Tailscale vs ZeroTier
Tailscale and ZeroTier compared as mesh VPNs for developers and homelabs: seat vs device pricing, free-tier limits, WireGuard vs Layer 2 networking, relays, exit nodes, self-hosted controllers and licences, with current 2026 plans.
Quick Answer
Tailscale is the better default for most developers: the free Personal plan covers up to 6 users with unlimited user devices, exit nodes and Funnel are on every plan, and setup is a login with an identity provider. ZeroTier is the pick when you need a real Layer 2 network (broadcast, multicast, Ethernet bridging), want a controller you can run yourself, or have many users but few devices, since it bills per device rather than per seat.
Last updated October 19, 2026. Uses Tailscale's current seat-based Personal/Standard/Premium plans and ZeroTier's October 2026 Personal/Essential/Scale device pricing, plus both projects' current licence files.
| Feature | Tailscale | ZeroTier |
|---|---|---|
| Free Plan | Personal: up to 6 users, unlimited user devices, 50 tagged resources | Personal: 10 devices, 1 network, 1 admin |
| Entry Paid Plan | Standard $8/user/month | Essential $18/month (10 devices) |
| Pricing Model | Per seat (user); user devices unlimited | Per device ($2 extra on Essential, $1.80 on Scale) |
| Free Plan for Business Use | No (Personal plan is non-commercial) | No (Personal plan is non-commercial) |
| Tunnel Protocol / Crypto | WireGuard | Custom (Curve25519/Ed25519, Salsa20/Poly1305) |
| Network Layer | IP (WireGuard encapsulates IP packets) | Ethernet (Layer 2) emulation: multicast, broadcast, bridging |
| NAT Traversal Fallback | DERP relays (HTTPS) + peer relays; direct UDP 41641 | Root-server relaying, own roots (moons), self-hosted TCP relay; UDP 9993 |
| Exit Nodes | All plans | Not listed on pricing page |
| Expose a Service to the Internet | Funnel, all plans (beta; ports 443, 8443, 10000) | Not listed on pricing page |
| Self-Hosted Control Plane | Not offered; third-party Headscale (single tailnet) | Built-in controller (non-commercial licence); commercial self-hosting on Enterprise |
| Licence | Client BSD-3-Clause; coordination service is SaaS | Agent MPL-2.0; controller source-available (non-commercial) |
| SSO / Identity | IdP sign-in on all plans; SCIM from Standard | OIDC SSO from Essential |
Tailscale
WireGuard-based mesh VPN with a hosted coordination service: devices sign in through an identity provider, get stable tailnet IPs and connect peer to peer, falling back to relays when NAT gets in the way.
Pros
- Free Personal plan covers up to 6 users with unlimited user devices and 50 tagged resources
- Exit nodes and Funnel (public HTTPS to a tailnet service, in beta) are available on all plans
- Data plane is standard WireGuard, and the client is BSD-3-Clause open source
- Every connection works out of the box: DERP relays over HTTPS first, then an upgrade to direct UDP or a peer relay
- Seat-based pricing means adding laptops, phones and homelab boxes for existing users costs nothing
- Extras developers actually use: MagicDNS, subnet routers, Tailscale SSH, a Kubernetes operator and a GitHub Action for ephemeral CI nodes
Cons
- The free Personal plan is for non-commercial use only; a custom-domain tailnet is treated as business use
- Tailscale does not offer a self-hosted control plane; the self-hosted route is the third-party Headscale project, scoped to a single tailnet
- IP-level tunnels only, so no Ethernet broadcast, multicast-style LAN discovery or bridging like ZeroTier's Layer 2
- Paid plans are per seat ($8 Standard, $18 Premium), which adds up for teams with many users and few devices
- Two devices both behind hard NAT cannot connect directly and stay on a relay unless you run a peer relay
Best For
Developers, homelabbers and small teams who want remote access to servers and devices working in minutes, with exit nodes and public sharing included.
ZeroTier
Peer-to-peer virtual network that emulates an Ethernet switch: nodes find each other through root servers, join networks defined by a controller, and get Layer 2 features such as broadcast, multicast and bridging.
Pros
- True Layer 2: Ethernet emulation with multicast, broadcast and controller-approved Ethernet bridging
- Per-device pricing suits teams with many users and few machines: Essential includes unlimited users
- The controller is built into the node software and driven by a local API, so you can run your own for non-commercial use
- You can add your own root servers (moons) and host a TCP relay when a network blocks UDP entirely
- Agent is MPL-2.0, and Essential adds OIDC SSO, an API and 30-day audit logs
Cons
- Free Personal plan is non-commercial and capped at 10 devices, one network and one admin
- Controller code sits in the repo's nonfree directory under a source-available, non-commercial licence; commercial self-hosting is an Enterprise feature
- Custom protocol rather than WireGuard, and ZeroTier's own docs say it does not implement forward secrecy in VL1
- Paid plans jump fast: Essential is $18/month for 10 devices plus $2 per extra device, Scale is $179/month
- The pricing page does not list exit nodes or a public-sharing feature comparable to Tailscale Funnel
Best For
Networks that need Layer 2 behaviour (LAN discovery, legacy protocols, bridging), self-run controllers for personal use, and organisations with many users per device.
