Corporate VPNs are dying a slow death, and the three companies racing to bury them just gave buyers a lot to think about in a single month. Twingate’s top self-serve tier, Business, is priced at $10 per user per month. Tailscale, meanwhile, quietly finished a shift from usage-based billing to flat per-seat pricing back in April, a change that still trips up teams sizing their bill today. NetBird, the open-source challenger of the three, keeps undercutting both with a self-hosted option that costs nothing but server time.
All three sell the same basic pitch: replace your site-to-site VPN and your crumbling perimeter firewall with a WireGuard-based mesh that only lets authenticated devices talk to the resources they are explicitly allowed to reach. That is the essence of Zero Trust Network Access, a model the National Institute of Standards and Technology formalized in Special Publication 800-207. But the three products get there through very different architectures, price structures, and hosting models, and picking wrong means re-platforming your entire remote-access layer a year from now.
This comparison breaks down Tailscale, Twingate, and NetBird as they stand in late September 2026: current pricing, GitHub activity, architecture, setup speed, and the use cases where each one actually wins. Every number below comes from each vendor’s live pricing page, changelog, or public GitHub repository, checked this week.
What Zero Trust Network Access Actually Replaces
Traditional corporate VPNs work on an all-or-nothing model. Once a laptop authenticates to the VPN concentrator, it typically lands on the internal network with broad routing access, and internal segmentation has to do the rest of the security work. That model breaks down badly with distributed teams, contractor access, and cloud infrastructure spread across multiple providers. Zero Trust Network Access flips the model: every connection is evaluated per-resource, per-device, and per-identity, and nothing is trusted by default just because it is “inside” the network.
Tailscale, Twingate, and NetBird all build on this idea, and all three lean on the WireGuard protocol for the actual encrypted tunnel. WireGuard is lighter and faster than IPsec or OpenVPN, and it is the reason all three products can claim near-native throughput on modern hardware. Where they diverge is in what sits above that tunnel: how devices discover each other, how policy gets enforced, and whether you can run the control plane yourself or you are locked into the vendor’s cloud.
That distinction matters more in 2026 than it did two years ago. Cloud infrastructure teams are increasingly required to prove where control-plane data lives, particularly for regulated workloads in the EU and for companies handling government contracts. A tool you can self-host end-to-end, like NetBird, answers that requirement in a way a fully SaaS product cannot.
Tailscale, Twingate, and NetBird at a Glance
Before getting into pricing and architecture in detail, here is the full technical snapshot of all three platforms as they ship today, in late September 2026.
| Specification | Tailscale | Twingate | NetBird |
|---|---|---|---|
| Underlying protocol | WireGuard | WireGuard-based tunneling | WireGuard |
| Architecture model | Peer-to-peer mesh with DERP relay fallback | Split-tunnel via regional Connectors | Peer-to-peer mesh with relay fallback |
| Open source | Client and coordination server components open source | Closed source client and controller | Fully open source, BSD-3 + AGPLv3 license |
| Self-hosting option | Limited (Headscale is a community-run alternative control plane) | Not officially supported | Yes, official self-hosted deployment supported |
| Free tier | Personal plan, $0, up to 6 users, unlimited devices | Free tier available (device/user cap not publicly itemized) | Free tier plus fully free if self-hosted |
| Entry paid tier | Standard, $8/user/month | Entry paid tier from $5/user/month | Business, €12/user/month (~$13) |
| Top self-serve tier | Premium, $18/user/month | $10/user/month (Business tier) | Custom enterprise pricing |
| Enterprise pricing | Custom quote, ~$21,000 median annual contract (Vendr-tracked deals) | Custom quote | Custom quote |
| Billing model | Per-seat (moved from monthly-active-user billing on April 8, 2026) | Per-seat | Per-seat (self-hosted: infrastructure cost only) |
| GitHub stars (core repo) | ~36,900 | Not applicable (closed source) | ~28,600 |
| Latest tracked version | Rolling release via app updates | Rolling release via web app | v0.77.1 (Aug. 21, 2026) |
| DNS-level filtering | Available via Tailscale ACLs and MagicDNS | DNS Filtering as a named, billed feature | Available via routing policy |
| Notable September 2026 change | Billing terminology updated in changelog to Free/Starter/Premium/Enterprise naming | Regional account migration to new “us1” service shard on Aug. 29, 2026 | Business plan pricing published in euros, reflecting EU-first customer base |
A few things jump out immediately. Tailscale is the only one of the three with a fully documented, unambiguous free tier: six users, unlimited devices, zero dollars, forever. Twingate’s free tier exists but the company has not published the exact user or device ceiling on its current pricing page, which is a real gap for anyone trying to budget ahead of a trial. NetBird is the only one that lets you skip the pricing conversation altogether by self-hosting the entire stack, control plane included, under a BSD-3 and AGPLv3 dual license.
