What Is Tailscale? How It Works and Is It Free (2026)

Tailscale is a mesh VPN, free for up to 6 users, that links your laptops, phones and servers into one private encrypted network built on WireGuard, with no ports to open and no config files to write. It is made for reaching your own machines from anywhere (NAS, home server, SSH), not for anonymous browsing: to hide your IP it needs an exit node.

This guide answers, in order, the questions people type into Google: what Tailscale does, how it works, what is free and what is paid, and how to use it like a normal VPN.

What will it cost you? Tailscale is free for 6 users but only for non-commercial use, Twingate and NetBird stop at 5 users, ZeroTier at 10 devices. Our free Tailscale pricing calculator takes your number of users and devices and shows the cheapest plan that fits at each service over 12 to 36 months, next to a self-hosted Headscale or NetBird server (prices checked 18 Oct 2026).

What is Tailscale, in one sentence?

Tailscale is a mesh VPN, built on WireGuard, that connects all your devices into a single private network with almost no setup. You install the app on each device, sign in with an existing account, and they can all reach each other securely - wherever they are in the world. It takes the fast, modern WireGuard protocol and removes the manual work that usually comes with it.

What does Tailscale actually do?

The definition above says what Tailscale is. People usually want to know what it does, which is a shorter answer: it gives every device you own a fixed private address that keeps working no matter which network the device is on.

Everything else follows from that one behaviour. In practice it does three things:

• It makes your devices reachable from each other. Your laptop can open your home NAS, your desktop, or a server you rent, from a café or another country, without opening a single port on your router.
• It keeps working when the network changes. The address does not change when you move from home Wi-Fi to mobile data. Connections survive the switch instead of breaking.
• It can route your internet traffic too, if you ask. By designating one device as an exit node, you can send your browsing through it - which is the part that resembles a traditional VPN, and the part that is off by default.

What it does not do is give you a menu of servers in other countries. That is the usual source of confusion, and it is covered further down.

(The name is written as one word. If you searched for "tail scale" in two words, you are in the right place - the product is Tailscale.)

How does Tailscale work?

Tailscale works in four steps: each device creates its own WireGuard key pair, the public keys are exchanged through Tailscale's coordination server, the devices find a path to each other through NAT (directly, or via an encrypted relay), and traffic then flows device to device over WireGuard. Here is what happens, in order, the first time you run tailscale up:

1. You sign in with an identity you already have. Google, Microsoft, GitHub, Apple or any OIDC provider. Tailscale stores no password of its own; the identity provider says who you are, and that identity decides which tailnet the device joins.
2. The device generates a WireGuard key pair locally. The private key never leaves the machine. Only the public key, plus the addresses where the device can be reached, is sent to the coordination server (the control plane at login.tailscale.com).
3. The coordination server hands out the map. Every device receives the public keys and reachable addresses of its peers, the access rules (ACLs) you wrote, a fixed private address in the 100.64.0.0/10 range, and a MagicDNS name such as nas.your-tailnet.ts.net.
4. The devices find a path to each other. Each one discovers its public address with STUN and tries to open a direct UDP connection by punching through the NAT. When both sides sit behind a strict NAT or CGNAT, traffic goes through a DERP relay instead, still encrypted end to end (the relay carries ciphertext it cannot read), and Tailscale keeps trying to switch to a direct path in the background.
5. Traffic flows over WireGuard, device to device. The coordination server never sees a packet of your data; it only handles keys, identity and the peer list.

The one thing to keep in mind: the coordination server is the piece you trust. It never carries your data, but it decides which public keys belong to your tailnet. If that bothers you, the open-source Headscale server replaces it on a machine you own, and the official Tailscale clients keep working unchanged.

What is Tailscale used for?

It shines whenever you need private access to your own machines:

• Reach a home server or NAS from anywhere, as if you were at home.
• Connect a small team's devices without a traditional corporate VPN.
• SSH into servers without exposing them to the public internet.
• Link cloud and home machines into one flat, private network.

