What is Tailscale?
Tailscale connects devices and services into a private encrypted network rather than routing everything through a central VPN gateway. It builds a peer-to-peer mesh, called a tailnet, over the open-source WireGuard protocol, so devices talk to each other directly and traffic does not have to pass through a single choke point. Access is identity-based, meaning policies are attached to users and groups rather than to IP addresses, and connections cross firewalls and NAT without port forwarding. It can also be used like a traditional VPN by routing all traffic through an exit node. The free Personal plan covers up to six users with unlimited devices but is for non-commercial use only. It suits people who want their own devices and servers reachable from anywhere without running a VPN server.
Verified product facts
- Type
- VPN clientEditorially reviewed
- Platform
- macOS
- Pricing
- FreemiumDeveloper-stated
- Developer
- TailscaleDeveloper-stated
- Relationship to Nuanyue
- Third-party product — not published by NuanyueEditorially reviewed
- Licence
- BSD-3-Clause
- Current version
- 1.102.4Developer-stated
- Official website
- tailscale.com/
Last updated . Facts marked developer-stated come from the developer and are not independently confirmed; editorially reviewed marks a Nuanyue judgement.
Key features
What Tailscale does at a glance.
Peer-to-peer mesh network (a tailnet) instead of a central gateway
Built on the open-source WireGuard protocol
With encrypted point-to-point connections
Zero Trust access policies attached to identity rather than IP address
Works across firewalls and NAT
Without port forwarding or firewall rules
Exit nodes let you route all traffic like a traditional VPN
Tailnet Lock
For additional protection of the network's control plane
Cross-platform and infrastructure agnostic
Direct device-to-device paths
The vendor states improves throughput and latency
What you can use Tailscale for
- Reaching your own machines and servers from anywhere without running a VPN server
- Connecting a distributed team to internal resources without exposing them publicly
- Linking devices across cloud providers into one private network
- Giving a homelab or media server a stable private address
Who is Tailscale for?
- Individuals and small teams who want their devices on one private network
- Organisations that need identity-based access instead of IP-based firewall rules
Who is Tailscale not for?
- Anyone who needs a paid plan's feature set on the free tier — Personal is limited to 6 users and is non-commercial only
- Users who need the whole stack auditable, since the GUI clients and the coordination service are not open source
Limitations
- The free Personal plan is for non-commercial use only and caps users at 6
- The GUI wrappers for macOS, iOS and Windows are not open source, even though the daemon and CLI are
- Running the service requires the vendor's coordination server; it is not a self-hosted-only product
- Apple Silicon support is not stated in the sources Nuanyue tracks
Strengths and trade-offs
What Tailscale does well, and what to weigh before choosing it. Points marked developer-stated come from the developer’s own material and have not been independently confirmed.
Strengths
- Connects devices peer to peer over WireGuard, so traffic can flow directly instead of through a central gateway.Developer-stated
- Uses identity-based access policies rather than IP-based firewall rules.Developer-stated
- Crosses firewalls and NAT without port forwarding or manual firewall configuration.Developer-stated
- Can route all traffic through an exit node, behaving like a conventional VPN when that is wanted.Developer-stated
- The free Personal plan allows unlimited user devices, which is unusual among connectivity products.
Trade-offs
- The free Personal plan is restricted to non-commercial use, so a business cannot run on it.
- The macOS, iOS and Windows GUI wrappers are not open source, so the client you install is not fully auditable even though the daemon is.
- It depends on Tailscale's hosted coordination service rather than being self-hosted only.Derived
First-use experience
What the app asks of you when you set it up. Only established facts appear here; anything we could not confirm is left out rather than guessed at.
- Installation
- A signed macOS package is published on the vendor's package server, or the App Store build can be used.
- First launch Developer-stated
- Sign in to an identity provider on each device; authenticating two or more devices creates a tailnet with a default allow-all policy.
- System integration Developer-stated
- Runs a background daemon (tailscaled) that manages the network, with a menu bar control for the GUI client.
What it does
Tailscale puts your devices on one private network without a VPN server to configure. Each device gets an encrypted, authenticated connection to the others over WireGuard, and because the connections are peer to peer the traffic does not have to funnel through a single gateway. Access is decided by identity — who the user is and what group they belong to — rather than by which IP address they arrive from.
How it differs from a traditional VPN
A conventional VPN has a hub: clients connect to it and it relays everything. That design concentrates traffic, which adds latency and creates a single point of failure. Tailscale’s mesh, which the project calls a tailnet, lets devices connect directly to each other, and the vendor states this improves both throughput and latency. Connections traverse firewalls and NAT without port forwarding.
When a traditional VPN shape is wanted anyway — sending all your traffic out through one location — an exit node provides it.
Pricing and open source
The free Personal plan covers up to six users with unlimited user devices, three ACL groups and fifty tagged resources, and is explicitly limited to non-commercial use. Standard is $8 per user per month and Premium $18 per user per month; Enterprise is quoted. Extra tagged resources cost $1 per month each.
The project publishes most of its source, including the tailscaled daemon and
the tailscale CLI, but the GUI wrappers for macOS, iOS and Windows are not open
source, so the application you install is not fully auditable. Running the
service also depends on Tailscale’s hosted coordination server.
Questions about Tailscale
Is Tailscale free?
There is a free tier. The Personal plan is $0 and free forever for up to 6 users with unlimited user devices, 3 ACL groups and 50 tagged resources, but it is licensed for non-commercial use only. Paid plans start at $8 per user per month.
How is Tailscale different from a traditional VPN?
A traditional VPN routes traffic through a central gateway. Tailscale builds a peer-to-peer mesh, so devices connect directly to each other, which the vendor states gives higher throughput and lower latency and avoids a single point of failure. It can still be used as a traditional VPN through an exit node.Developer-stated
What protocol does Tailscale use?
It uses the open-source WireGuard protocol to create encrypted point-to-point connections between devices on your private network.Developer-stated
Is Tailscale open source?
Partly. The repository contains the majority of Tailscale's open source code, including the tailscaled daemon and the tailscale CLI. However, the GUI wrappers for macOS, iOS and Windows are not open source.
Alternatives to Tailscale
Apps that could replace this one — the same job, a different trade-off.
Tunnelblick
Free, open-source graphic user interface for OpenVPN on OS X.
Both connect a Mac to a private network, but Tunnelblick is an OpenVPN client for a conventional VPN server while Tailscale creates the mesh itself without a server to run.
Competitors
Direct competitors: overlapping features aimed at the same users.
Cloudflare WARP
Free client that encrypts device traffic through Cloudflare's network.
Both provide identity-aware private network access without a conventional VPN concentrator, but Tailscale builds a peer-to-peer mesh while WARP routes through Cloudflare's network.
Similar apps
Related in purpose, but not a straight swap.
Mullvad VPN
Flat-rate privacy VPN with anonymous accounts and no logging.
Both build encrypted tunnels and both offer WireGuard, but Mullvad is an anonymity VPN that hides your traffic from a destination while Tailscale is for reaching your own private resources.
Links
Sources
Facts on this page are checked against the sources below. Last updated .
- Tailscale — official websiteGrade B
- Tailscale — developer websiteGrade B
- Tailscale — documentationGrade C
- Tailscale — source repositoryGrade D