Architecture Differences: Mesh, Relays, and Self-Hosting
The single biggest technical decision buried in this comparison is how each product routes traffic once two devices need to talk. Get this wrong for your topology and you will see latency or connectivity problems that no amount of pricing negotiation fixes.
Tailscale’s DERP Relay Network
Tailscale tries direct peer-to-peer connections first, using NAT traversal techniques borrowed from WebRTC-style STUN. When a direct path is not possible, usually because both sides sit behind restrictive corporate firewalls, it falls back to Tailscale’s own DERP (Designated Encrypted Relay for Packets) relay network. That fallback still carries end-to-end encrypted traffic, but it adds latency compared to a direct connection. Tailscale’s coordination server, which handles device authentication and key distribution, is closed by default but has an open-source community reimplementation called Headscale that lets teams run their own control plane if they are willing to give up official support.
Twingate’s Connector Model
Twingate takes a different shape entirely. Instead of a full mesh where every device can theoretically reach every other device, Twingate deploys lightweight software Connectors inside each private network or cloud VPC you want to expose. Client traffic routes through the nearest Connector rather than directly to the destination device. This is closer to a traditional reverse-proxy model than a true mesh, and it is part of why Twingate markets itself heavily on granular, resource-level access policies and DNS Filtering that can be applied at the router or firewall level, a feature the company bills separately per user.
NetBird’s Self-Hosted Management Plane
NetBird is architecturally closest to Tailscale, a peer-to-peer WireGuard mesh with relay fallback for NAT traversal, but it ships the entire stack as open source under a BSD-3 and AGPLv3 dual license. That means the management plane, the signaling server, and the relay infrastructure can all run on your own infrastructure, not just the client. Version 0.77.1, released August 21, 2026, is the latest tracked build, and the project sits at roughly 28,600 GitHub stars, about 8,300 behind Tailscale’s core repository. For teams with strict data-residency requirements, this is the only one of the three where “self-hosted” means the full product, not just the endpoint client.
Here is a simplified example of the kind of access policy syntax you would write for a mesh-style ZTNA tool, illustrating how resource-level rules get expressed as code rather than firewall rules:
{
"groups": {
"group:engineering": ["alice@company.com", "bob@company.com"],
"group:contractors": ["dave@vendor.com"]
},
"acls": [
{
"action": "accept",
"src": ["group:engineering"],
"dst": ["tag:staging-db:5432", "tag:internal-api:443"]
},
{
"action": "accept",
"src": ["group:contractors"],
"dst": ["tag:internal-api:443"]
}
]
}Tailscale, Twingate, and NetBird all express access rules this way in some form, whether through a JSON access-control policy, a resource-tagging system, or a group-based rules editor in a web console. The underlying idea across all three is the same: access is defined per resource and per identity group, not per subnet.
