Tailscale free na? Limits for free Personal plan

Tailscale free na? Yes, for Personal plan

Tailscale free na for Personal plan. The free tier no get expiry date, and e include most of the product. E limit how many people fit join your network, no be how many machines you connect. As we check am on 10 October 2026, Tailscale pricing page show say Personal plan get six users, unlimited user devices, 50 tagged resources, and access to nearly every feature.

Make we explain two words first. A tailnet na your private network: one account, one user list, and one policy file. A seat na one person inside that tailnet. Tailscale dey charge per seat, so na people dem dey count. This one fact decide whether your setup go remain free.

Every figure below na published number, with the date wey we check am. Prices and allowances fit change, so confirm dem for the pricing page before you plan budget around dem. The structure dey change much more slowly, and na the structure be the useful part: dem dey count people and tagged infrastructure, while paid tiers dey sell capabilities instead of bigger device allowance. WireGuard, the tunnel protocol wey dey underneath, na the same for every plan, and wetin Tailscale add on top plain WireGuard explain that difference.

Wetin count as user, and wetin count as device

Everything wey dey inside tailnet get owner. If you log in with your own identity, na you own the machine. Tailscale dey call am user device, and the pricing FAQ talk am clearly: "User devices are free and unlimited." Your laptop, phone, desktop, and tablet na one seat together, no be four.

If you register machine with tag instead, na the tag own am. Tailscale dey call am tagged resource, and na tagged resources plan dey count. Servers and routers suppose use tags, because shared machine no suppose belong to whoever run the login command first. As of 10 October 2026, Personal plan get 50 tagged resources, and pricing page list extra ones as 1 US dollar per month each, wey you fit buy self-serve. VPS wey dey do work for everybody belong to this category, whether na subnet router wey dey advertise private range or exit node wey dey carry outbound traffic.

Tag server as e join, so e no go ever dey inside tailnet as machine wey you own:

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --advertise-tags=tag:server

tailscale status

tailscale status list the node together with the owner wey register am under. The tag must already dey inside your tailnet policy file for tagOwners, because tag na ownership grant, and node no fit claim tag wey nobody grant. If tag no dey inside policy, node no fit take am.

Na why free plan dey surprise people for both sides. Homelab wey get thirty machines, all of dem signed in as you, na one seat, and e free. Team of four people wey everybody sign in na four seats out of six, and e still free. Twelve people no be free, no matter how many devices dem get, because na number of people the cap dey count.

Ephemeral resources na the third category. Node wey register with ephemeral auth key, like continuous integration runner or Kubernetes pod, go delete itself when e stop, and e go use monthly pool of minutes instead of holding resource slot. As of 10 October 2026, Personal and Standard get 1,000 of those minutes every month, while Premium get 10,000. Node wey remain active pass four hours stop counting as ephemeral and become normal tagged resource.

One more billing detail: invited user no go take seat until e use the tailnet. The pricing FAQ talk say user "does not occupy a seat until they first log in to the admin console or when they first authenticate a device". You fit send invitations early without paying for people wey never show.

Wetin paid plans cost

[
  {
    "plan": "Personal",
    "usd_per_user_month": 0
  },
  {
    "plan": "Standard",
    "usd_per_user_month": 8
  },
  {
    "plan": "Premium",
    "usd_per_user_month": 18
  }
]

Personal free. Standard na 8 US dollars per user per month, while Premium na 18, as dem publish am on 10 October 2026. Enterprise na sales team go quote am based on custom user counts and limits. Standard and Premium remove the user cap, so for most teams, na the seventh person make dem start to pay, no be the fortieth server. To turn those list prices into real monthly bill, add seats and tagged resources together. one worked breakdown of household and five-person team show how both cases work.

Wetin features dey behind paid tier

These ones na capability gates. If you add more machines, e no go move you enter another tier. But if you write access policy wey more complex, e fit.

Access control lists (ACLs), wey be the rules wey decide which user fit reach which machine, show this matter clearly. The policy file dey for every plan. But the number of groups wey you fit define inside am no dey the same.

[
  {
    "plan": "Personal",
    "acl_groups": 3
  },
  {
    "plan": "Standard",
    "acl_groups": 10
  },
  {
    "plan": "Premium",
    "acl_groups": 300
  }
]

Personal allow 3 groups, Standard allow 10, and Premium allow 300. Group na named set of users, so this one really mean the maximum level wey you fit use divide people into separate groups. Three groups fit cover "me", "family" and "guests". E no fit cover company wey get different departments.

The other gates, wey dem check on 10 October 2026 against the pricing page and Tailscale feature documentation:

• Bringing your own identity provider (IdP), wey mean single sign-on (SSO) with any OIDC provider wey you already dey run, dey for every plan, including Personal. Tailscale remove the paid-plan restriction for April 2024 and talk say "SSO is once again available for free for everyone." The custom OIDC setup need proof say na you own the domain and a provider wey meet the technical requirements, no be proof of plan. Wetin Standard add for identity side na SCIM, wey provision users and groups from that provider automatically.
• Device approval and basic device posture checks (operating system and Tailscale version) dey for every plan. Posture integrations with mobile device management (MDM) and endpoint security tools start from Standard.
• Advanced user roles, like billing admin, IT admin and auditor, start from Standard.
• Network flow logs start from Premium. Advanced Tailscale SSH also start from Premium. Basic Tailscale SSH dey for every plan, and the pricing comparison list am as up to 5 hosts.

