Tailscale pricing after the free plan

Tailscale pricing in one paragraph

Tailscale pricing is charged per user, not per device. User devices are unlimited on every plan, including the free one, so the free plan does not run out because you bought another laptop. It runs out because you added a person, or because you needed an admin feature that only a paid plan carries. Tailscale is a VPN (virtual private network) built on WireGuard, and the part you pay for is the control plane around the tunnels: identity and policy.

[
  {
    "plan": "Personal",
    "usd_per_user_month": 0
  },
  {
    "plan": "Standard",
    "usd_per_user_month": 8
  },
  {
    "plan": "Premium",
    "usd_per_user_month": 18
  }
]

Tailscale sells 3 self-serve plans plus a quoted one. Personal costs $0 and covers up to six users. Standard costs $8 per user per month. Premium costs $18 per user per month. Enterprise is priced case by case, so it has no list figure to plot. Those are the published list prices as of August 2026, read from the Tailscale pricing page. Tailscale has revised its plans several times, so check that page before you budget.

Tailscale reworked its plans on 8 April 2026. Personal Plus was retired and its six-user allowance moved into the free Personal plan, and the old Starter plan became Standard. Tailscale said that if you were already paying, your current plan keeps working at the same price for at least another twelve months from that announcement. An existing invoice may therefore not match the current page.

What Tailscale actually meters

Four things carry a number on your tailnet (the single Tailscale network your devices share), and only one of them is people. The figures below are as published in August 2026.

• Seats. A seat is a user. Standard and Premium bill per seat per month, and the seat count is the whole invoice.
• User devices. Unlimited on every plan. A machine that belongs to a person costs nothing, however many machines that person owns.
• Tagged resources. Every plan includes 50. Extra ones are $1 per month each, added self-serve from the billing console. A tagged resource is a machine that carries a tag instead of a user identity, which is how a server or other non-human node joins.
• ACL groups. An ACL (access control list) group is a named set of users that your policy rules refer to. The number you get differs sharply by plan, and that difference gets its own section below.

Ephemeral resources are metered separately, in minutes: 1,000 minutes a month on Personal and Standard, 10,000 on Premium. An ephemeral node is a short-lived one, such as a CI (continuous integration) runner that joins for a build and then leaves. A node that stays in the tailnet longer than four hours stops counting against that pool, so an ordinary server never drains it. The comparison table has no row for exit nodes, subnet routers or MagicDNS, so the shape of the network itself is not metered. For the precise edge of the free tier, see where the free Tailscale plan stops.

How a seat is counted, so the invoice matches your headcount

Tailscale's billing documentation states it plainly: you pay for a number of seats on your tailnet, and a user occupies a seat when they join. In practice a user takes a seat the first time they sign in to the admin console, or the first time they authenticate a device. Someone you invited who has not accepted yet does not occupy a seat, and you are not charged for them. If every seat is taken and a new user signs in, the seat count is automatically increased by 1, and a seat added inside a monthly billing period is charged at the prorated rate. A seat can be vacated, for example by deleting the user, and the next person reuses it. On an annual subscription those changes go through Tailscale's sales team rather than the console, which is worth knowing before you commit to a year.

Two scenarios, worked end to end

Seats are the only variable, so an annual figure is the seat count times the monthly price times twelve. Here are four shapes at list price.

[
  {
    "label": "Household of 4, Personal",
    "usd_per_year": 0
  },
  {
    "label": "Household of 7, Standard",
    "usd_per_year": 672
  },
  {
    "label": "Team of 5, Standard",
    "usd_per_year": 480
  },
  {
    "label": "Team of 5, Premium",
    "usd_per_year": "1,080"
  }
]

Scenario one: a household of four people

This is the easy case and the answer is $0. Personal covers up to six users and user devices are unlimited. Four people carrying a phone and a laptop each, plus a home server, a network video recorder and a VPS, all fit inside the free plan. A VPS acting as a Tailscale exit node on a VPS is one more free device, because the plan meters people rather than roles.

Two things still end a household's free plan. The first is the seventh user. Housemates, a partner's parents, a friend who wants access to your media server: pass six users and the whole tailnet moves to Standard, and you pay for every seat, not only the new one. Seven seats at $8 each is $672 a year. The second is tags. If you tag your servers so they are owned by a tag instead of by you, the first 50 are included and each one after that costs $1 per month. Most households never reach 50.

Scenario two: a five person team

Five people fit inside the six-user free allowance, so a five person company can run Tailscale for $0 a year, and many do. Headcount is rarely what stops them. The admin side of the product is what pushes a small team onto a paid plan, and it does so well before the sixth hire.

When you do move, the arithmetic is simple because seats are the only input. Five seats on Standard is $480 a year. The same five seats on Premium is $1,080 a year. A new hire in month seven adds one prorated seat, not a new plan.

Why the bill appears on the identity side

The login itself is free on every plan. The charge sits in the machinery around it: who may administer what, and how finely you can describe access. That is the same pattern we described in the SSO tax in self-hosted apps, and Tailscale is a clear example of it.

Start with user roles, because this is the row that moves small teams onto a paid plan. Tailscale's documentation splits roles in two. "Basic roles are available for all pricing plans", and those roles are Owner, Admin and Member. "Advanced roles are available for the Standard, Premium, and Enterprise pricing plans", and those roles are Billing admin, IT admin, Network admin and Auditor. On the free plan there is no way to let your networking person own the policy file without also giving them the power to delete the tailnet, and there is no read-only role at all. The first time a colleague asks for audit access, you are on Standard.

SCIM (system for cross-domain identity management) is the second row. SCIM is the protocol that pushes users and groups from your identity provider into a service, so that a leaver disappears from the tailnet when HR disables their account. It starts at Standard. On Personal you remove people by hand, which is fine for four people and a real risk at twenty.

