment suited to Kubernetes; wiredoor offers Client and Gateway Nodes, a dashboard, and CLI management across several platforms.
- piko includes a Prometheus endpoint, access logging, and a status API; wiredoor offers a web dashboard and optional Prometheus and Grafana monitoring.
- piko reports 2.2k stars and 89 forks; wiredoor reports 1.6k stars and 78 forks.
Choose piko if you…
- need HTTP(S) and TCP routing through outbound connections, including endpoint-based routing.
- want clustered proxy nodes for fault tolerance, scaling, or zero-downtime deployments.
- prefer a Go agent or SDK and operational features such as access logging and a status API.
Choose Wiredoor if you…
- need to route UDP as well as HTTP and TCP traffic through WireGuard tunnels.
- want domain-and-path routing, TLS certificate management, or OAuth2 and IP-based access restrictions.
- need Client or Gateway Nodes for services across Docker, Kubernetes, or private networks, with dashboard and CLI management.
Compare the numbers side by side, or add more projects
This comparison is generated with AI from the OSRepos analyses of both projects. Always check each project's repository and documentation before choosing.