Tailscale Pricing & Free Plan 2026: The Complete Honest Guide

Last verified against tailscale.com/pricing on 2026-05-20. Reflects Pricing v4, which Tailscale shipped April 8, 2026.

Is Tailscale free in 2026, and what does the free plan actually include?

Tailscale is free. The Personal plan, as of the April 8, 2026 Pricing v4 update, now supports up to six users, unlimited user-owned devices, fifty tagged resources, 1,000 ephemeral resource-minutes per month, WireGuard-grade encryption, MagicDNS, subnet routing, exit nodes, basic ACLs, and Tailscale SSH at no cost, forever. Paid tiers start at $8 per user per month (Standard) and run to $18 per user per month (Premium), with custom-quoted Enterprise on top. Personal Plus was retired in v4 and folded into the expanded free Personal plan, so anyone who used to pay for it now gets those features at zero. For solo developers, homelabs, and groups under seven people, the free plan is genuinely enough. Most people never need to upgrade.

The rest of this guide expands on the current free-plan numbers, walks through every paid tier with honest upgrade triggers, compares Tailscale to ZeroTier, NetBird, Nebula and Headscale, and ends with a five-step buying checklist. Everything reflects the post-v4 reality as of 2026-05-20, sourced directly from tailscale.com/pricing and the official v4 announcement.

If you searched for "tailscale pricing free plan 2026" between January and early April of this year, almost every result you read about the free tier was already wrong. Tailscale CEO Avery Pennarun published Pricing v4: more value, more simply on April 8, 2026, and the changes were not cosmetic. The headline shift: the Personal plan doubled its user cap, from three to six, and Personal Plus, the old "pay to add more users to your home network" tier, was retired entirely. People who had been paying $5 per month for Personal Plus simply stopped paying and kept everything they had, with more on top.

On the business side, the picture changed in three ways. First, "Starter" was renamed to "Standard" and gained features that used to live behind the next tier up. Second, all business plans moved from a hybrid usage-based model to predictable seat-based pricing, which makes budgeting trivial and stops the "we got a surprise bill" complaints that used to surface on r/Tailscale. Third, the Premium tier added a bundle of self-serve capabilities that used to require a sales call: SCIM provisioning, device posture, user management APIs, and webhooks.

The migration window for legacy plans is at least twelve months. If you signed up before April 2026, your old pricing keeps working at the same rate while you decide whether to move. This is the context most pages on the SERP do not have, because they were written and indexed before April 8. The free-plan numbers below reflect the post-v4 reality.

Two numbers people most often get wrong about Tailscale free in 2026:

1. The user cap on free is six, not three. The cap of three is the old number from before April 8, 2026.
2. There is no longer a Personal Plus tier. If a comparison chart shows it, that chart is out of date.

The free tier is not a trial, not a feature-stripped demo, and not a fourteen-day teaser. It is a fully working WireGuard-encrypted mesh network with most of the headline features turned on. That single fact is the reason Tailscale dominates the "mesh VPN free" search space in 2026, and the reason most individuals and most very small teams never need to pay.

Tailscale 2026 pricing at a glance: every tier, every price, every feature gate

Here is the current full pricing table, condensed.

Add-ons that work across paid plans:

• Mullvad VPN integration: $5 per month per five devices, for exit-node anonymization through Mullvad's network.
• Additional tagged resources: $1 per month per resource beyond plan cap.
• Ephemeral resource overages: quoted by sales.
• Multiple tailnets: quoted by sales, used when one org needs strictly separated networks.
• Aperture (the AI-governance platform extension Tailscale launched alongside v4): contact sales for current pricing.

What you actually get on the free Personal plan

The free plan in 2026 looks like an "almost everything for solo users" deal. Below is the full inventory, with annotations on what each item is and when it matters.