This is different from a commercial VPN. If you want to compare the hands-on alternative, see our Tailscale vs raw WireGuard breakdown.

What is the difference between Tailscale and a normal VPN?

This trips people up, so it is worth being clear. A commercial VPN routes your traffic through a provider's servers to hide your IP and unblock streaming. Tailscale connects your own devices to each other privately. It is not built for anonymous browsing or watching another country's Netflix. It is built for secure, private access to the machines and services you own.

Mesh versus hub-and-spoke: the shape of the network

The table above compares what the two are for. The deeper difference is the topology, and it is what decides how your traffic actually moves.

A traditional VPN is hub and spoke. Every device dials the same concentrator, and everything you send crosses it, even a file going to the laptop on your own desk. That hub is a single place to configure, a single place to fail, and a detour measured in real milliseconds when the two machines are in the same room and the hub is in another country.

A mesh VPN is peer to peer. Each device holds a key for every other device and talks to it directly when the network allows it, using NAT traversal to punch a path through the routers in between. There is still a coordination server, but it distributes keys and addresses; it does not carry your packets. When traversal fails, and it does on some restrictive networks, traffic falls back to a relay and you get the hub-and-spoke behaviour again, slower but working.

Three consequences follow from the shape, not from the brand:

• Latency follows the real path between two devices, not the path to a concentrator.
• A mesh has no single choke point to size or to lose, but it does have a coordination service whose availability still matters.
• Adding a device is a key exchange, not a change to a central configuration.

What are the limits of Tailscale?

Tailscale is excellent, but it has trade-offs. You rely on its coordination servers and login for the control layer, so it is not fully self-contained - if that matters to you, the open-source Headscale server or plain WireGuard removes the dependency, with more setup. Pricing is per user, so it scales with team size. And because it is for private device access, it will not replace a commercial VPN for unblocking content. Pick it for what it is: the easiest way to wire your own devices together securely.

Is Tailscale free?

Short answer: yes for personal use, up to 6 users. Our dedicated page Is Tailscale free? The free plan limits goes through five common setups (family, homelab, freelancer, small team) and what each way past the free plan costs.

There is a free tier and it is unusually generous for personal use: the Personal plan covers up to 6 users with unlimited user devices, as long as the use stays non-commercial. A tailnet created with a company domain starts a trial and then needs a paid plan, billed per user rather than per device. Figures from tailscale.com/pricing, read on 18 October 2026; check them again before signing, the grid changes regularly.

Tagged resources (servers, exit nodes, subnet routers) are included up to 50 on paid plans, then $1 per month each. Three ways to pay nothing once you outgrow Personal: count the people who log in rather than the devices (a household of 4 with 20 machines stays free); self-host the control plane with Headscale, where the official Tailscale clients work, there is no user cap and the cost is the server, a Contabo VPS at about €5.50 per month (checked 17 Oct 2026) with our free Headscale config generator writing the configuration; or compare with the competition in our Tailscale pricing calculator, which gives the real cost of Tailscale, Twingate, NetBird and ZeroTier over 12 to 36 months for your numbers.

The distinction that matters more than the price: Tailscale is free in the sense that a coordination service is provided to you, not in the sense that you run everything yourself. Your traffic stays peer-to-peer, but the service that introduces your devices to each other is theirs. If you want that part on your own infrastructure too, that is precisely what Headscale exists for, an open-source reimplementation of the control plane you host yourself.

Why is Tailscale free, then? Tailscale explains it in its own post How our free plan stays free by CEO Avery Pennarun (read on 24 October 2026). Your data travels peer-to-peer between your devices, not through Tailscale's servers, so a free user costs very little to serve; and people who use it at home bring it to work, where companies pay per user. Tailscale's stated position is that your data is not the product. The free plan rests on that business model, which is one reason some home labs keep a self-hosted Headscale as a fallback.

Want the full breakdown, case by case (family, homelab, freelancer, 7th user)? Our guide Is Tailscale free? The free plan limits goes through each limit and what it costs to get past it.

