Tailscale review

Tailscale describes itself as an identity-based connectivity platform for replacing legacy VPNs, SASE and PAM. It connects remote teams, cloud environments, infrastructure, devices and AI workloads, with access controlled by identity and least-privilege policies.

The product covers more than remote access to a home or office network. Tailscale says teams can connect directly to infrastructure, including Kubernetes clusters without bastions, and to private apps without exposing them publicly. Its mesh overlay networking connects cloud and on-prem environments, and it can connect CI/CD pipelines and runners across multiple cloud environments.

The practical question is whether you want a managed way to connect people and systems, or prefer to operate the networking layer yourself. Tailscale is built around the former. That can suit teams replacing a legacy VPN, but it also means evaluating per-user costs and reliance on a third-party provider—not just the feature list.

Tailscale’s range is its clearest advantage: the same platform is presented for employee access, infrastructure, private apps and CI/CD connectivity. Teams can use identity-based access controls to apply least privilege, while the mesh overlay links cloud and on-prem environments. The stated option to reach Kubernetes without bastions may also appeal to teams trying to simplify infrastructure access.

The free Personal plan gives individuals and home users a low-cost way to start: the pricing page lists up to 6 users, unlimited user devices, up to 3 ACL groups, 50 tagged resources and 1,000 ephemeral minutes per month. For a team, Standard is $8 per user per month and includes unlimited users, up to 10 ACL groups, SCIM and MDM configuration, and basic Tailscale SSH for up to 5 hosts.

Premium is $18 per user per month. It raises the limits to 300 ACL groups and 10,000 ephemeral minutes, and adds just-in-time resource access, advanced SSH, network flow logs and log streaming. The plan ladder is relatively clear; whether its per-user cost works depends on team size and which controls you need.

The bill scales with users: Standard is $8 per user per month and Premium is $18, while Enterprise pricing is custom. The pricing page shows monthly prices; annual rates are not published, although it references annual subscriptions. A 14-day free trial is listed, but the ongoing free Personal plan is capped at 6 users, 3 ACL groups and 50 tagged resources. Standard includes only 1,000 ephemeral minutes monthly; Premium includes 10,000. One Reddit commenter clarified that ephemeral minutes apply to short-lived nodes, not ordinary usage such as accessing a Jellyfin server.

Some costs sit outside the headline price. The page lists Mullvad at $5 per month per 5 devices and additional tagged resources at $1 per month each. Extra ephemeral usage requires contacting sales, as do platform extensions including PAM, AI governance, CI/CD and Edge & IoT connectivity. Support add-ons are separately scoped.

There is also a vendor-dependence trade-off. In one Reddit thread, self-hosting users objected to relying on a third-party, VC-backed service and suggested Headscale as an alternative. That is a preference, not proof of a specific failure, but teams that require self-hosting should weigh it before switching.

The pricing page lists Personal at $0/month for up to 6 users, with unlimited user devices, up to 3 ACL groups, 50 tagged resources and 1,000 ephemeral minutes monthly. Standard is $8 per user/month, with unlimited users, up to 10 ACL groups and basic Tailscale SSH for up to 5 hosts. Premium costs $18 per user/month: 2.25 times Standard, adding up to 300 ACL groups, 10,000 ephemeral minutes, just-in-time access and advanced SSH.

That tier jump matters as headcount grows: the listed prices are per user, not per team. Enterprise pricing is custom. Mullvad is $5/month per 5 devices; extra tagged resources are $1/month each. For ephemeral usage beyond the included minutes, the pricing information says to contact sales. Support SLAs and platform extensions, including PAM and CI/CD, are separately scoped or require contacting sales.

Prices are shown monthly. Annual rates are not published, despite a reference to annual subscriptions. A 14-day free trial is listed.

Tailscale is positioned as a replacement for legacy VPNs, connecting remote users, cloud and on-prem infrastructure through identity-based access. Before switching, inventory who needs access to which apps, devices and infrastructure, then map those requirements to your access rules and plan limits. The published pricing details do not specify migration tools or services beyond Enterprise implementation assistance, so estimate setup effort with your own environment in mind.

Treat reliance on Tailscale’s service and access configuration as a switching consideration, especially if you need fully self-hosted control; our verdict flags that as a poor fit. The published materials do not describe data-export options, so verify what you can export and how before committing. They also include no Reddit posts or comments, so we can’t substantiate claims about why users leave based on Reddit. Ask for an exit process covering access policies, connected systems and any separately scoped extensions.