Tailscale pricing: wetin you go really pay

Tailscale pricing for one paragraph

Tailscale pricing dey charge per user, no be per device. User devices no get limit for every plan, including the free one, so free plan no go finish because you buy another laptop. E go finish because you add person, or because you need admin feature wey only paid plan get. Tailscale na VPN (virtual private network) wey build on WireGuard, and wetin you dey pay for na the control plane around the tunnels: identity and policy.

[
  {
    "plan": "Personal",
    "usd_per_user_month": 0
  },
  {
    "plan": "Standard",
    "usd_per_user_month": 8
  },
  {
    "plan": "Premium",
    "usd_per_user_month": 18
  }
]

Tailscale dey sell 3 self-serve plans plus one wey dem dey price by quote. Personal cost $0 and e cover up to six users. Standard cost $8 per user per month. Premium cost $18 per user per month. Enterprise price dey depend on each case, so e no get list figure to plot. Na the published list prices be these, as we check dem on 6 October 2026, from the Tailscale pricing page. Tailscale don change its plans several times, so check that page before you prepare budget.

Tailscale rework its plans on 8 April 2026. Dem retire Personal Plus and move its six-user allowance enter the free Personal plan, while the old Starter plan become Standard. Tailscale talk say if you don dey pay before, your current plan go continue to work for the same price for at least another twelve months from that announcement. So, existing invoice fit no match the current page.

Wetin Tailscale actually dey meter

Four things dey carry number for your tailnet (the single Tailscale network wey your devices share), and na only one of dem be people. Dem check the figures below against Tailscale published pricing on 6 October 2026.

• Seats. Seat na user. Standard and Premium dey charge per seat every month, and the seat count na the full invoice.
• User devices. Unlimited for every plan. Machine wey belong to person no cost anything, no matter how many machines that person get.
• Tagged resources. Every plan include 50. Extra ones na $1 every month each, and you fit add dem yourself from billing console. Tagged resource na machine wey carry tag instead of user identity. Na so server or another non-human node dey join.
• ACL groups. ACL (access control list) group na named set of users wey your policy rules refer to. The number wey you get dey differ well-well by plan, and that difference get im own section below.

Dem dey meter ephemeral resources separately, for minutes: 1,000 minutes every month for Personal and Standard, 10,000 for Premium. Ephemeral node na short-lived node, like CI (continuous integration) runner wey join for one build and then comot. Node wey stay for the tailnet pass four hours no longer count against that pool, so ordinary server no go drain am. The comparison table no get row for exit nodes, subnet routers or MagicDNS, so dem no dey meter the network shape itself. Na why one machine wey dey advertise private subnet from VPS fit make whole network of devices reach your tailnet without adding one billable line to the invoice. Serve and Funnel no dey inside am too, so publishing HTTPS service no cost anything for any plan, although policy setting dey hold Funnel back instead of price, as serve against funnel explain. For the exact limit of the free tier, see where free Tailscale plan dey stop.

How dem dey count seat, so invoice go match your headcount

Tailscale billing documentation talk am clear: you dey pay for certain number of seats for your tailnet, and user go occupy one seat when dem join. For practical side, user go take seat the first time dem sign in to the admin console, or the first time dem authenticate device. Person wey you invite but never accept invitation no dey occupy seat, and dem no go charge you for am. If all seats don finish and new user sign in, seat count go increase automatically by 1, and dem go charge seat wey dem add during monthly billing period with prorated rate. You fit free seat, for example by deleting user, and the next person go reuse am. For annual subscription, Tailscale sales team dey handle these changes instead of the console. You suppose know this before you commit to one year.

Two scenarios, worked end to end

Seats na the only variable, so annual amount na seat count multiply by monthly price multiply by twelve. See four examples for list price.

[
  {
    "label": "Household of 4, Personal",
    "usd_per_year": 0
  },
  {
    "label": "Household of 7, Standard",
    "usd_per_year": 672
  },
  {
    "label": "Team of 5, Standard",
    "usd_per_year": 480
  },
  {
    "label": "Team of 5, Premium",
    "usd_per_year": "1,080"
  }
]

Scenario one: household of four people

Dis na di easy case, and di answer na $0. Personal fit cover up to six users, and user devices no get limit. Four people wey each carry phone and laptop, plus home server, network video recorder, and VPS, all fit enter the free plan. VPS wey dey act as Tailscale exit node for VPS na one more free device, because di plan dey count people, no be roles.

