Tailscale Review 2026: Free for 6 Users, $8 Seats and What It Can See

Verdict at a glance

What we like

• Free Personal plan: up to 6 users and unlimited user devices, no card required
• Peer-to-peer WireGuard connections; relays only ever forward already-encrypted traffic
• Private keys never leave your devices
• Clients on Windows, macOS, Linux, iOS, Android, Chromebook, Apple TV and Amazon Fire devices
• Simple seat pricing for business: $8 Standard, $18 Premium per user per month
• Open-source clients and DERP relay code; a community self-hosted control server (Headscale) exists

What we don't

• Not a privacy VPN out of the box - exit nodes are your own machines unless you pay for Mullvad
• The coordination server is closed source and sees which of your devices talk to which, including public IPs
• Client logs stream to Tailscale by default unless you opt out
• Payments are non-refundable and removing seats mid-month does not lower that month's bill
• No public audit report: SOC 2 Type II and third-party audits are only "available on request"

What Tailscale is, and what it is not

Every device you sign in gets the Tailscale client and joins your "tailnet", a private network tied to your identity provider account (Google, Microsoft, GitHub, Apple or any SSO provider). A coordination server run by Tailscale hands out public keys and tells devices how to find each other; the traffic itself goes directly between devices over WireGuard.

When two devices cannot reach each other directly - strict firewalls, double NAT, carrier-grade NAT on mobile networks - Tailscale first tries a peer relay (one of your own devices acting as a relay, generally available since February 18, 2026) and then falls back to its DERP relay servers. Tailscale's docs describe a DERP server as one that "blindly forwards already-encrypted traffic".

That design is why Tailscale is not a substitute for the consumer VPNs we usually review. A consumer VPN sends your browsing through a provider's server so websites see the provider's IP. Tailscale, in its own words, works differently: "If you use an exit node, they're your exit nodes, not ours." Route your traffic through an exit node at home and websites see your home IP. Route it through nothing and they see whatever network you are on.

Typical uses are reaching a NAS or Home Assistant box away from home, SSH into servers without opening ports, sharing a printer or media server with family, giving staff access to internal tools without a traditional VPN concentrator, and connecting cloud and Kubernetes workloads across providers.

Tailscale pricing in October 2026

Tailscale now sells four plans. All of them include unlimited user devices such as computers and phones; what changes is the number of users, access-control groups, servers and the business features.

• Personal - $0, "Free forever": up to 6 users, unlimited user devices, up to 3 ACL groups, up to 50 tagged resources, 1,000 minutes per month of ephemeral resources, "Access nearly all of Tailscale's features".
• Standard - $8 per user per month: unlimited users, SCIM user and group provisioning, up to 10 ACL groups, MDM configuration, device posture integrations with MDM, EDR and XDR tools, advanced roles for billing, IT and auditors.
• Premium - $18 per user per month (labelled "Most popular"): up to 300 ACL groups, 10,000 ephemeral minutes per month, just-in-time access, advanced Tailscale SSH, network flow logs, log streaming, regional routing and traffic steering, priority support.
• Enterprise - custom pricing: custom device quantities and limits, custom MSA and SLAs, custom tailnet subdomains, pay by invoice.

Servers, exit nodes and other machines that are tagged rather than owned by a person are counted as tagged resources: "50 tagged resources included; add more for $1/month each." Tailscale also says it is "currently not enforcing the hard limits or overages of ACL groups, multiple tailnets, tagged resources, and ephemeral resources", so today those limits are soft.

What changed with Pricing v4

CEO Avery Pennarun announced the change on April 8, 2026: "we're simplifying things by retiring Personal Plus (again) and making the free Personal plan more generous", and "we're moving to simple, predictable seat-based pricing for business plans... Starter becomes Standard". SCIM, device posture, user management APIs and webhooks became available on self-serve business plans.

The price of the entry business tier went up. Tailscale's FAQ says only that "we have slightly increased the price per seat" moving from Starter to Standard, while Premium's price point stayed the same. Third-party write-ups put the old Starter price at $6 per user per month on annual billing or $7 monthly; Tailscale itself does not state the old figure.

How far the free Personal plan goes

For individuals, families and homelabs the Personal plan is the headline. It went from 3 users to 6 in April 2026, devices per user are unlimited, and Tailscale says it gives access to "nearly all" of its features, including a taste of Tailscale SSH and the Kubernetes features. No billing details are needed: "If you're using the Personal plan, no billing details are needed."

