If you have ever wanted your laptop, phone and home server to reach each other securely from anywhere - without opening ports or wrestling with config files - Tailscale is probably the tool you were looking for. It is a mesh VPN that makes your own devices act like they are on one private network. This guide explains what Tailscale is, how it works, and where it fits.
What is Tailscale, in one sentence?
Tailscale is a mesh VPN, built on WireGuard, that connects all your devices into a single private network with almost no setup. You install the app on each device, sign in with an existing account, and they can all reach each other securely - wherever they are in the world. It takes the fast, modern WireGuard protocol and removes the manual work that usually comes with it.
A VPN changes your IP. It does not change your browser.
A tunnel replaces the address a service sees. It changes nothing about what your browser announces on its own - fonts, screen, time zone, graphics stack - and that combination is often stable enough to recognise you across sessions, tunnel or no tunnel.
Measure your own browser fingerprint - passive, no questions, no account, no email.
What does Tailscale actually do?
The definition above says what Tailscale is. People usually want to know what it does, which is a shorter answer: it gives every device you own a fixed private address that keeps working no matter which network the device is on.
Everything else follows from that one behaviour. In practice it does three things:
- It makes your devices reachable from each other. Your laptop can open your home NAS, your desktop, or a server you rent, from a café or another country, without opening a single port on your router.
- It keeps working when the network changes. The address does not change when you move from home Wi-Fi to mobile data. Connections survive the switch instead of breaking.
- It can route your internet traffic too, if you ask. By designating one device as an exit node, you can send your browsing through it - which is the part that resembles a traditional VPN, and the part that is off by default.
What it does not do is give you a menu of servers in other countries. That is the usual source of confusion, and it is covered further down.
(The name is written as one word. If you searched for "tail scale" in two words, you are in the right place - the product is Tailscale.)
How does Tailscale work?
Raw WireGuard is powerful but fiddly: you generate keys, edit config files, and open firewall ports for every device. Tailscale automates all of that. It manages the keys, helps your devices find each other, and builds direct, encrypted connections between them - a mesh, where each device talks straight to the others rather than through a central hub.
There is one important nuance. Tailscale runs coordination servers that handle the setup - exchanging keys and your login - but your actual traffic does not flow through them. The data goes directly between your devices, encrypted end to end.
What is Tailscale used for?
It shines whenever you need private access to your own machines:
- Reach a home server or NAS from anywhere, as if you were at home.
- Connect a small team's devices without a traditional corporate VPN.
- SSH into servers without exposing them to the public internet.
- Link cloud and home machines into one flat, private network.
This is different from a commercial VPN. If you want to compare the hands-on alternative, see our Tailscale vs raw WireGuard breakdown.
What is the difference between Tailscale and a normal VPN?
| Tailscale (mesh VPN) | Commercial VPN | |
|---|---|---|
| What it connects | Your own devices, to each other | Your device, to a provider's server |
| What it is for | Private access to machines and services you own | Hiding your IP, reaching geo-blocked services |
| Where traffic goes | Directly between your devices where possible | Through the provider, always |
| Anonymous browsing | Not what it does | That is the point |
| Who runs the exit | You do | The provider does |
This trips people up, so it is worth being clear. A commercial VPN routes your traffic through a provider's servers to hide your IP and unblock streaming. Tailscale connects your own devices to each other privately. It is not built for anonymous browsing or watching another country's Netflix. It is built for secure, private access to the machines and services you own.
Mesh versus hub-and-spoke: the shape of the network
The table above compares what the two are for. The deeper difference is the topology, and it is what decides how your traffic actually moves.
A traditional VPN is hub and spoke. Every device dials the same concentrator, and everything you send crosses it, even a file going to the laptop on your own desk. That hub is a single place to configure, a single place to fail, and a detour measured in real milliseconds when the two machines are in the same room and the hub is in another country.
A mesh VPN is peer to peer. Each device holds a key for every other device and talks to it directly when the network allows it, using NAT traversal to punch a path through the routers in between. There is still a coordination server, but it distributes keys and addresses; it does not carry your packets. When traversal fails, and it does on some restrictive networks, traffic falls back to a relay and you get the hub-and-spoke behaviour again, slower but working.