SSH session recording na the case wey you need read well, because e prove say dem set these gates per feature, no be according to tier order, and say dem fit change. Tailscale session recording documentation list the recorder-based feature for Personal and Enterprise plans, but as of 10 October 2026 e mark that feature as deprecated: Tailscale no longer offer am through tsrecorder, support for existing users go end for August 2027, and the docs point to Tailscale PAM instead. The pricing page group SSH, Kubernetes and database recording under that separately purchased Privileged Access Management extension. Check the current page before you build compliance requirement on top of am.

Why free tailnet dey talk say “Reached use limit”

Admin console go show “Reached use limit” when tailnet no fit add another user. Tailscale message reference, wey dem check on 10 October 2026, list three causes: you don add more users than the plan allow, account no update properly after plan change, or organization policy limit access to the tailnet. For Personal, the usual cause na the seventh person, because the plan dey count people. Standard and higher plans no get user cap. So if na paid plan, this message usually mean say account configuration get problem. Tailscale documented fix na to contact its support. If you sign in with company domain, ask your IT administrator whether policy dey restrict Tailscale sign-ins. None of these causes depend on how many laptops and phones dey connected. So counting devices when you see this message na waste of time. Open admin console and count human accounts first.

Pikin paid plan you need for custom DERP relay?

DERP (Designated Encrypted Relay for Packets) na Tailscale relay network. When two nodes no fit open direct connection through NAT (network address translation), their encrypted traffic go fall back to DERP server. To run your own DERP relay, you go configure am for tailnet policy file. As of 10 October 2026, Tailscale documentation for custom DERP servers no list any plan restriction. The same page still mark custom DERP servers as alpha.

You need understand exactly wetin custom relay dey change, because na here people dey mix up relaying with self-hosting. Custom DERP server move the fallback data path go machine wey you own. The control path no move. Tailscale coordination server still hold your node keys, your policy file, and your user list. E no ever hold the private keys wey decrypt your traffic, so wetin attacker actually gain if e take over that coordination server na narrower question than e first sound. If you want that part for your own hardware, relay no be the correct tool. You need another control plane.

When self-hosted Headscale control plane dey make sense?

Headscale, the open source Tailscale control server dey replace coordination server with one wey you run for VPS (virtual private server). Tailscale clients no dey change. Dem point to your server instead of Tailscale own server, so you no get seats to buy and no user limit.

Start with the money, because the difference smaller pass wetin people dey expect. One Standard seat na 8 US dollars every month. Small VPS wey fit run control plane dey cost around wetin one or two seats cost. So the total no go change direction until you dey pay for several people, and e never change direction for solo homelab, wey don dey free before. Self-hosting to save money for network wey get five devices no go work out.

The real trade na control against work. Headscale dey keep your user list and policy file for machine wey you own, for country wey you choose, without vendor account for the path. According to project documentation wey dem check on 10 October 2026, e supports ACLs and grants, tags, subnet routers, exit nodes, MagicDNS, Taildrop, Tailscale SSH, node registration over OpenID Connect (OIDC), and embedded DERP server. Funnel and Serve dey listed as not yet supported, so publishing a service with Serve or Funnel still dey use Tailscale own control plane for now. Network flow logs no dey available too, OIDC groups no fit dey used inside ACL rules, and the project design na for one tailnet only.

Na this work you go handle:

• You own the control plane availability. Existing tunnels go continue to pass traffic for some time, because the peers don already hold each other's keys. Anything wey need coordination go stop: new nodes no fit register, expiring keys no fit renew, and policy changes no go reach the nodes.
• You own the upgrades. Headscale dey implement protocol wey Tailscale clients dey change continuously, so your upgrade schedule dey follow their client releases instead of your own calendar.
• You own the database and the backups. If you lose that state, every node must register again.
• You own TLS (transport layer security) for the server public endpoint, because clients dey reach the control server through HTTPS.

Na the honest cost be this. Accept am when the reason na control or user count wey per-seat pricing no handle well. No choose am just to save eight dollars.

A self-hosted NetBird server na the other answer wey you fit self-host. E ship with its own control plane, its own identity handling, and its own web interface. Dem build am as product, instead of reimplementing another person control server. Both options still leave you running service wey your network depends on. First decide say you want run one, then choose.

FAQ

Tailscale free plan na trial?

No. Personal na free tier wey no get expiry. As we check am on 10 October 2026, e get six users, unlimited user devices, and 50 tagged resources. E also include almost the full feature set, including single sign-on with your own OIDC identity provider. Wetin e no get na capabilities wey paid tiers dey sell, like more ACL groups, SCIM provisioning, advanced user roles, and network flow logs. Confirm today numbers for Tailscale pricing page, because dem fit revise the allowances.

How many devices I fit add for Tailscale free plan?

Your own devices no get limit. Tailscale pricing FAQ talk say user devices, meaning any node wey no be tagged, dey free and unlimited. Na tagged resources dem dey count: servers and routers wey you register with a tag. Personal include 50 of dem on 10 October 2026. Older guides wey talk 20 device or 100 device cap dey describe old pricing model wey no apply again.

Why my tailnet dey talk "Reached use limit"?

For Personal, the usual cause na seventh person, because the plan dey count people, no be machines. Tailscale also list account wey no update properly after plan change, and organization policy wey restrict access, as possible causes. For paid plan, wey no get user cap, contact Tailscale Support. First count human accounts for admin console. Untagged laptops and phones no be the cause.

Headscale cheaper pass to pay for Tailscale?

Only when paid seats don pass few. VPS wey fit run Headscale dey cost roughly wetin one or two Standard seats cost per month. So small tailnet no go save anything, and solo tailnet don already free from beginning. Headscale worth am when you want control plane for hardware wey you own, or when your user count make per-seat pricing awkward. The cost na operational work: upgrades wey follow Tailscale client releases, database backups, TLS certificate wey you need renew, and say na only you fit fix outage.