The catch is the licence, not the limits. Personal is "only suitable for non-commercial use". Sign up with a public email domain such as Gmail and you land on Personal automatically; sign up with a custom company domain and you start a 14-day business trial with no user limit, after which you choose a paid plan.

• 6 users, each with unlimited phones and computers
• 3 ACL groups for access rules - enough to separate family, guests and servers
• 50 tagged resources for servers, exit nodes and subnet routers
• Basic Tailscale SSH on up to 5 hosts
• Non-commercial use only

Features that matter day to day

Tailscale's Basics feature group covers secure peer-to-peer connections, subnet routers and exit nodes, split tunneling and MagicDNS, zero-trust access control lists and peer relays. Infrastructure features include Tailscale SSH, Kubernetes ingress and egress, and Funnel, which publishes a service from your tailnet to the public internet.

MagicDNS

MagicDNS gives every device a stable name, so you type my-server instead of remembering a 100.x.y.z address. It is one toggle in the DNS page of the admin console and it is the feature that makes a tailnet feel like a home network.

Subnet routers and exit nodes

A subnet router lets devices without Tailscale - a printer, a camera, an old NAS - be reached through one machine that runs it. An exit node sends all of a device's internet traffic out through another device you own, which is useful on hotel or café Wi-Fi when you want your home connection instead of the local one.

Taildrop

Taildrop sends files between your own devices, across operating systems, using the system share sheet. On a Mac it appears as Tailscale in the Finder Share menu; on Windows and Linux it is available from the client.

Tailscale SSH

Tailscale SSH replaces SSH keys with tailnet identity and access rules. Basic Tailscale SSH is limited to 5 hosts; advanced Tailscale SSH, including recording and stricter re-authentication options, is a Premium feature.

Platforms

The Mullvad add-on: privacy VPN exit nodes

If you also want a conventional privacy VPN, Tailscale resells Mullvad's servers as exit nodes. The add-on costs "$5 Per month for every 5 devices" and the base add-on includes five licences, with more available.

• Personal plans can pay monthly or annually; Standard and Premium are monthly only; Enterprise goes through its account team
• Still labelled beta and needs Tailscale v1.48.2 or later
• "Tailscale knows which Mullvad accounts belong to which Tailscale users"
• "Mullvad does not receive user identity information from Tailscale"

That last pair matters. Mullvad's own service is built around anonymous account numbers; through Tailscale, your Tailscale identity is linked to the Mullvad account on Tailscale's side. For most people that is a fair trade for having everything in one client, but anyone choosing Mullvad specifically for anonymity is better served buying it directly. Our separate Mullvad review covers that route.

Privacy and security: what Tailscale can see

Tailscale is clear about what its servers handle. "Your devices' private encryption keys never leave their respective nodes, and our coordination server only collects and exchanges public keys." It cannot decrypt your traffic, including traffic that passes through its DERP relays: "the only data Tailscale could see and capture is encrypted."

What it does see is metadata: "We do receive metadata about which of your private nodes connect to which other private nodes, including public IP addresses." The control plane runs on Linux servers in AWS, coordination data is stored in SQLite and backed up to AWS S3, and analytics are kept in Snowflake. The privacy policy (effective August 25, 2026) says data is processed in Canada, Germany, the United States and the United Kingdom.

Client logs and how to turn them off

By default "each Tailscale agent in your distributed network streams its logs to a central log server (at log.tailscale.com)." You can opt out, which also disables telemetry, with a flag or environment variable - at the cost of Tailscale support being able to help you debug:

tailscaled --no-logs-no-support
# or
TS_NO_LOGS_NO_SUPPORT=true

Configuration audit logs are on for every tailnet and kept for 90 days. Network flow logs, which record which devices talked to which, are only available on Premium and Enterprise.

Tailnet Lock

Tailnet Lock, generally available since June 23, 2025, closes the obvious trust gap: with it enabled, a new device must be signed by keys on devices you trust, so even a compromised coordination server cannot quietly add a node to your network.

Audits and open source

Tailscale has completed a SOC 2 Type II certification and works with the security firm Latacora on audits, but those reports are "available on request" rather than published. Clients are open source where the operating system is open source; on closed systems the daemon is open source but the GUI is not. DERP relay code is open source; the coordination server is closed source.

What TailscaleUp 2026 added

At its late-August 2026 TailscaleUp event, Tailscale pushed well beyond networking. Network World summed it up as Tailscale expanding "from VPN into a full connectivity platform".