Network primitives, all included. Every device on your tailnet is connected through a WireGuard-based encrypted tunnel. There is no device count throttle for user-owned devices on the free tier. A solo developer with a desktop, a laptop, a phone, a tablet, a home server, a Raspberry Pi cluster, and a half-dozen virtual machines is well inside the limit. MagicDNS gives every device on your tailnet a stable hostname under your .tailnet-name.ts.net domain, so you can reach homeserver from your laptop without typing an IP. Subnet routing lets you designate a device as a "subnet router" and the rest of the tailnet can reach the LAN behind it; this is the feature that lets you "VPN into your home network" without port forwarding, without exposing anything to the public internet, and without paying anyone. Exit nodes let you designate any device as the upstream gateway and route all your phone or laptop traffic through that device's internet connection, useful when you are on hotel Wi-Fi, in a country with restrictive networks, or just want all your traffic to appear to come from your home IP. Basic ACLs let you express, in code, "these users on these devices can talk to those tagged resources on these ports." The free plan gets three ACL groups, which is enough to express "family", "work", and "iot" or similar. Tailscale SSH replaces your private-key-juggling SSH workflow with identity-mediated SSH that lives inside the tailnet, no key management required; the connection is authenticated by your Tailscale identity. Free includes all of this. The premium upgrade later adds session recording and other advanced controls.

Identity and login. Free Personal supports Google, Microsoft, GitHub, Apple, Passkeys, and email login. You do not get SAML SSO on the free plan, but for a personal account where you are the only identity to manage, that is a feature you do not need. Six is the new Personal-plan cap on users, where a user is a Tailscale identity, not a device, and one user can have unlimited devices.

Limits worth knowing about. The free plan has three quotas you can theoretically hit before the user cap: fifty tagged resources (a tagged resource is a non-user-owned device or service that lives on the tailnet under a tag rather than a user identity, including subnet routers, exit nodes, app connectors, and any "service" identity), 1,000 ephemeral resource-minutes per month (ephemeral nodes are short-lived devices created by CI jobs or auto-scaling workloads; one thousand minutes is a little under seventeen hours per month), and three ACL groups (fine for "me, family, iot" splits, tight if you want to express more elaborate policy like role-based access for multiple service tiers). If you hit any of these, the upgrade path is Standard at $8 per user per month, which lifts most of them or raises them tenfold to three-hundred-fold depending on the feature.

Add-ons explained

The Mullvad integration is the most interesting add-on. For $5 per month per five devices, you get the option to route any tailnet device's exit traffic through Mullvad's anonymizing VPN network. This stacks Tailscale's identity-mediated mesh with Mullvad's privacy-focused commercial VPN, which is the cleanest "mesh plus anonymizer" combination available in 2026. Tagged-resource overage at $1 per month per resource is the right pressure-relief valve if you start running fifty-one or sixty subnet routers; you do not have to jump up an entire pricing tier for one extra device.

What changed in Pricing v4 (April 2026), and what it means for buyers

The Pricing v4 release notes deserve a section on their own because they reshape what the right plan is for almost every audience.

What v4 retired

Personal Plus, the in-between paid tier that used to let an individual extend their personal network past three users, no longer exists. Anyone who was paying for it now uses the expanded Personal plan instead, and they are no longer charged. This is the most "we listened to the community" change in v4: Personal Plus was confusing, occupied an awkward middle ground, and the cleaner fix was to make Personal itself more generous.

What v4 renamed

Starter became Standard. The new Standard is broader than the old Starter; features that used to require Premium dropped down a tier in many cases. The renaming is also a positioning move: "Starter" sounds like an entry-level placeholder, while "Standard" sounds like the default professional plan. The product is the same. The story is sharper.

What v4 added on the business side

Three categories of features:

• Self-serve management APIs and webhooks. Customers can now wire Tailscale events into their own automation without contacting sales for an Enterprise quote first. Webhooks fire on tailnet membership changes, device events, and ACL changes, which makes downstream integrations (Slack notifications on new device join, Datadog alerts on exit-node use, custom auth flows) trivial.
• SCIM provisioning, broadened. SCIM used to require a higher tier in older pricing versions. In v4 it lives on Standard, which means most teams reach SCIM at the first paid step instead of two steps up.
• Device posture. Premium customers can now require device-side posture (encryption status, OS version, MDM enrollment) before a device can join the tailnet. This used to be an Enterprise-only conversation. It now lives on Premium.