Does Tailscale see my traffic?

No, in the normal case, and the reason is structural rather than a promise. Tailscale builds WireGuard tunnels directly between your devices, and the encryption keys never leave them: the coordination servers exchange public keys and connection information, not payloads. What Tailscale can see is metadata, which devices exist, when they connect, what addresses they advertise.

There is one nuance worth knowing rather than discovering. When two devices sit behind network setups that refuse a direct connection, traffic falls back to a DERP relay operated by Tailscale. That relay carries the encrypted tunnel; it cannot read inside it, because the keys are still only on your devices. So the honest statement is: relays can see that you are talking and how much, never what you are saying.

Tailscale vs a VPN app, in one distinction

The confusion behind most "which should I use" questions is that the word VPN covers two unrelated jobs.

A commercial VPN app gives you someone else's IP address. That is what makes geo-unblocking and hiding your address from a website work, and it is the entire product. Tailscale gives you your own devices, reachable from anywhere, as if they shared a private network. It does not hide you from websites, you still exit through whichever network you are on, unless you deliberately route through an exit node you control.

So the question is not which is better. It is which job you have. Reaching your NAS from a hotel is Tailscale. Watching a service that is not available where you are is a commercial VPN. Wanting both means running both, and that is a normal setup, not a compromise.

What surprises people first about Tailscale?

Three things account for most of the early friction, and none is a defect:

• Every device needs the client. There is no server-side switch that puts a machine on your network. Anything you want reachable has to run Tailscale, which is why a printer or an old NAS often ends up behind a subnet router instead.
• The IP addresses look unfamiliar. Devices get an address in the 100.x range, not your home LAN range. That is deliberate, it avoids clashing with whatever local network you happen to be on, but it does mean bookmarks to 192.168.x addresses will not work from outside.
• Access is open by default. A fresh network lets every device reach every other one. That is fine for personal use and wrong for anything shared; ACLs exist for exactly that, and they are worth writing before you invite anyone.

Can Tailscale hide your IP like a normal VPN?

Yes, on one condition: you give it an exit. Tailscale has no browsing servers of its own. To make your internet traffic leave somewhere other than the network you are on, you designate one device in your tailnet as an exit node, and your other devices browse with that node's IP. There are three ways to do it, and they do not do the same job:

A VPS is the usual pick when you want an exit that depends neither on your router nor on the power at home. Setup takes about ten minutes: install Tailscale on the server, enable IP forwarding (net.ipv4.ip_forward = 1), run sudo tailscale set --advertise-exit-node, then approve the node in the admin console. Every command and the check that it works are in our complete Tailscale exit node guide. The same server can later run Headscale if you also want to stop depending on the coordination servers.

The bottom line

Tailscale is the simplest path to a private network of your own devices. It takes WireGuard's speed and security and hides the complexity, so connecting a laptop, a phone and a server takes minutes instead of an evening. It is not an anonymity tool - it is a private-access tool - and for that job, it is hard to beat.

A VPN changes your IP. It does not change your browser.

A tunnel replaces the address a service sees. It changes nothing about what your browser announces on its own - fonts, screen, time zone, graphics stack - and that combination is often stable enough to recognise you across sessions, tunnel or no tunnel.

Measure your own browser fingerprint - passive, no questions, no account, no email.

Keep the commands at hand: our free Tailscale & Headscale Cheat Sheet (4-page PDF, direct download, no sign-up) gathers status and ping, exit node, subnet router, Serve and Funnel, the Headscale config, users, keys and ACLs, and the usual failure causes. Download the cheat sheet.

Related guides

• Tailscale Funnel: the one-word difference that puts your app on the public internet
• Tailscale exit node: the complete guide on a VPS
• Tailscale vs Headscale: managed SaaS or a self-hosted control server
• Tailscale subnet router: reach the printer or NAS without a client

If you would rather run the endpoint yourself than depend on a coordination service, our cheapest-VPS comparison covers the entry-level plans that suffice.