• Aperture, an AI gateway for managing access to AI models and tools, reached general availability on August 25, 2026, with some tokens included in new instances and MCP endpoints for Tailscale and Tailscale SSH.
• Tailscale PAM, built from its first acquisition, Border0, entered beta on August 26, 2026: "identity-aware, credential-free access to critical infrastructure" with just-in-time access and Slack approvals.
• DNS filtering by Control D, billed per user who needs it.
• A Tailnets API for creating networks on demand, and Tailcat, an open-source data plane that runs without Tailscale's control plane.
• Declarative Node Sharing on an alpha waitlist, plus new SDKs for Rust, Python, C, C++ and Elixir.

None of this changes what a home user gets on the free plan, but it shows where the company's money is going: businesses with AI workloads and infrastructure access problems, not consumer privacy.

Billing, trials and refunds

Business plans are billed per seat at the start of each month. Adding seats mid-month charges the prorated cost; removing seats "does not affect the cost for that month." Plans renew automatically and your card keeps being charged "unless and until you change your Plan or close your account".

Business sign-ups get a 14-day free trial with no user limit. Enterprise customers can pay by annual invoice, and Tailscale offers special pricing for eligible non-profits and educational institutions.

Who should use Tailscale, and who should buy a consumer VPN

Tailscale fits if you

• Want to reach home servers, NAS boxes, cameras or Home Assistant from anywhere without port forwarding
• Run a homelab or a handful of cloud servers and want SSH without exposing port 22
• Need a small team or family network for free, up to 6 people
• Run a company that wants zero-trust access to internal tools without a VPN appliance

Buy a consumer VPN instead if you

• Mainly want to hide your IP address from websites and your ISP
• Want servers in many countries for streaming or travel
• Have no devices of your own that need to talk to each other

Tailscale is built on WireGuard; our WireGuard protocol guide explains what that means for speed and security. And if you like the idea of Tailscale plus a privacy VPN, compare the Mullvad add-on with buying Mullvad directly.

The company behind it

Tailscale was started in 2019 by Avery Pennarun, David Crawshaw, David Carney and Brad Fitzpatrick. It is headquartered in Toronto but describes itself as a fully remote company. In April 2025 it raised $160 million in a Series C led by Accel, and it says more than 30,000 businesses use it, with customers including Duolingo, Instacart, Microsoft, Mistral, Nvidia and SAP.

Frequently asked questions

Is Tailscale free?

Yes, for personal use. The Personal plan is $0 for up to 6 users with unlimited devices each, 3 ACL groups and 50 tagged resources, and it needs no card. It is licensed for non-commercial use only.

How much does Tailscale cost per user?

Standard is $8 per user per month and Premium is $18 per user per month; Enterprise is quoted individually. Tagged resources beyond the included 50 cost $1 per month each. Tailscale does not publish an annual per-user price.

Can Tailscale hide my IP address like a normal VPN?

Not by itself. Exit nodes are your own devices, so websites see your home or server IP. To get a third-party IP you need the Mullvad add-on at $5 per month for every 5 devices, which is still in beta.

Can Tailscale see my traffic?

No. Traffic is end-to-end encrypted with WireGuard and private keys stay on your devices, so even traffic relayed through Tailscale's DERP servers is encrypted. Tailscale does see metadata about which of your devices connect to which, including their public IP addresses, and clients send logs to log.tailscale.com unless you opt out.

Does Tailscale offer refunds?

No. Its terms say payments are non-refundable except where the agreement states otherwise, and removing seats mid-month does not reduce that month's bill. Test on the free plan or the 14-day business trial before paying.

Can I self-host Tailscale?

Partly. The clients and DERP relays are open source, but Tailscale's coordination server is not. Headscale is a community-run open-source replacement for the coordination server; it works with the Tailscale clients but Tailscale does not support it.

What happened to Personal Plus and Starter?

Both were retired for new customers on April 8, 2026. Starter became Standard at a slightly higher per-seat price. Existing customers keep their current plan and price for at least 12 months, and legacy personal accounts can stay as they are for the foreseeable future.

Key takeaways

• Tailscale connects your own devices over WireGuard; it is not a consumer VPN that hides your IP.
• Since April 8, 2026 the free Personal plan covers 6 users with unlimited devices, for non-commercial use.
• Business plans are $8 (Standard) or $18 (Premium) per user per month; Personal Plus and Starter are gone.
• Tailscale cannot read your traffic but does see connection metadata and, by default, client logs.
• The Mullvad add-on adds privacy exit nodes for $5 per month per 5 devices; payments are non-refundable.