What v4 stabilized

Seat-based pricing. The old model had a usage component (extra device fees beyond a quota, surprise overages on tagged resources). The new model is one number per user per month, with the quotas built in. Budgeting is trivial under v4; you take your seat count, multiply by $8 or $18, and you know your annual line item.

What v4 left alone

The actual technical product. The WireGuard-based protocol is unchanged. The client is unchanged. MagicDNS, exit nodes, Tailscale SSH, and ACLs all work the same. Existing tailnets do not need to migrate, do not need new clients, and do not lose any configuration. This is why the v4 transition has been smoother than most SaaS pricing changes: the underlying product never moved.

What v4 signals about Tailscale's direction

Companies usually update pricing to extract more revenue. Tailscale used v4 to give away more (free tier expanded) while making business plans more predictable (seat-based) and more capable (features dropped down tiers). That is a "we are confident in our market position and want to widen the funnel" move, not a "we need to squeeze our base" move. For buyers, that signal matters: it is a strong indication that Tailscale will continue to compete on generosity rather than lock-in.

When the free plan is enough, and when you really should upgrade

Most "tailscale pricing" guides paste the comparison table and walk away. The harder, more useful question is: which person are you, and which tier maps to your actual life? Below is a profile-driven mapping built from talking to Tailscale users across homelab subreddits, indie-hacker forums, and small-team Slack groups.

Profile A: Solo developer, homelab operator, freelance consultant

You are building a side project, running a home NAS, want to SSH to your dev box from a coffee shop, maybe pull files off your home Plex server while traveling. You have one to six devices, one user (you), maybe two if your partner also uses the home server. You should use Free Personal. It is overbuilt for you. You will not hit a single quota. The only reason to upgrade is if you need SAML SSO for compliance, which you almost certainly do not at this scale. Solo users routinely run twenty to forty devices on free with zero friction. The friction point, if it ever arrives, is the ephemeral minute quota, which only matters if you start running heavy CI workloads against tailnet-attached runners.

Profile B: Two-to-six-person startup

You are a tiny team of cofounders sharing access to a staging environment, internal admin panel, and developer servers. You have four developers, ten or fifteen devices total, a couple of subnet routers, no SCIM provisioning needs because HR is one of you and onboarding takes ninety seconds. You should use Free Personal, until the sixth user is added or you start running CI heavily enough to burn through 1,000 ephemeral minutes per month. When either of those triggers fires, move to Standard at $8 per user per month. For a six-person team, that is $48 per month total. It is one of the cheapest commercial-grade VPN bills on the market. Many startups at this scale spend more on a single dev tool seat (Linear, Notion, Figma) than they will spend on Standard for their whole team.

Profile C: Seven-to-fifty-person team

You are past the free user cap, with HR handling onboarding, an IT person who would like to push device configs centrally, and a security person who wants SCIM so leavers actually leave the network when they leave the company. You should use Standard. $8 per user per month, billed annually or monthly, with SCIM provisioning, MDM support for centrally pushing Tailscale to managed devices, up to ten ACL groups, and 1,000 ephemeral minutes per month. For a fifteen-person team that is $120 per month, less than many single-seat enterprise VPN licenses. The first features you notice after upgrading are SCIM (deprovisioning leavers happens automatically) and SSO (no more "I lost my login"); MDM and the broader ACL allowance show up as you grow into them.

Profile D: Fifty-plus, with audit and compliance load

You are a regulated SaaS, healthcare-adjacent, fintech, or anyone whose security team produces an annual SOC 2 report. You need network logging, you need just-in-time access for production, you need to record SSH sessions, and you want device posture so a non-encrypted laptop cannot join the network. You should use Premium. $18 per user per month. The Premium tier carries 300 ACL groups, JIT access, advanced SSH (session recording), network logs (which integrate with SIEM tools), device posture, and webhooks for triggering downstream automation. For a fifty-seat deployment that is $900 per month, which is in line with what an equivalent commercial ZTNA product costs but with substantially less administrative friction. The total cost of ownership story (no separate ZTNA license, no separate session-recorder, no separate VPN appliance) is usually where Premium pays for itself.

