Is Tailscale free? What the plans cover

Is Tailscale free? Yes, on the Personal plan

Tailscale is free on the Personal plan. The free tier has no expiry date and it includes most of the product. It limits how many people can join your network, not how many machines you connect. Checked on 17 August 2026, Tailscale's pricing page gives Personal six users, unlimited user devices, 50 tagged resources, and access to nearly every feature.

Two words first. A tailnet is your private network: one account, one user list, one policy file. A seat is one person inside that tailnet. Tailscale bills per seat, so the meter runs on people. That single fact decides whether your setup is free.

Every figure below is a published number with the date it was checked. Prices and allowances move, so confirm them on the pricing page before you plan a budget around them. The structure moves much more slowly, and the structure is the useful part: people and tagged infrastructure are counted, while the paid tiers sell capabilities rather than a bigger device allowance. WireGuard, the tunnel protocol underneath, is the same on every plan, and what Tailscale adds on top of plain WireGuard explains that split.

What counts as a user, and what counts as a device

Every machine in a tailnet is owned by something. Log in with your own identity and the machine is owned by you. Tailscale calls that a user device, and the pricing FAQ is blunt about it: "User devices are free and unlimited." Your laptop, your phone, your desktop and your tablet are one seat between them, not four.

Register a machine with a tag instead and it is owned by the tag. Tailscale calls that a tagged resource, and tagged resources are what the plan counts. Servers and routers are meant to be tagged, because a shared machine should not belong to whoever happened to run the login command on it. As of 17 August 2026 the Personal plan includes 50 tagged resources, and the pricing page lists extra ones at 1 US dollar per month each, bought self-serve. A VPS doing a job for everybody belongs in this category, whether it is a subnet router advertising a private range or an exit node carrying outbound traffic.

Tag a server at the moment it joins, because changing ownership later means re-authenticating the node:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --advertise-tags=tag:server

tailscale status

tailscale status lists the node with the owner it registered under. The tag must already exist in your tailnet policy file under tagOwners, because a tag is an ownership grant and a node cannot claim one that nobody granted. If the tag is not in the policy, the command is refused and the node never joins.

This is why the free plan surprises people in both directions. A homelab with thirty machines all signed in as you is one seat, and it is free. A four person team where everyone signs in is four seats of six, still free. Twelve people is not free at any device count, because the cap counts people.

Ephemeral resources are the third category. A node that registers with an ephemeral auth key, such as a continuous integration runner or a Kubernetes pod, deletes itself when it stops and draws from a monthly pool of minutes instead of holding a resource slot. Personal had 1,000 of those minutes per month on 17 August 2026 and Premium had 10,000. A node that stays up past four hours stops counting as ephemeral and becomes an ordinary tagged resource.

One more billing detail: an invited user does not take a seat until they use the tailnet. The pricing FAQ states that a user "does not occupy a seat until they first log in to the admin console or when they first authenticate a device". You can send invitations early without paying for people who never arrive.

What the paid plans cost

[
  {
    "plan": "Personal",
    "usd_per_user_month": 0
  },
  {
    "plan": "Standard",
    "usd_per_user_month": 8
  },
  {
    "plan": "Premium",
    "usd_per_user_month": 18
  }
]

Personal is free. Standard is 8 US dollars per user per month and Premium is 18, both as published on 17 August 2026. Enterprise is quoted by sales with custom user counts and limits. Standard and Premium remove the user cap, so for most teams the seventh person is the reason they start paying, not the fortieth server.

Which features sit behind a paid tier

These are capability gates. Adding machines does not push you up a tier. Writing a more complicated access policy does.

Access control lists (ACLs, the rules that decide which user may reach which machine) show this clearly. The policy file itself is on every plan. The number of groups you may define in it is not.

[
  {
    "plan": "Personal",
    "acl_groups": 3
  },
  {
    "plan": "Standard",
    "acl_groups": 10
  },
  {
    "plan": "Premium",
    "acl_groups": 300
  }
]

Personal allows 3 groups, Standard 10, and Premium 300. A group is a named set of users, so this is really a ceiling on how finely you can divide people. Three groups covers "me", "family" and "guests". It does not cover a company with departments.

The other gates listed on the same page, checked on the same day:

• Bringing your own identity provider (IdP), which means single sign-on (SSO) with any provider you already run, starts at Standard. Personal signs you in with the consumer identity providers Tailscale supports directly.
• Network flow logs, device approval and device posture checks start at Standard.
• Advanced user roles start at Premium, as does advanced Tailscale SSH. Basic Tailscale SSH on Personal is capped at 5 hosts.

SSH session recording is the case worth reading carefully, because it proves these gates are set per feature and not by tier order. Tailscale's session recording documentation lists the feature for the Personal and Enterprise plans, while the pricing page groups it under a separately purchased Privileged Access Management extension. It also needs a recorder node that you run and store the recordings on. Check the current page before you build a compliance requirement on top of it.