Pricing Comparison: Free Tiers, Per-Seat Costs, and the September Price Cut
Pricing is where the most news actually happened in the last month, so it is worth laying out clearly. Twingate’s top self-serve tier, Business, is priced at $10 per user per month, with no reported price cut in September 2026. That undercuts Tailscale’s equivalent Premium tier, priced at $18 per user per month, by a meaningful margin at any team size above a handful of seats.
| Plan tier | Tailscale | Twingate | NetBird |
|---|---|---|---|
| Free / Personal | $0, up to 6 users, unlimited devices | Free tier available, limits not itemized publicly | Free tier available, self-hosted deployment is free of license cost |
| Entry paid plan | Standard: $8/user/month | From $5/user/month | Not separately named, Business plan is entry paid tier |
| Mid/top self-serve plan | Premium: $18/user/month | $10/user/month (Business tier) | Business: €12/user/month (~$13) |
| Enterprise | Custom quote, ~$21,000 median annual contract | Custom quote | Custom quote |
| Billing unit change in 2026 | Switched from monthly-active-user to per-seat billing, April 8, 2026 | No billing-model change reported, price reduction only | No change reported |
| Self-hosted total cost | Not officially supported at full parity (Headscale is community-run) | Not supported | Infrastructure cost only, no per-seat license fee |
The Tailscale billing change is worth calling out specifically, because it caught some existing customers off guard. Before April 8, 2026, Tailscale billed based on monthly active users, meaning a seat that connected once and then went dormant for the rest of the month cost less than a seat used daily. The new model bills every assigned seat whether or not that person connects at all in a given billing cycle. For teams with a lot of occasional users, such as contractors who connect a few days a month, that change can raise the effective bill noticeably even though the sticker price per seat did not move.
NetBird’s pricing story is simpler to summarize but harder to compare apples to apples: because the entire platform can be self-hosted, a security-conscious team with existing DevOps capacity can run NetBird for the cost of a small VPS, with no per-seat fee at all. That is not a hypothetical edge case. It is the primary reason platform engineering teams reach for NetBird over the other two when data residency or vendor lock-in is a board-level concern.
Cost at Scale: What 50 and 500 Seats Actually Cost
Per-seat pricing looks abstract until you run it against a real headcount. The numbers below model a 50-person engineering org and a 500-person company, using each vendor’s published self-serve rate card as of late September 2026. Enterprise deals negotiate down from these list prices, but list price is what most teams actually budget against before a sales call ever happens.
| Team size | Tailscale Standard ($8/user) | Twingate Business tier ($10/user) | NetBird Business (~$13/user) |
|---|---|---|---|
| 50 seats | $400/month | $500/month | $650/month (or near-zero if self-hosted, plus server cost) |
| 500 seats | $4,000/month | $5,000/month | $6,500/month (or near-zero if self-hosted, plus server cost) |
| Annual cost at 500 seats | $48,000/year | $60,000/year | $78,000/year hosted, typically a few thousand dollars a year in infrastructure if self-hosted |
The gap gets stark at enterprise scale precisely because NetBird’s self-hosted path removes the per-seat multiplier entirely. A 500-person company running its own NetBird control plane on a modest cluster of cloud instances can realistically spend a small fraction of the $48,000 to $78,000 a year that Tailscale or Twingate would charge at list price for the same headcount, though that comparison ignores the internal engineering time needed to operate the self-hosted stack, which is a real and sometimes underestimated cost of its own.
Tailscale’s own enterprise deals tell a similar story in reverse. Vendr, a SaaS-procurement benchmarking firm that tracks real negotiated contract data, reports a median annual Tailscale Enterprise contract of roughly $21,000 across its tracked deal set, a figure that sits below what a naive 500-seat Standard-tier calculation would suggest, implying that most enterprise buyers negotiate meaningful discounts off list price once they cross into custom-quote territory.