Profile E: Large enterprise with custom contracting needs

You are signing an MSA, want an SLA, need a dedicated solutions engineer, want invoice billing in your local currency, and your procurement function takes six weeks to add a new vendor. You should use Enterprise. This is a sales-quoted plan. The technical features overlap heavily with Premium; what you are paying for is the contract surface, the dedicated humans, and the procurement-friendly billing. Enterprise customers also unlock multi-tailnet topologies (useful for strict segregation between business units), priority support, and named customer-success contact.

The four upgrade triggers, distilled

Stay on Free if all of the following are true: your team is six or fewer total users, you do not need SCIM/MDM, you can live with three ACL groups, your CI does not burn more than 1,000 ephemeral resource-minutes per month, you do not need SAML SSO/network logs/session recording, and your reasonable-effort security posture does not require device posture checks.

Move to Standard ($8/user/month) when any of these become true: you add a seventh user; HR or compliance asks for SCIM provisioning so users are actually deprovisioned when they leave; you want to push the Tailscale client to managed devices via MDM (Jamf, Intune, Kandji); you want self-serve SAML SSO with your identity provider of choice; or you want more than three ACL groups.

Move to Premium ($18/user/month) when any of these become true: your security team wants network logs and full audit trail; you need JIT access for production with approval workflow; you need 10,000 ephemeral resource-minutes per month for busier CI/CD; you want up to 300 ACL groups for fine-grained role-based access; you want device posture checks; you want advanced SSH features including session recording; or you want webhooks to trigger downstream automation off tailnet events.

Move to Enterprise (custom) when any of these become true: your procurement requires an MSA, formal SLA, and dedicated solutions engineer; you need invoice billing in your local currency, or net-45 terms; you need custom data residency or other contractual carve-outs; or you want a named TAM and named customer success.

The thing to notice: the leap from Free to Standard is mostly about org-scale features (SCIM, MDM, SSO). The leap from Standard to Premium is mostly about security and governance features (JIT, logs, posture, session recording). The leap from Premium to Enterprise is mostly about contract and relationship features. Each step has a clear "you'd know it if you needed it" trigger.

Common over-buying mistake: paying for Premium when Standard would do

A surprisingly common mistake is for a thirty-person SaaS to land on Premium because someone read the feature list and got excited about JIT access and session recording. If your security team has not explicitly asked for those things, you are paying $10 extra per user per month for features you will not turn on. The honest test: pull the Premium-only feature list, ask your security team "do you actually need any of these in the next six months", and if the answer is no, save your budget for the day they say yes.

How Tailscale free compares to ZeroTier, NetBird, Nebula, and Headscale

If you are pricing Tailscale, you are probably also pricing its alternatives. The honest comparison, mid-2026.

Tailscale Personal (Free) vs ZeroTier Free

ZeroTier's free tier in 2026 allows one network with up to twenty-five nodes. Tailscale's free allows up to six users with unlimited user-owned devices and fifty tagged resources. For solo or family use, both work. ZeroTier becomes more limiting once you need many devices behind one user, because of the twenty-five-node cap. Tailscale's MagicDNS, exit nodes, and Tailscale SSH are also slicker than ZeroTier's equivalents. ZeroTier's strength is its longer history, broader router-firmware support (it ships in OpenWRT packages and some pre-built consumer routers), and a slightly more transparent open-source story for the controller. Winner for solo/homelab: Tailscale, narrowly. Winner for small business: Tailscale, more decisively. Winner for "I want to flash my router with mesh VPN": ZeroTier.

Tailscale Personal (Free) vs NetBird Free

NetBird's hosted free tier currently allows up to five users and one hundred peers. NetBird is open-source and self-host-friendly; the hosted free plan is similar in spirit to Tailscale's. NetBird's policy UI is more graphical; Tailscale's ACL-as-code is more programmer-friendly. NetBird has fewer ecosystem add-ons (no equivalent to Tailscale SSH session recording, no Aperture-style AI governance). NetBird wins decisively on the self-hosted story, because the same open-source NetBird code that runs the hosted SaaS can be deployed on your own VPS in an afternoon. Tailscale's self-host story requires the third-party Headscale project, covered below. Winner for cloud-managed: Tailscale, on ecosystem maturity. Winner for self-host: NetBird, on first-party support.