Why a free tailnet says "Reached use limit"

The admin console shows "Reached use limit" when the tailnet hits a plan ceiling. On Personal the usual cause is the seventh person, because the plan counts people. The other candidate is tagged resources past the included allowance. Neither one is about how many laptops and phones are connected, so counting devices when you see this message wastes time. Open the admin console and count human accounts first, tagged machines second.

Do you need a paid plan for a custom DERP relay?

DERP (Designated Encrypted Relay for Packets) is Tailscale's relay network. When two nodes cannot open a direct connection through NAT (network address translation), their encrypted traffic falls back to a DERP server. Running your own DERP relay is configuration in the tailnet policy file, and Tailscale's documentation on custom DERP servers lists no plan restriction as of 17 August 2026.

Be precise about what a custom relay changes, because this is where relaying gets confused with self-hosting. A custom DERP server moves the fallback data path onto a machine you own. The control path does not move. Tailscale's coordination server still holds your node keys, your policy file and your user list. If you want that part on your own hardware, a relay is the wrong tool. You need a different control plane.

When does a self-hosted Headscale control plane make sense?

Headscale, the open source Tailscale control server replaces the coordination server with one you run on a VPS (virtual private server). The Tailscale clients do not change. They point at your server instead of Tailscale's, so there are no seats to buy and no user cap.

Start with the money, because the gap is smaller than people expect. One Standard seat is 8 US dollars per month. A small VPS that can run a control plane costs about what one or two seats cost. So the sum does not change sign until you are paying for several people, and it never changes sign for a solo homelab, which was free already. Self-hosting to save money on a five device network does not work out.

The real trade is control against work. Headscale puts your user list and your policy file on a machine you own, in a country you chose, with no vendor account in the path. Per the project documentation checked on 17 August 2026, it supports ACLs and grants, tags, subnet routers, exit nodes, MagicDNS, Taildrop, Tailscale SSH, node registration over OpenID Connect (OIDC), and an embedded DERP server. Funnel and Serve are listed as work in progress, so publishing a service with Serve or Funnel stays on Tailscale's own control plane for now. Network flow logs are absent too, OIDC groups cannot be used inside ACL rules, and the project is scoped to a single tailnet by design.

Here is the work you take on:

• You own the availability of the control plane. Existing tunnels keep passing traffic for a while, because the peers already hold each other's keys. Everything that needs coordination stops: new nodes cannot register, expiring keys cannot be renewed, and policy changes never reach the nodes.
• You own the upgrades. Headscale implements a protocol that Tailscale's clients keep changing, so your upgrade schedule follows their client releases rather than your calendar.
• You own the database and its backups. Lose that state and every node must register again.
• You own TLS (transport layer security) on the server's public endpoint, because clients reach the control server over HTTPS.

That is the honest bill. Take it when the reason is control or a user count that per-seat pricing handles badly. Do not take it to save eight dollars.

A self-hosted NetBird server is the other self-hostable answer. It ships its own control plane, its own identity handling and its own web interface, and it is built as a product rather than as a reimplementation of somebody else's control server. Both options leave you running a service that your network depends on. Decide that you want to run one, then pick.

FAQ

Is the Tailscale free plan a trial?

No. Personal is a free tier with no expiry. Checked on 17 August 2026 it carries six users, unlimited user devices and 50 tagged resources, and it includes nearly all of the feature set. What it does not carry are the capabilities the paid tiers sell, such as more ACL groups and single sign-on with your own identity provider. Confirm today's numbers on Tailscale's pricing page, because allowances get revised.

How many devices can I add on the Tailscale free plan?

Your own devices are unlimited. Tailscale's pricing FAQ says user devices, meaning any node that is not tagged, are free and unlimited. What gets counted is tagged resources, the servers and routers you register with a tag, and Personal included 50 of those on 17 August 2026. Older guides quoting a 20 device or 100 device cap are describing a previous pricing model that no longer applies.

Why does my tailnet say "Reached use limit"?

The tailnet has hit a ceiling on its plan. On Personal the usual cause is a seventh person, because the plan counts people rather than machines. The other candidate is tagged resources beyond the included allowance. Count human accounts in the admin console first, then count tagged machines. Untagged laptops and phones are not the cause.

Is Headscale cheaper than paying for Tailscale?

Only above a few paid seats. A VPS able to run Headscale costs roughly what one or two Standard seats cost per month, so a small tailnet saves nothing and a solo tailnet was free to begin with. Headscale pays off when you want the control plane on hardware you own, or when your user count makes per-seat pricing awkward. The price is operational: upgrades that follow Tailscale client releases, database backups, a TLS certificate you renew, and being the only person who can fix an outage.