The full review
What is Tailscale?
Tailscale is a connectivity platform built on WireGuard that links laptops, servers, containers and edge hardware into a single private mesh network. Instead of funneling traffic through a central concentrator, devices negotiate direct encrypted peer-to-peer connections, so a machine in a home office and one in a cloud region behave as though they share a flat LAN.
The vendor positions Tailscale as a Zero Trust, identity-based platform meant to replace legacy VPN, SASE and PAM tooling across remote teams, multi-cloud environments, CI/CD pipelines, Edge and IoT devices, and AI workloads. Access is decided by who you are in your identity provider, not by which network you happen to be sitting on.
Inside the Tailscale mesh
Tailscale describes the experience as identity-based, zero-config access, and the shape of it is genuinely simple: install a per-device agent, sign in through your IdP, and the device joins the tailnet. Because the mesh is an overlay, it works alongside your existing infrastructure — the Business VPN page promises seamless remote access without rearchitecting your network, with no hardware to configure and no network changes required. The homepage stresses that installation takes minutes and that the platform is cross-platform and infrastructure agnostic.
Replacing a legacy VPN
The Business VPN page names the pain plainly: centralized VPNs are slow in performance and rollout. Tailscale counters with incremental rollouts that avoid productivity loss, MDM integrations for applying policy at fleet scale, and a way to keep internal dashboards, self-hosted tools and third-party apps reachable without publishing them to the open internet. Tailscale's own claim is that those quick rollouts permanently lower tickets.
Access control, SSH and Kubernetes
Reachability is only half the product. Tailscale layers on an adaptive policy engine with Grants for fine-grained rules, ACL groups scaled by plan, and device posture checks that can draw signals from MDM, EDR and XDR tools. Tailscale SSH is split by tier — Basic on the lower plans, Advanced on Premium — and the pricing page also lists a Kubernetes operator, Kubernetes ingress and egress, and a Kubernetes API proxy. Premium adds just-in-time access, advanced Tailscale SSH, network flow logs and log streaming — the evidence auditors tend to request.
Aperture and AI governance
Aperture by Tailscale is an AI gateway the vendor pitches as unified AI governance, aimed at teams whose rapid AI adoption has left a collection of tools, providers and credentials with no central inventory. The vendor reports that each request is logged with caller identity, model, provider, timestamp and token count, and that policy can set token or request rate limits per agent, per team or organization-wide. Aperture offers one endpoint per provider and supports agents such as Claude Code, Codex and Gemini CLI, plus self-hosted models.
Four tiers cover the range. Personal, which the vendor calls free forever, allows unlimited user devices for a small group and access to nearly every feature; Standard adds SCIM provisioning, MDM configuration and advanced roles for billing, IT and auditors; Premium raises ACL group and ephemeral-resource limits while unlocking regional routing and priority support; Enterprise handles custom quantities, MSAs and dedicated services. Platform extensions for PAM, CI/CD, workload and IoT Edge connectivity sell separately, and procurement can route through AWS or Azure marketplaces.
Who should choose Tailscale
Tailscale fits engineering-led organizations whose resources are scattered across clouds, on-prem racks, CI runners and edge hardware — precisely where a hub-and-spoke VPN turns into a bottleneck. Solo developers and homelab owners get unusual mileage from the Personal plan. It is a poorer fit for anyone chasing consumer-style location shifting or anonymous browsing, which leans on the separate Mullvad add-on rather than the core design; teams with no identity provider, or no appetite for policy expressed as configuration, will feel the learning curve.
Strengths
- Built on WireGuard with true peer-to-peer mesh, so traffic mostly avoids relays and stays fast
- Free Personal tier is unusually generous: 6 users, unlimited devices, most features
- Fast, low-friction setup — SSO login and a client install, no firewall re-architecture
- Strong cross-platform coverage plus option to self-host the control plane (Headscale-compatible ethos)
Watch out for
- Single JSON ACL file gets unwieldy for large orgs with many teams and scoped policies
- $18/user/mo Premium jump is steep versus the $8 Standard tier for advanced governance
- Mesh model is device-centric, less app-scoped least-privilege than connector-based ZTNA rivals
- Newer add-on/overage items (tagged resources $1/mo, ephemeral minutes) add billing complexity to track
Key features
| Feature | What it does |
|---|
| WireGuard mesh networking | Encrypted peer-to-peer tunnels between all devices in a tailnet, with automatic NAT traversal and DERP relay fallback. |
| Identity-based access (ACLs) | Human-readable JSON policy file ties access to SSO identity; Standard adds ACL groups and advanced roles. |
| Tailscale SSH | Access SSH endpoints via identity without managing keys; advanced SSH session recording on Premium. |
| Device posture & MDM | Grant access based on device compliance signals and MDM configuration (Standard and up). |
| MagicDNS & subnet routers | Automatic DNS names for devices plus subnet routing and exit nodes to bridge existing networks. |
| Mullvad VPN add-on | Optional exit-node privacy via Mullvad for $5/mo per 5 devices, billed through Tailscale. |
How Tailscale compares
| Alternative | How it differs |
|---|
| Twingate | Connector-based, app-scoped ZTNA with per-team policies and native audit logs; stronger least-privilege governance, but uses its own protocol rather than WireGuard. |
| Cloudflare Access (Zero Trust) | Agentless, browser-first ZTNA on Cloudflare's edge; broader security suite but less of a flat-LAN mesh feel for server-to-server. |
| NetBird | Open-source WireGuard mesh alternative with self-hosting focus; closest architectural match, often cheaper, smaller ecosystem. |
Frequently asked questions
How much is Tailscale?
Tailscale has a free Personal plan (up to 6 users, unlimited user devices). Paid seat-based plans are Standard at $8 per user/month and Premium at $18 per user/month, both with unlimited users. Enterprise is custom-priced via annual invoice. Add-ons include Mullvad VPN at $5/month per 5 devices.
Is Tailscale a VPN or ZTNA?
Both. Tailscale is a WireGuard-based mesh VPN that connects your devices peer-to-peer like one private LAN, and it layers zero-trust controls on top: SSO identity, ACL policies, and device posture checks. It leans more network-centric than app-scoped ZTNA tools like Twingate, but delivers identity-based zero-trust access.
Tailscale vs Twingate — which is better?
Tailscale gives a true WireGuard peer-to-peer mesh, deep platform coverage, and self-hosting options — great for engineering teams. Twingate uses a connector, hub-and-spoke model with app-scoped least-privilege access and stronger per-team governance and audit. Pick Tailscale for flat-network speed; pick Twingate for granular, deny-by-default resource access.
Does Tailscale have a free plan?
Yes. The free Personal plan supports up to 6 users and unlimited user devices, includes 50 tagged resources and 1,000 ephemeral resource minutes per month, and unlocks nearly all core features. It is free forever and works well for individuals, homelabs, and small dev teams before upgrading to the $8 Standard tier.
Did Tailscale change its pricing in 2026?
Yes. On April 8, 2026, Tailscale moved from active-user billing to predictable seat-based pricing. The old Starter plan became Standard ($8/user/mo), Personal Plus was retired into a 6-user free tier, and features like SCIM and device posture moved into paid self-serve tiers. Existing customers keep their plan and price for at least 12 months.
Tailscale ratings on other platforms
Independent user ratings from third-party review sites, linked here for transparency.
These are not our editorial score, are captured on the date shown, and may have changed since.