Tailscale Personal (Free) vs Nebula (self-host only)

Nebula is the mesh-overlay network originally built by Slack and now maintained by Defined Networking. It is free, self-hosted, command-line first, and has no hosted SaaS option (Defined Networking is a separate paid managed service on top). Nebula is excellent for engineers who want full control and do not mind running their own certificate authority. It does not have MagicDNS or Tailscale SSH equivalents; you wire those up yourself. Nebula's strength is performance and predictable behavior at scale; Slack runs significant production traffic on it. Winner for hands-on control: Nebula. Winner for "I want this to just work": Tailscale.

Tailscale Personal (Free) vs Headscale (self-hosted Tailscale control plane)

Headscale is an open-source reimplementation of the Tailscale control server. It is free, fully self-hosted, and lets you run the Tailscale client against your own coordination server. You give up the official enterprise features and SLA, but you get full data sovereignty. Headscale is the right answer for organizations that genuinely need the Tailscale client experience but cannot, for compliance or sovereignty reasons, route coordination traffic through a vendor. It is also the right answer for the kind of homelabber who treats running infrastructure as the hobby itself. Winner for "I want Tailscale but I don't want Tailscale Inc. to be in the loop": Headscale. Winner for everyone else: Tailscale Personal Free, because you get the same client, the same control plane, the same exit-node logic, and you do not have to operate any servers.

Comparison summary table

The headline observation: in 2026, Tailscale's free tier is the most generous of any hosted mesh-VPN service, and the only competitive moves are in the self-hosted lane (NetBird, Nebula, Headscale), which require operational effort that most users do not want to take on. That positioning is exactly what the Pricing v4 update aimed to reinforce.

Frequently asked questions about Tailscale pricing in 2026

Is Tailscale really free for commercial use on the Personal plan?

The Personal plan is intended for individual and small-team use. The Terms of Service do not block commercial use outright, but the user cap (six) and tagged-resource cap (fifty) are the practical commercial throttles. A solo SaaS founder using free Personal to connect their laptop to their production server is well inside both the spirit and the letter of the plan. A fifty-person company trying to run all its corporate VPN on six Tailscale accounts is not, and would also run into operational limits long before policy ones. The right way to think about it: free Personal is the right plan if your team genuinely is six or fewer real humans, regardless of whether the work is commercial or hobby. It is the wrong plan, and probably a policy violation, if you are trying to share six accounts across thirty actual people.

How many devices can I put on the free plan?

Unlimited, for user-owned devices. Tagged (non-user-owned) resources are capped at fifty, and ephemeral resources are capped at 1,000 minutes per month. A solo user with twenty laptops, phones, tablets, Raspberry Pis, and VMs across multiple cloud accounts is fine. A user trying to register hundreds of CI runners as ephemeral nodes will burn through the monthly minutes long before any device-count ceiling. In practice, almost no one hits the device cap on free, because there is no device cap on user devices. The cap that actually matters is the user cap (six) and, for CI-heavy workflows, the ephemeral minute quota.

What is the actual difference between Free Personal and Standard?

Three big things: user cap (6 vs unlimited), SCIM/MDM/SSO (none vs all), and ACL groups (3 vs 10). Several smaller things: Standard includes group sharing across tailnets, self-serve features like webhooks, and tighter integration with identity providers. If you are a team of seven or more, Standard is the first paid step and almost always the right one before Premium. The honest framing: Free Personal is "everyone in my household and homelab"; Standard is "everyone on my team's payroll"; Premium is "everyone on my team plus the security team has policy requirements."

Does the free plan include SSO?

Sort of. The free plan lets you log in with Google, Microsoft, GitHub, Apple, Passkeys, or email. What it does not include is SAML/OIDC SSO against your own identity provider (Okta, Azure AD beyond basic Microsoft login, Auth0, etc.). For that, you need Standard or higher. For most personal and small-team use, "log in with Google" is the SSO that matters. For a workplace that already has Okta, the SSO that matters is SAML, and that conversation lives on Standard.

How much does Tailscale cost for a 10-person team in 2026?