Two things still fit end household free plan. Di first na di seventh user. Housemates, partner parents, or friend wey wan access your media server: once users pass six, di whole tailnet go move to Standard, and you go pay for every seat, no be only di new one. Seven seats at $8 each na $672 for one year. Di second na tags. If you tag your servers so tag go own dem instead of you, di first 50 dey included, and every one after dat one cost $1 per month. Most households no dey reach 50.

Scenario two: team wey get five people

Five people fit enter the free allowance wey cover six users, so company wey get five people fit run Tailscale for $0 every year, and plenty companies dey do am. Number of staff hardly be wetin dey stop dem. Na the product admin side dey push small team enter paid plan, and e dey happen well before the sixth person join.

When una move, the calculation dey simple because na seats alone dey count. Five seats for Standard na $480 every year. The same five seats for Premium na $1,080 every year. New person wey join for month seven go add one prorated seat, no be new plan.

Why bill dey appear for identity side

The login itself free for every plan. The charge dey come from the machinery around am: who fit administer wetin, and how detailed you fit describe access. Na the same pattern we describe for SSO tax for self-hosted apps, and Tailscale show am clearly.

Start with user roles, because na this row dey move small teams go paid plan. Tailscale documentation divide roles into two. “Basic roles dey available for all pricing plans”, and those roles na Owner, Admin and Member. “Advanced roles dey available for Standard, Premium, and Enterprise pricing plans”, and those roles na Billing admin, IT admin, Network admin and Auditor. For free plan, you no fit allow your networking person own the policy file without giving dem power to delete the tailnet too, and no read-only role dey at all. The first time colleague ask for audit access, you don reach Standard.

SCIM (system for cross-domain identity management) na the second row. SCIM na protocol wey dey push users and groups from your identity provider go service, so leaver go disappear from the tailnet when HR disable their account. E start from Standard. For Personal, you remove people by hand. E good for four people, but e become real risk at twenty. Forgotten account na also the realistic way person fit enter tailnet, instead of anything related to encryption. Na the argument wey Tailscale trust model dey use.

[
  {
    "plan": "Personal",
    "groups_included": 3
  },
  {
    "plan": "Standard",
    "groups_included": 10
  },
  {
    "plan": "Premium",
    "groups_included": 300
  }
]

Then ACL groups. Personal allow 3 groups. Standard allow 10. Premium allow 300. Three fit sound workable until you write the policy file: one group for staff and one for contractors go leave you with only one group for everything else. Any extra structure go need you write am against individual users. This one stop to scale the day somebody change job.

Two more rows worth mentioning, so you no upgrade for the wrong reason. Device posture integrations with MDM (mobile device management), EDR (endpoint detection and response) and XDR (extended detection and response) start from Standard. Network flow logs and log streaming start from Premium, while session recording dey come with Enterprise privileged access management extension. Device approval, wey hold new machine for waiting state until admin allow am enter, documentation say e dey available for all plans. So e no be reason to pay.

Discount wey you fit actually get

Tailscale don document several discounts, and e worth make you check dem before you pay the normal list price. Charities wey qualify, not-for-profit organisations, and educational institutions “receive a 50% discount on Tailscale list prices”. How you go claim am depend on whether you dey pay already. If you never get paid subscription, contact Tailscale Support first with the verification information wey dem request. After dem confirm say you qualify, Support go give you one-time 50% discount coupon wey you apply during checkout. If you already get paid subscription, contact Support and dem go apply the discount to that subscription. Commercial education technology companies, and programmes wey na only for people under 18, no qualify. Open source projects for GitHub organisation wey get OSI (Open Source Initiative) licence fit get Tailscale free, provided say the tailnet dey use GitHub for authentication. You no fit select that plan from the Billing page; you need apply for am instead. Promo codes fit show for conferences and marketing emails. Dem apply when you upgrade or, from the Billing page for the admin console, to paid plan wey you already get. We check these terms against Tailscale discounts documentation on 6 October 2026.