Pricing: seats versus devices
The two products charge for different things, so the cheaper one depends on the shape of your network. Tailscale bills per seat. Standard is $8 per user per month and Premium $18, and user devices are unlimited on every plan, so a developer with a laptop, a phone and a desktop occupies one seat. Shared infrastructure such as servers, subnet routers and app connectors should be tagged, which makes them tagged resources rather than user devices. The pricing page lists 50 tagged resources included on Personal and extra tagged resources at $1 per month each, so check your plan's allowance before tagging a large fleet. ZeroTier bills per device. Essential is $18 per month with 10 devices, unlimited users and 10 networks, then $2 per extra device. Scale is $179 per month with 100 devices, $1.80 per extra device and unlimited networks. Worked through: five developers with 35 devices between them pay $40 a month in Tailscale seats, before any tagged-resource charges. On ZeroTier Essential the same 35 devices cost $18 plus 25 × $2, or $68. Essential passes Scale's $179 at about 90 devices, so a fleet that size should be on Scale. Flip the shape, say 40 users sharing 10 kiosks, and ZeroTier Essential is $18 while Tailscale Standard is $320.
Free plans and the commercial-use line
Both free plans are generous for personal use and both exclude business use, which matters if you were planning to run a startup's infrastructure on them. Tailscale's Personal plan is free forever for up to 6 users, with unlimited user devices, 50 tagged resources, 3 ACL groups and 1,000 ephemeral minutes a month for short-lived nodes such as CI runners. Tailscale's FAQ says the plan is only for non-commercial use. A tailnet created with a public-domain login (Gmail, Apple, a personal GitHub) is enrolled in Personal automatically, while one created with a custom domain is treated as business use and starts a 14-day Enterprise trial. If the trial lapses without a plan, existing devices keep working, but new users and devices cannot become active. ZeroTier's Personal plan is for personal, non-commercial use, with 10 devices, one network and one network admin, plus the CLI, UI, webhooks and community support. The paid plans are where the commercial licence appears: Essential, Scale and Enterprise each include one. For a homelab, Tailscale's free tier goes further: unlimited user devices beat a 10-device cap. For a company, the real comparison is Tailscale Standard against ZeroTier Essential, using the worked costs above.
Networking model: WireGuard IP tunnels versus Layer 2 Ethernet
This is the technical split that should decide most choices. Tailscale's data plane is WireGuard, which encapsulates IP packets over UDP. Every connection starts on a DERP relay, which only needs outbound HTTPS, and Tailscale then tries NAT traversal to upgrade to a direct UDP tunnel, with UDP 41641 the default port. If that fails it tries a peer relay running on your own infrastructure, and otherwise stays on DERP. Tailscale's docs note that two devices both behind hard NAT, which many cloud NAT gateways behave like, cannot connect directly. On top of the tunnels you get MagicDNS, subnet routers, exit nodes and ACLs. ZeroTier splits its protocol in two. VL1 is a peer-to-peer virtual wire that discovers peers through root servers, punches holes for direct links and falls back to relaying. VL2 emulates Ethernet: networks support multicast through publish/subscribe, broadcast is a multicast group all members join, and the controller can designate members as Ethernet bridges. The default port is UDP 9993, and when a network blocks UDP entirely ZeroTier suggests hosting a TCP relay nearby. If your use case is SSH, databases and web services, IP tunnels are all you need. If you need LAN game discovery, mDNS-style service discovery, non-IP protocols or a bridged physical segment, ZeroTier's Layer 2 does things Tailscale's model does not attempt.
Self-hosting and licensing
Developers drawn to self-hosting should read the licences before choosing. Tailscale's client is BSD-3-Clause, but the coordination service that handles keys, ACLs and device approval is Tailscale's SaaS. Tailscale does not sell a self-hosted control plane. The usual alternative is Headscale, a BSD-3-Clause, self-hosted implementation of the Tailscale control server. Its README says it is not associated with Tailscale Inc. (one maintainer is a Tailscale employee) and deliberately covers a narrow scope: a single tailnet, aimed at personal use and small open-source groups. ZeroTier's repository is split. The agent is MPL-2.0. The controller and related components live in a nonfree directory under the ZeroTier Source-Available License, which allows non-commercial use and requires a separate commercial licence for any use by or for a company, including development and staging environments used for business. The controller itself is easy to start: every node can act as one, and you create networks and authorise members through the local API on port 9993. ZeroTier lists self-hosted and air-gapped deployment as an Enterprise feature. So for a personal network you control end to end, ZeroTier's built-in controller and Headscale both work. For a company that must self-host, ZeroTier Enterprise is the vendor-supported path; Tailscale has none.
Verdict
Choose Tailscale if you want remote access to your servers, laptops and homelab with the least setup: the free plan covers up to 6 users and unlimited user devices for personal use, exit nodes and Funnel are on every plan, and the data plane is plain WireGuard. Choose ZeroTier if your workload needs a Layer 2 network, such as LAN discovery, broadcast or multicast, legacy protocols or bridging a physical segment, or if you want to run your own controller for a personal network. ZeroTier's per-device pricing also wins for organisations with many users and few machines, while Tailscale's per-seat pricing wins when a few people own many devices. For business use, budget for a paid plan on either: both free plans are non-commercial.