If everyone is on Standard, $80 per month ($8 multiplied by 10 users). If everyone is on Premium, $180 per month ($18 multiplied by 10). You only need Premium if you have a specific Premium-tier feature requirement (JIT, network logs, session recording, device posture, 300 ACL groups, 10,000 ephemeral minutes/month). For most ten-person SaaS teams, Standard is correct and Premium is overspend. Annual billing typically carries a small discount versus monthly, though the exact percentage is set by Tailscale and shown on the checkout page.

What happens to my Personal Plus subscription now that v4 retired it?

According to the Pricing v4 announcement, Personal Plus subscribers were folded into the expanded free Personal plan and stopped being charged. Everything they had keeps working. There is a twelve-month grandfathering window for all legacy plans during the transition. If you were paying for Personal Plus, you can check your billing page; the line item should already be gone.

Is Tailscale "free forever" actually forever, or will it be paywalled later?

The CEO's blog post and the pricing page both explicitly say "free forever" for the Personal tier. No company can write an unbreakable promise into a SaaS product, but Tailscale has shipped a more generous free tier in v4 than in any previous version. That direction is the opposite of paywall-creep. The most honest answer: free is highly likely to stay free for as long as Tailscale exists in roughly its current form. The strategic logic also supports this; Tailscale's commercial growth comes from teams that started on free, hit the user cap, and converted to Standard. A more restrictive free tier would actively damage that funnel.

Can I switch from Free Personal to Standard without losing my configuration?

Yes. The tailnet, the device list, the MagicDNS names, and the ACL file all transfer cleanly. You log in to the admin console, upgrade the plan, and continue. The only thing you "lose" is the user cap; the rest just unlocks.

How Solomon Signal rates Tailscale, and our buying-decision checklist

Overall: 4.7 / 5.

We score Tailscale highly because the free tier is genuinely usable for the audience that searches for "free VPN" or "mesh VPN free." It is not a trial. It is not a feature-stripped demo. It is a real working network with real WireGuard encryption, real subnet routing, and real ACLs, that costs nothing for up to six users. The paid tiers are honestly priced and the upgrade triggers are obvious. The product is mature, the client is on every platform that matters, and the company shipped a more generous free tier in 2026 instead of a more restricted one, which is the rarest thing in modern SaaS.

We dock half a point for two things. First, the Personal cap of six users is generous in the homelab and family case but will frustrate a seven- or eight-person early startup that has to make the jump to Standard before it really needs the org-scale features that Standard exists to deliver. Second, Tailscale's documentation around its newer features (Aperture, advanced SSH, Tailscale Funnel) is improving but is not yet as discoverable as the core "set up a tailnet" docs were in 2022.

What we like

• Genuinely free for 6-person teams and homelabs. Most "free" VPN products are demos. This one is not.
• WireGuard underneath, which is the best modern VPN protocol we have.
• MagicDNS is on by default and Just Works.
• Tailscale SSH eliminates SSH key juggling at zero marginal cost.
• Seat-based business pricing is predictable and budget-friendly.
• The Pricing v4 update was generous, not extractive, which signals good company alignment.
• Personal Plus retirement removed a confusing in-between tier and made the lineup clearer.
• Exit nodes turn any device into your privacy-routed gateway, useful for travel.
• Cross-platform clients (macOS, Windows, Linux, iOS, Android, AppleTV, Synology, etc.) are all first-class.
• Mullvad integration is an unusually clean privacy upgrade for $5 per month per five devices.

What we don't like

• Personal user cap of 6 is just below where many small teams sit.
• Ephemeral minute quota on free (1,000/mo) is tight for any serious CI use.
• No SAML SSO on free is correct policy but worth knowing.
• Aperture and AI-governance features are still maturing; documentation lags slightly.
• Network logs require Premium, which is correct gating but a real cost step for security-conscious smaller teams.
• Self-host requires Headscale, a third-party project, rather than a first-party option.

Buying decision: a clean five-step checklist

If you are still on the fence, here is the buying-decision walk in five steps.

