Headscale vs Tailscale

Last reviewed Aug 25, 2026 · 646 words

This isn't a comparison of two VPNs — Headscale is the Tailscale system with one organ transplanted. The WireGuard tunnels, the clients on every platform, the NAT traversal: identical, because Headscale users run the official open-source Tailscale clients pointed at a different login server. What changes hands is the coordination server — the control plane that authenticates devices, distributes public keys, and pushes network maps. Tailscale-the-company hosts theirs; Headscale is the community's open-source reimplementation you host yourself. So the real question: who should run your network's brain?

What the hosted control plane costs you

Precision matters here. Your traffic does not flow through Tailscale's servers — sessions are end-to-end encrypted WireGuard between your devices, with DERP relays carrying only ciphertext when NAT traversal fails. What Tailscale's control plane does hold: your device inventory, keys' public halves, network topology, account identity, and the ability to add a device to your network if their infrastructure or your SSO account were compromised. That last item is the serious one — the control plane is a trust root, mitigated by device approval, tailnet lock (which makes new nodes require signing by your existing trusted nodes), and hardware 2FA on the account. For most threat models, those mitigations plus a company whose entire business is this service beat a self-run alternative. The remote access overview lands the same way.

What Headscale gives, and what it asks

Headscale removes the third party entirely: a single Go binary (SQLite state, ~128 MB) on a small VPS becomes your coordination server, clients register to https://headscale.example.com, and features cover the essentials — MagicDNS, ACLs, exit nodes, subnet routers, pre-auth keys, embedded DERP relay. No device caps, no plan tiers, no account with anyone.

The asks are equally concrete. You now operate the most security-critical service you own: its TLS, its updates, its backup (lose the database and every device re-registers), and its availability — when Headscale is down, existing tunnels keep working but nothing new can join and expired keys can't renew. Some polish is absent by design: no official admin GUI (community ones exist), no Funnel-style public sharing, and client features occasionally land before Headscale supports their server side, since the project tracks a moving proprietary target. None of this is a criticism — the Headscale guide shows it's an evening's setup — but "self-host the trust root" is a commitment, not a checkbox.

The decision, without romance

The uncomfortable observation for a self-hosting directory: the coordination server is the rare component where the hosted option is often the more secure choice in practice, because Tailscale's operational security (dedicated team, tailnet lock, audited infra) exceeds what most individuals will sustain on a $5 VPS they patch quarterly. Headscale's case is strongest on principle (no third party in your network, full stop), on scale (past the free tier's 3 users, hosted pricing starts competing with a VPS), and on air-gapped or compliance-bound networks where an external control plane is disqualified outright.

Decision table

What I'd do

Hosted Tailscale with tailnet lock enabled, device approval on, hardware key on the account — that configuration answers the realistic threats while keeping the zero-maintenance property that made Tailscale worth adopting. Move to Headscale when a concrete reason arrives (user count, policy, principle you're willing to fund with operational care), and do it as a planned migration — the clients don't care, which is the quiet beauty of the whole arrangement.