Tailscale pricing and plans: what you really pay

Tailscale pricing in one paragraph

Tailscale pricing is charged per user, not per device. User devices are unlimited on every plan, including the free one, so the free plan does not run out because you bought another laptop. It runs out because you added a person, or because you needed an admin feature that only a paid plan carries. Tailscale is a VPN (virtual private network) built on WireGuard, and the part you pay for is the control plane around the tunnels: identity and policy.

[
  {
    "plan": "Personal",
    "usd_per_user_month": 0
  },
  {
    "plan": "Standard",
    "usd_per_user_month": 8
  },
  {
    "plan": "Premium",
    "usd_per_user_month": 18
  }
]

Tailscale sells 3 self-serve plans plus a quoted one. Personal costs $0 and covers up to six users. Standard costs $8 per user per month. Premium costs $18 per user per month. Enterprise is priced case by case, so it has no list figure to plot. Those are the published list prices as checked on 10 October 2026, read from the Tailscale pricing page. Tailscale has revised its plans several times, so check that page before you budget.

Tailscale reworked its plans on 8 April 2026. Personal Plus was retired and its six-user allowance moved into the free Personal plan, and the old Starter plan became Standard. Tailscale said that if you were already paying, your current plan keeps working at the same price for at least another twelve months from that announcement. An existing invoice may therefore not match the current page.

What Tailscale actually meters

Four things carry a number on your tailnet (the single Tailscale network your devices share), and only one of them is people. The figures below were checked against Tailscale's published pricing on 10 October 2026.

• Seats. A seat is a user. Standard and Premium bill per seat per month, and the seat count drives the invoice.
• User devices. Unlimited on every plan. A machine that belongs to a person costs nothing, however many machines that person owns.
• Tagged resources. Every plan includes 50. Extra ones are $1 per month each, added self-serve. Unlike seats, they do not grow automatically with usage, so add them before you need them. A tagged resource is a machine that carries a tag instead of a user identity, which is how a server or other non-human node joins.
• ACL groups. An ACL (access control list) group is a named set of users that your policy rules refer to. The number you get differs sharply by plan, and that difference gets its own section below.

Ephemeral resources are metered separately, in minutes: 1,000 minutes a month on Personal and Standard, 10,000 on Premium. An ephemeral node is a short-lived one, such as a CI (continuous integration) runner that joins for a build and then leaves. A node that stays in the tailnet longer than four hours stops counting against that pool, so an ordinary server never drains it. The comparison table has no row for exit nodes, subnet routers or MagicDNS, so the shape of the network itself is not metered. That is why a single machine advertising a private subnet from a VPS can put a whole network of devices within reach of your tailnet without adding one billable line to the invoice. Serve and Funnel are absent from it too, so publishing an HTTPS service costs nothing on any plan, though Funnel is held back by a policy setting rather than by price, as serve against funnel explains. For the precise edge of the free tier, see where the free Tailscale plan stops.

How a seat is counted, so the invoice matches your headcount

Tailscale's pricing FAQ states it plainly: you pay for a number of seats on your tailnet, and a user occupies a seat when they join. In practice a user takes a seat the first time they sign in to the admin console, or the first time they authenticate a device. Someone you invited who has not accepted yet does not occupy a seat, and you are not charged for them. If every seat is taken and a new user signs in, the seat count is automatically increased by 1, and a seat added inside a monthly billing period is charged at the prorated rate. A seat can be vacated, for example by deleting the user, and the next person reuses it. On an annual subscription those changes go through Tailscale's sales team rather than the console, which is worth knowing before you commit to a year.

Two scenarios, worked end to end

Seats are the main variable, so the subscription itself is the seat count times the monthly price times twelve. Extra tagged resources beyond the included 50, and add-ons such as the Mullvad VPN add-on, which is licensed per device rather than per user, sit on top of that. Here are four shapes at list price.

[
  {
    "label": "Household of 4, Personal",
    "usd_per_year": 0
  },
  {
    "label": "Household of 7, Standard",
    "usd_per_year": 672
  },
  {
    "label": "Team of 5, Standard",
    "usd_per_year": 480
  },
  {
    "label": "Team of 5, Premium",
    "usd_per_year": "1,080"
  }
]

Scenario one: a household of four people

This is the easy case and the answer is $0. Personal covers up to six users and user devices are unlimited. Four people carrying a phone and a laptop each, plus a home server, a network video recorder and a VPS, all fit inside the free plan. A VPS acting as a Tailscale exit node on a VPS is one more free device, because the plan meters people rather than roles.