1. Count your users. Six or fewer, and you start on Free. Seven or more, and Standard is the floor.
2. Count your tagged resources. Under fifty, free covers it. Over fifty, Standard.
3. Estimate your monthly ephemeral CI minutes. Under 1,000, free. Between 1,000 and 10,000, Standard. Over 10,000, Premium.
4. List your security requirements. If anyone in your org has a checklist that includes SCIM, SSO, MDM, network logging, JIT access, device posture, or session recording, you are paying. Map the checklist to Standard or Premium.
5. Sign a contract or not. If procurement needs an MSA/SLA/invoice billing, Enterprise. Otherwise, Standard or Premium is self-serve via credit card.

For everyone outside the "we need a contract" lane, Tailscale is one of the easier purchase decisions in modern infrastructure. The free tier is honest. The paid tiers are seat-priced and predictable. The upgrade triggers are obvious. The downgrade path (within twelve-month legacy windows) is friendly.

Cost worked example: what a typical small team actually pays

Imagine a real team to make the numbers concrete. Acme Indie LLC is a ten-person SaaS. Two cofounders, four engineers, one designer, one head of marketing, one fractional operations lead, and one fractional security consultant. They want a single VPN solution for development access, staging access, internal tooling access, and SSH to production.

On free Personal: not possible, because ten users exceeds the six-user cap. The team would have to operate in two split tailnets, which loses the entire benefit of a unified network. Free is out.

On Standard: ten seats at $8 per month each is $80 per month, or $960 per year. The team gets SCIM (so when the fractional security consultant rolls off, their access automatically deprovisions), SSO against their Google Workspace identity, MDM support if they ever choose to roll out a centrally managed device fleet, ten ACL groups (enough to model "engineers", "non-engineers", "production-only", "staging", "internal tools", and a few specialized roles), and 1,000 ephemeral resource-minutes per month for any CI work. For most ten-person SaaS teams in 2026, this is the right plan and the right line item.

On Premium: ten seats at $18 per month each is $180 per month, or $2,160 per year. Premium is the right call only if the security consultant has explicitly asked for JIT access to production, session-recorded SSH for audit, network logs for SIEM, or device posture checks. Without one of those triggers, Premium is over-spend by $120 per month.

Annualized, the Standard story is "less than the cost of a single Linear seat across the team." The Premium story is "less than two Slack Pro seats across the team, plus all your audit-ready security controls." For most people researching this query, that math is more useful than feature lists.

Migration paths: how to actually upgrade or downgrade

Tailscale's plan-change UX is unusually clean. To upgrade from Free to Standard, you log in to the admin console at login.tailscale.com, navigate to Settings, click the plan picker, choose Standard, enter a billing method, and you are done. Existing tailnet, existing devices, existing ACL file, existing MagicDNS names all keep working. The user cap immediately lifts, SCIM and SSO features appear in the admin nav, and you can start using them in the same session.

Upgrading from Standard to Premium follows the same flow, with the bonus that the new features (JIT, session recording, network logs, posture) appear as new admin nav items rather than overhauling anything existing. Premium is a strict superset of Standard.

Downgrading from Standard back to Free is allowed, with one constraint: you need to be back inside the six-user cap before the downgrade takes effect. If you have ten users, you first have to remove or deactivate four of them, then choose Free, then the admin console will let you complete the change.

Downgrading from Premium to Standard is straightforward and the same flow, with the constraint that you lose Premium-only features at the moment of downgrade. Network logs stop being collected; JIT access flows turn off; session recordings remain accessible for thirty days (per Tailscale's stated data retention) before being purged.

The Enterprise plan has a contract-managed migration story rather than a self-serve one, but the technical mechanism is the same. Plans are a billing posture; the tailnet is a separate object that does not need to move.

Practical homelab and indie-developer setup notes

A few setup details that matter for real-world free-tier use:

Always-on Apple TV exit node. A surprisingly popular 2026 Tailscale pattern is to designate a home Apple TV (or low-power Linux box, or Raspberry Pi) as an always-on exit node. The exit node sits on your home network with a stable IP, runs Tailscale in the background, and acts as your "phone home" gateway. From your laptop at a coffee shop, you flip on the exit node and now your traffic appears to come from your home connection. This is one of the most common reasons solo users adopt Tailscale, and it costs nothing on free.