Three consequences follow from the shape, not from the brand:
- Latency follows the real path between two devices, not the path to a concentrator.
- A mesh has no single choke point to size or to lose, but it does have a coordination service whose availability still matters.
- Adding a device is a key exchange, not a change to a central configuration.
What are the limits of Tailscale?
Tailscale is excellent, but it has trade-offs. You rely on its coordination servers and login for the control layer, so it is not fully self-contained - if that matters to you, the open-source Headscale server or plain WireGuard removes the dependency, with more setup. Pricing is per user, so it scales with team size. And because it is for private device access, it will not replace a commercial VPN for unblocking content. Pick it for what it is: the easiest way to wire your own devices together securely.
See Proton VPN →Tailscale links your own devices, not anonymous browsing. If hiding your IP and unblocking content is what you actually need, Proton VPN is an audited, no-log, Swiss commercial VPN.→Is Tailscale free?
There is a free tier and it is unusually generous for personal use: it covers a single user with a meaningful number of devices, which is enough for most people linking a laptop, a phone and a home server. Paid plans start where teams, shared access and admin controls begin.
The distinction that matters more than the price: Tailscale is free in the sense that a coordination service is provided to you, not in the sense that you run everything yourself. Your traffic stays peer-to-peer, but the service that introduces your devices to each other is theirs. If you want that part on your own infrastructure too, that is precisely what Headscale exists for, an open-source reimplementation of the control plane you host yourself.
Does Tailscale see my traffic?
No, in the normal case, and the reason is structural rather than a promise. Tailscale builds WireGuard tunnels directly between your devices, and the encryption keys never leave them: the coordination servers exchange public keys and connection information, not payloads. What Tailscale can see is metadata, which devices exist, when they connect, what addresses they advertise.
There is one nuance worth knowing rather than discovering. When two devices sit behind network setups that refuse a direct connection, traffic falls back to a DERP relay operated by Tailscale. That relay carries the encrypted tunnel; it cannot read inside it, because the keys are still only on your devices. So the honest statement is: relays can see that you are talking and how much, never what you are saying.
Tailscale vs a VPN app, in one distinction
The confusion behind most "which should I use" questions is that the word VPN covers two unrelated jobs.
A commercial VPN app gives you someone else's IP address. That is what makes geo-unblocking and hiding your address from a website work, and it is the entire product. Tailscale gives you your own devices, reachable from anywhere, as if they shared a private network. It does not hide you from websites, you still exit through whichever network you are on, unless you deliberately route through an exit node you control.
So the question is not which is better. It is which job you have. Reaching your NAS from a hotel is Tailscale. Watching a service that is not available where you are is a commercial VPN. Wanting both means running both, and that is a normal setup, not a compromise.
What surprises people first about Tailscale?
Three things account for most of the early friction, and none is a defect:
- Every device needs the client. There is no server-side switch that puts a machine on your network. Anything you want reachable has to run Tailscale, which is why a printer or an old NAS often ends up behind a subnet router instead.
- The IP addresses look unfamiliar. Devices get an address in the 100.x range, not your home LAN range. That is deliberate, it avoids clashing with whatever local network you happen to be on, but it does mean bookmarks to 192.168.x addresses will not work from outside.
- Access is open by default. A fresh network lets every device reach every other one. That is fine for personal use and wrong for anything shared; ACLs exist for exactly that, and they are worth writing before you invite anyone.
The bottom line
Tailscale is the simplest path to a private network of your own devices. It takes WireGuard's speed and security and hides the complexity, so connecting a laptop, a phone and a server takes minutes instead of an evening. It is not an anonymity tool - it is a private-access tool - and for that job, it is hard to beat.
Related guides
If you would rather run the endpoint yourself than depend on a coordination service, our cheapest-VPS comparison covers the entry-level plans that suffice.
★ Nuremberg GDPR datacenter · ✓ Dedicated IPv4 included · 200+ Mbps guaranteed
Self-host your VPN on your own VPS → ContaboFull root access · public IPv4 · pick your region→