Headscale, the self-hosted escape hatch

Headscale na open source implementation of Tailscale control server, and official Tailscale clients dey connect to am. E no dey associated with Tailscale Inc. The documentation set the scope narrow: na one tailnet, “suitable for a personal use, or a small open-source organisation”, wey target self-hosters and hobbyists. The feature list full pass wetin most people expect. MagicDNS, Taildrop, tags, subnet routers, exit nodes, ephemeral nodes, embedded DERP (designated encrypted relay for packets) server, ACLs and Tailscale SSH all dey listed as supported.

The trade-off dey work for both sides, and e good make we talk am honestly. Headscale remove per-seat bill completely: users, devices and ACL groups become your own numbers, and per-person charge disappear. But you go operate the control plane. Control server na e dey issue node keys and distribute peer map, so when e dey offline, you no fit add device or re-authenticate one wey key don expire. That mean database need backups, version need upgrade plan, and host need monitoring, just like any other production service. Identity na also where e weak pass: Headscale support OIDC (OpenID Connect) logins, but documentation note say OIDC groups no fit dey used for ACLs. Na exactly this capability team fit pay Tailscale for.

So take the trade if you dey run one tailnet, you already dey keep Linux server patched and backed up, and per-seat price na your only reason for checking am. No take am if wetin you wan buy na SCIM, auditor access or group-based policy, because na that part Headscale no dey try solve. The install na ordinary server setup, wey dem cover for running Headscale as your own Tailscale control server. If you no want the bill or the control plane, plain WireGuard against Tailscale na the comparison to read, because hand-managed WireGuard get no per-user cost and no coordination server at all. If group-based policy na the thing wey dey push you toward paid plan, running your own NetBird server fit you better, because e ship identity provider together with control plane and write access rules against groups wey you define yourself.

Count your own users and devices first

Before you model anything, first get the two real numbers. For any machine wey don already dey inside the tailnet:

tailscale status

This command go print one line for each machine:

100.101.102.103  laptop-alice   alice@   linux   active; direct 203.0.113.9:41641, tx 1116 rx 1124
100.101.102.104  phone-bob      bob@     iOS     active; relay "fra", tx 1351 rx 4262
100.101.102.105  vps-frankfurt  alice@   linux   idle; tx 1214 rx 50

The columns na Tailscale IP address, machine name, owner, operating system, and connection state. Na the third column dey determine your bill. Count the different logins there, no be the lines, because three machines wey alice@ own na one seat and three free devices.

For the whole tailnet instead of just one machine view, the API go return the complete device list:

curl -s "https://api.tailscale.com/api/v2/tailnet/example.com/devices" -u "$TS_API_KEY:"

Replace example.com with your tailnet name, and generate the access token from the Keys page for the admin console. You must be Owner, Admin or IT admin before that call fit succeed. The number wey go settle the invoice still dey for the Users page of the admin console, because seat na user wey don sign in, and na that Tailscale dey count.

FAQ

Tailscale free for personal use?

Yes, e free for up to six users. Personal plan cost $0 and e include unlimited user devices, 50 tagged resources, 3 ACL groups, and 1,000 ephemeral resource minutes every month, according to the check wey dem do on 6 October 2026. Six na the user count for the whole tailnet. So, if seventh person join, the whole tailnet go move to paid plan, and every existing user go become billed seat.

My devices dey count for Tailscale bill?

Devices wey belong to person no dey count. User devices unlimited for every plan, so one person wey get twenty machines still na one seat. The device number wey fit cost money na tagged resources. These na machines wey carry tag instead of user identity. Every plan include 50 of dem. Extra ones cost $1 every month each, and you fit add dem yourself from billing console.

Wetin be the cheapest way to run Tailscale for five-person team?

Remain on Personal, because five people fit inside the six-user free allowance. Move to Standard at $8 per user every month, wey be $480 every year for five seats, when you need feature wey the free plan no provide: advanced user roles, SCIM provisioning, device posture checks, or more than 3 ACL groups. If you be registered charity or educational institution, contact Tailscale Support for the 50% discount before you subscribe. That way, you go get the one-time coupon to apply for checkout.

Self-hosting Headscale really dey save money?

E remove per-seat charge, but replace am with server wey you go operate. This arrangement make sense when na the bill alone make you consider am, when you run one tailnet, and when you already dey back up and patch Linux host. E no work well when your plan be to pay for identity governance. Headscale documentation note say OIDC groups no fit work inside its ACLs. So, the group-based policy wey you want na the part wey no go carry over.