Two things still end a household's free plan. The first is the seventh user. Housemates, a partner's parents, a friend who wants access to your media server: pass six users and the whole tailnet moves to Standard, and you pay for every seat, not only the new one. Seven seats at $8 each is $672 a year. The second is tags. If you tag your servers so they are owned by a tag instead of by you, the first 50 are included and each one after that costs $1 per month. Most households never reach 50.

Scenario two: a five person team

Five people fit inside the six-user allowance by headcount, but headcount is not the test for a company. Tailscale's pricing page describes Personal as "only suitable for non-commercial use", its plan documentation says "The Personal plan is not intended for commercial use", and a tailnet on a custom domain is treated as business use and enrolled in a free trial instead. So a five person company should budget for a paid plan from the start. The admin side of the product would push a small team onto one anyway, and it does so well before the sixth hire.

On a paid plan the arithmetic is simple because seats drive the bill. Five seats on Standard is $480 a year. The same five seats on Premium is $1,080 a year. A new hire in month seven adds one prorated seat, not a new plan.

Why the bill appears on the identity side

The login itself is free on every plan. The charge sits in the machinery around it: who may administer what, and how finely you can describe access. That is the same pattern we described in the SSO tax in self-hosted apps, and Tailscale is a clear example of it.

Start with user roles, because this is the row that moves small teams onto a paid plan. Tailscale's documentation splits roles in two. "Basic roles are available for all pricing plans", and those roles are Owner, Admin and Member. "Advanced roles are available for the Standard, Premium, and Enterprise pricing plans", and those roles are Billing admin, IT admin, Network admin and Auditor. On the free plan the only way to let your networking person own the policy file is to make them an Admin, and an Admin can do anything in the admin console, from removing users to changing the billing plan. Deleting the tailnet stays with the Owner, but the narrower Network admin role, which touches only network configuration, is a paid one. There is no read-only role at all. The first time a colleague asks for audit access, you are on Standard.

SCIM (system for cross-domain identity management) is the second row. SCIM is the protocol that pushes users and groups from your identity provider into a service, so that a leaver disappears from the tailnet when HR disables their account. It starts at Standard. On Personal you remove people by hand, which is fine for four people and a real risk at twenty. A forgotten account is also the realistic route into a tailnet rather than anything to do with the encryption, which is the argument Tailscale's trust model works through.

[
  {
    "plan": "Personal",
    "groups_included": 3
  },
  {
    "plan": "Standard",
    "groups_included": 10
  },
  {
    "plan": "Premium",
    "groups_included": 300
  }
]

Then the ACL groups. Personal allows 3 groups. Standard allows 10. Premium allows 300. Three sounds workable until you write the policy file: one group for staff and one for contractors leaves you a single group for everything else, so any further structure has to be written against individual users. That stops scaling the day somebody changes job.

Two more rows are worth naming so you do not upgrade for the wrong reason. Device posture integrations with MDM (mobile device management), EDR (endpoint detection and response) and XDR (extended detection and response) start at Standard, while basic posture checks on operating system and Tailscale version work on every plan. Network flow logs and log streaming start at Premium, and session recording arrives with the privileged access management platform extension, which for now is sold through Tailscale's sales team. Device approval, which holds a new machine in a waiting state until an admin lets it in, is documented as available on all plans, so it is not a reason to pay.

Discounts you can actually get

Tailscale documents several, and they are worth checking before you pay list price. Eligible charities, not-for-profit organisations and educational institutions "receive a 50% discount on Tailscale list prices". How you claim it depends on whether you already pay. If you do not have a paid subscription yet, contact Tailscale Support first with the verification information it asks for; once your eligibility is confirmed, Support gives you a one-time 50% discount coupon that you apply during checkout. If you already have a paid subscription, contact Support and the discount is applied to that subscription. Commercial education technology companies, and programmes exclusively for people under 18, are not eligible. Open source projects in a GitHub organisation with an OSI (Open Source Initiative) licence can get Tailscale free, on the condition that the tailnet uses GitHub for authentication; that plan is not available from the Billing page, so you apply for it rather than select it. Promo codes appear at conferences and in marketing emails, and apply when you upgrade or, from the Billing page of the admin console, to a paid plan you already have. These terms were checked against Tailscale's discounts documentation on 10 October 2026.