Subnet router for the rest of the house. Pair the always-on device with subnet routing and your tailnet reaches every device on the home LAN, even devices that do not run a Tailscale client themselves: printers, TVs, IoT, the spouse's laptop. Each subnet router counts as one tagged resource against the fifty-resource free cap; one is usually enough.

Tailscale Funnel for public-facing services. Tailscale Funnel (announced earlier and still part of the product in 2026) lets you expose a tailnet-internal service to the public internet through a Tailscale-managed TLS-terminating proxy. This is useful for self-hosting a webhook target, a quick demo URL, or a small public site without managing certificates or opening firewall ports. Tailscale Funnel is available on the free plan with quotas; it is not a free pass to run a production website, but it is a legitimate path for hobby and small-scale public exposure.

MagicDNS for inter-device hostnames. On a fresh tailnet, MagicDNS is the feature that pays for itself fastest. Instead of remembering that the home server is 100.85.42.17, you reach it as homeserver. The DNS query is intercepted by the Tailscale client and resolved against your tailnet directory. It works on every platform, costs nothing on free, and removes the most common friction point for new users.

Tailscale SSH instead of OpenSSH. Once your tailnet is up, switch SSH workflows over to Tailscale SSH. You stop managing keys. You stop worrying about which key is on which laptop. You stop renting a bastion host. The cost is zero on free; the upside is one of the biggest day-to-day quality-of-life upgrades available in modern devops.

Where to verify the current numbers yourself

Pricing pages drift. Three places will always tell you the absolute current truth about Tailscale plans: the Tailscale pricing page (the canonical source), the Pricing v4 announcement (CEO's own framing of the current model), and your own admin console once you have logged in (which shows the exact plan you are on and the exact quotas you have used).

If you are still researching, three useful next steps from here: read the pricing page directly for the absolute current numbers; read the Pricing v4 announcement to understand the company's pricing philosophy directly from the CEO; and check out other Solomon Signal reviews for adjacent stack decisions, including Ahrefs for SEO-side competitive intel, Ahrefs Webmaster Tools for a free-tier SEO toolkit comparison, or the Launch School reviews hub for everything we have rated. For a broader survey of the indie-to-startup tool stack, the Solomon Signal Launch School is the main pillar where reviews, tutorials, and alternatives all link from.

Bottom line: Tailscale is free for up to six users, and the free tier is the real product

Tailscale is free for up to six users in 2026, and the free tier is the real product, not a trial. Paid plans start at $8 per user per month for Standard and go to $18 per user per month for Premium, with sales-quoted Enterprise on top. The upgrade triggers are obvious (user count, SCIM/SSO, network logs, JIT access). Most individuals and small teams will never pay. Teams that do pay will find seat-based billing predictable and the value steps clear.

This page reflects the post-v4 reality as of 2026-05-20. Tailscale ships pricing changes infrequently (v4 is the first significant restructure since 2022), so this guide should remain accurate for some time. We will refresh it whenever tailscale.com/pricing changes materially.

If you take only one paragraph from this guide, take this one: if you are a solo developer, a homelab operator, a freelancer, or a team of six or fewer, the free Personal plan is the entire product and you should sign up at tailscale.com today; if you are seven or more humans, or you have a compliance checklist that includes SCIM/SSO/MDM, move to Standard at $8 per user per month; if your security team has explicitly asked for JIT access, session recording, network logs, or device posture, move to Premium at $18 per user per month; and if procurement needs an MSA, go to Enterprise. That is the whole decision tree.

One more practical note. Tailscale rolls out client updates roughly every two weeks across all platforms, with security fixes shipped faster. The auto-update default on most platforms means most users never have to think about patching, which is one of the underrated reliability advantages of using a hosted mesh VPN versus rolling your own. If you are on the free Personal plan in 2026, you get the exact same client, the exact same update cadence, and the exact same security posture as a paying Enterprise customer; the only thing the paid plans add is org-scale management and audit features, not the underlying connectivity or encryption.

Have a question about your specific situation? Solomon Signal's Launch School reviews hub collects honest comparison guides like this one across the indie-developer toolchain.

Pros and cons