[
  {
    "plan": "Personal",
    "groups_included": 3
  },
  {
    "plan": "Standard",
    "groups_included": 10
  },
  {
    "plan": "Premium",
    "groups_included": 300
  }
]

Then the ACL groups. Personal allows 3 groups. Standard allows 10. Premium allows 300. Three sounds workable until you write the policy file: one group for staff and one for contractors leaves you a single group for everything else, so any further structure has to be written against individual users. That stops scaling the day somebody changes job.

Two more rows are worth naming so you do not upgrade for the wrong reason. Device posture integrations with MDM (mobile device management), EDR (endpoint detection and response) and XDR (extended detection and response) start at Standard. Network flow logs and log streaming start at Premium, and session recording arrives with the Enterprise privileged access management extension. Device approval, which holds a new machine in a waiting state until an admin lets it in, is documented as available on all plans, so it is not a reason to pay.

Discounts you can actually get

Tailscale documents several, and they are worth checking before you pay list price. Charities, not-for-profit organisations and educational institutions get "50% discount off of list prices": you select a plan in the billing console first, then contact Tailscale Support to have the discount applied. Open source projects in a GitHub organisation with an OSI (Open Source Initiative) licence can get Tailscale free, on the condition that the tailnet uses GitHub for authentication. Promo codes appear at conferences and in marketing emails, and apply when you upgrade.

Headscale, the self-hosted escape hatch

Headscale is an open source implementation of the Tailscale control server, and the official Tailscale clients connect to it. It is not associated with Tailscale Inc. Its own documentation sets the scope narrowly: a single tailnet, "suitable for a personal use, or a small open-source organisation", aimed at self-hosters and hobbyists. The feature list is fuller than most people expect. MagicDNS, Taildrop, tags, subnet routers, exit nodes, ephemeral nodes, an embedded DERP (designated encrypted relay for packets) server, ACLs and Tailscale SSH are all listed as supported.

The trade runs in both directions, and it is worth stating honestly. Headscale removes the per-seat bill completely: users, devices and ACL groups become your own numbers, and the per-person charge disappears. In exchange you operate the control plane. The control server is what issues node keys and distributes the peer map, so while it is offline you cannot add a device or re-authenticate one whose key expired. That means its database needs backups, its version needs an upgrade plan, and its host needs monitoring, the same as any other production service. Identity is also where it is weakest: Headscale supports OIDC (OpenID Connect) logins, but its documentation notes that OIDC groups cannot be used in ACLs, which is precisely the capability a team was going to pay Tailscale for.

So take the trade if you run one tailnet, you already keep a Linux server patched and backed up, and the per-seat price is your only reason for looking. Do not take it if what you were about to buy is SCIM, auditor access or group-based policy, because that is the part Headscale is not trying to solve. The install is an ordinary server setup, covered in running Headscale as your own Tailscale control server. If you want neither the bill nor the control plane, plain WireGuard against Tailscale is the comparison to read, because hand-managed WireGuard has no per-user cost and no coordination server at all.

Count your own users and devices first

Before you model anything, get the two real numbers. On any machine already in the tailnet:

tailscale status

That prints one line per machine:

100.101.102.103  laptop-alice   alice@   linux   active; direct 203.0.113.9:41641, tx 1116 rx 1124
100.101.102.104  phone-bob      bob@     iOS     active; relay "fra", tx 1351 rx 4262
100.101.102.105  vps-frankfurt  alice@   linux   idle; tx 1214 rx 50

The columns are the Tailscale IP address, the machine name, the owner, the operating system, and the connection state. The third column is the one that decides your bill. Count the distinct logins there rather than the lines, because three machines owned by alice@ are one seat and three free devices.

For the whole tailnet rather than one machine's view, the API returns the full device list:

curl -s "https://api.tailscale.com/api/v2/tailnet/example.com/devices" -u "$TS_API_KEY:"

Replace example.com with your tailnet name, and generate the access token on the Keys page of the admin console. You need to be an Owner, Admin or IT admin for that call to succeed. The number that settles the invoice is still the Users page of the admin console, because a seat is a user who has signed in, and that is what Tailscale counts.

FAQ

Is Tailscale free for personal use?

Yes, for up to six users. The Personal plan costs $0 and includes unlimited user devices, 50 tagged resources, 3 ACL groups, and 1,000 ephemeral resource minutes a month, as published in August 2026. Six is a tailnet-wide user count, so a seventh person moves the whole tailnet onto a paid plan and every existing user becomes a billed seat.

Do my devices count toward the Tailscale bill?

Devices that belong to a person do not. User devices are unlimited on every plan, so one person with twenty machines is still one seat. The device number that can cost money is tagged resources, meaning machines that carry a tag instead of a user identity. Every plan includes 50 of those, and extra ones cost $1 per month each, added self-serve from the billing console.

What is the cheapest way to run Tailscale for a five person team?

Stay on Personal, because five people fit inside the six-user free allowance. Move to Standard at $8 per user per month, which is $480 a year for five seats, once you need something the free plan withholds: advanced user roles, SCIM provisioning, device posture checks, or more than 3 ACL groups. If you are a registered charity or an educational institution, ask Tailscale Support for the 50% discount before you subscribe.

Does self-hosting Headscale actually save money?

It removes the per-seat charge and replaces it with a server you operate. The trade works when the bill is your only reason for looking, when you run a single tailnet, and when you already keep a Linux host backed up and patched. It works badly when you were going to pay for identity governance, because Headscale's documentation notes that OIDC groups cannot be used in its ACLs, so the group-based policy you wanted is the part that does not carry over.