Headscale, the self-hosted escape hatch

Headscale is an open source implementation of the Tailscale control server, and the official Tailscale clients connect to it. It is not associated with Tailscale Inc. Its own documentation sets the scope narrowly: a single tailnet, "suitable for a personal use, or a small open-source organisation", aimed at self-hosters and hobbyists. The feature list is fuller than most people expect. MagicDNS, Taildrop, tags, subnet routers, exit nodes, ephemeral nodes, an embedded DERP (designated encrypted relay for packets) server, ACLs and Tailscale SSH are all listed as supported.

The trade runs in both directions, and it is worth stating honestly. Headscale removes the per-seat bill completely: users, devices and ACL groups become your own numbers, and the per-person charge disappears. In exchange you operate the control plane. The control server is what issues node keys and distributes the peer map, so while it is offline you cannot add a device or re-authenticate one whose key expired. That means its database needs backups, its version needs an upgrade plan, and its host needs monitoring, the same as any other production service. Identity is also where it is weakest: Headscale supports OIDC (OpenID Connect) logins, but its documentation notes that OIDC groups cannot be used in ACLs, which is precisely the capability a team was going to pay Tailscale for.

So take the trade if you run one tailnet, you already keep a Linux server patched and backed up, and the per-seat price is your only reason for looking. Do not take it if what you were about to buy is SCIM, auditor access or group-based policy, because that is the part Headscale is not trying to solve. The install is an ordinary server setup, covered in running Headscale as your own Tailscale control server. If you want neither the bill nor the control plane, plain WireGuard against Tailscale is the comparison to read, because hand-managed WireGuard has no per-user cost and no coordination server at all. If group-based policy was the thing pushing you toward a paid plan, running your own NetBird server is the closer fit, because it ships an identity provider alongside the control plane and writes its access rules against groups you define yourself.

Count your own users and devices first

Before you model anything, get the two real numbers. On any machine already in the tailnet:

tailscale status

That prints one line per machine:

100.101.102.103  laptop-alice   alice@   linux   active; direct 203.0.113.9:41641, tx 1116 rx 1124
100.101.102.104  phone-bob      bob@     iOS     active; relay "fra", tx 1351 rx 4262
100.101.102.105  vps-frankfurt  alice@   linux   idle; tx 1214 rx 50

The columns are the Tailscale IP address, the machine name, the owner, the operating system, and the connection state. The third column is the one that decides your bill. Count the distinct logins there rather than the lines, because three machines owned by alice@ are one seat and three free devices.

For the whole tailnet rather than one machine's view, the API returns the full device list:

curl -s "https://api.tailscale.com/api/v2/tailnet/example.com/devices" -u "$TS_API_KEY:"

Replace example.com with your tailnet name, and generate the access token on the Keys page of the admin console. You need to be an Owner, Admin, IT admin or Network admin to generate that token. The number that settles the invoice is still the Users page of the admin console, because a seat is a user who has signed in, and that is what Tailscale counts.

FAQ

Is Tailscale free for personal use?

Yes, for up to six users. The Personal plan costs $0 and includes unlimited user devices, 50 tagged resources, 3 ACL groups, and 1,000 ephemeral resource minutes a month, as checked on 10 October 2026. Six is a tailnet-wide user count, so a seventh person moves the whole tailnet onto a paid plan and every existing user becomes a billed seat.

Do my devices count toward the Tailscale bill?

Devices that belong to a person do not. User devices are unlimited on every plan, so one person with twenty machines is still one seat. The device number that can cost money is tagged resources, meaning machines that carry a tag instead of a user identity. Every plan includes 50 of those, and extra ones cost $1 per month each, added self-serve.

What is the cheapest way to run Tailscale for a five person team?

If the five of you are a business, the answer is not Personal, even though five people fit inside its six-user allowance, because Tailscale's plan documentation says "The Personal plan is not intended for commercial use." A non-commercial group of five, such as a household or a hobby project, can stay on Personal. For a company the cheapest route is Standard at $8 per user per month, which is $480 a year for five seats, and it also brings what the free plan withholds: advanced user roles, SCIM provisioning, third-party device posture integrations, and more than 3 ACL groups. If you are a registered charity or an educational institution, ask Tailscale Support for the 50% discount before you subscribe, so you have the one-time coupon to apply at checkout.

Does self-hosting Headscale actually save money?

It removes the per-seat charge and replaces it with a server you operate. The trade works when the bill is your only reason for looking, when you run a single tailnet, and when you already keep a Linux host backed up and patched. It works badly when you were going to pay for identity governance, because Headscale's documentation notes that OIDC groups cannot be used in its ACLs, so the group-based policy you wanted is the part that does not carry over.