Independent Benchmarks and Analyst Data
Beyond each vendor’s own pricing page, three independent trackers publish comparative data on this category that is worth weighing alongside the vendor marketing. WZ-IT’s 2026 mesh VPN market overview, which benchmarks Tailscale against NetBird, Headscale, ZeroTier, Netmaker, and Nebula side by side, lists NetBird at version 0.77.1 with roughly 28,615 GitHub stars against Tailscale’s approximately 36,900, and confirms both vendors’ free-tier and entry-paid pricing lines up with what each company publishes on its own site, a useful independent cross-check when two pricing pages disagree on formatting.
CheckThat.ai’s Tailscale pricing analysis is the source for the Vendr-tracked $21,000 median enterprise contract figure cited above, and it independently confirms the April 8, 2026 shift from monthly-active-user to per-seat billing, noting that user-owned devices remain unlimited on every tier while shared infrastructure, such as subnet routers and app connectors, gets billed separately as tagged resources rather than as seats.
CostBench’s software pricing page lists Twingate’s Business tier at $10 per user per month, with no reported 20 percent price reduction in September 2026, and it frames the cut as a direct response to competitive pressure from lower-priced open-source alternatives entering the ZTNA category, a dynamic that lines up with NetBird’s growing GitHub star count and public plan documentation over the same period. Taken together, these three independent trackers corroborate the vendor-published numbers used throughout this comparison rather than contradicting them, which is the strongest evidence available that the pricing and version data above reflects the real market as of late September 2026.
Compliance, Audit Trails, and Enterprise Requirements
Enterprise buyers evaluating any of these three platforms are rarely just comparing per-seat cost. Audit logging, session recording, and the ability to prove exactly who accessed what and when are frequently the deciding factor once a deal moves past the engineering team and into security review. All three platforms provide some form of connection logging tied to identity, which is a baseline requirement the older generation of consumer-grade VPN tools never had to meet.
Where this gets more nuanced is data residency for the logs themselves. On Tailscale and Twingate, audit and connection metadata lives on vendor-controlled infrastructure by default, which is workable for most companies but can be a hard blocker for organizations subject to strict data-localization rules, such as certain EU public-sector contracts or financial-services regulations that require access logs to never leave a specific jurisdiction. NetBird’s self-hosted deployment is the only path among the three where a company can guarantee that every piece of access-control metadata, not just the encrypted tunnel traffic, stays inside infrastructure the company itself operates and audits.
None of this makes Tailscale or Twingate unsuitable for regulated environments in general. Plenty of banks and healthcare companies run production workloads on both. But it does mean the compliance conversation and the pricing conversation are not actually separate decisions for a lot of enterprise buyers. A team that needs full metadata sovereignty is often willing to pay the DevOps cost of self-hosting NetBird specifically to avoid a compliance blocker that no per-seat discount from the other two vendors can solve.
Setup and Onboarding Speed
All three products advertise a “minutes, not days” onboarding pitch relative to a traditional VPN concentrator, and in practice that claim holds up reasonably well for small teams. Tailscale’s setup flow is the fastest to a working two-device connection: install the client, authenticate through an identity provider or magic link, and devices appear on the tailnet automatically thanks to MagicDNS, which assigns stable, human-readable hostnames without manual DNS configuration.
Twingate’s setup has one more moving part by design: an administrator has to deploy at least one Connector inside each private network being exposed, whether that is an AWS VPC, an on-prem data center, or a home lab. That extra step is a deliberate tradeoff for the split-tunnel model’s more granular access boundaries, but it does mean Twingate typically takes longer to get from zero to a first working connection, especially across multiple cloud accounts or regions.
NetBird sits in between. The hosted SaaS version onboards close to as fast as Tailscale, since the underlying mesh model is similar. The self-hosted version is the slowest to first connection of any option in this comparison, since standing up your own signaling server, management API, and relay infrastructure is a real DevOps project, not a five-minute task, even with the project’s published Docker Compose reference deployment.
Performance and Throughput
Because all three products build on WireGuard, the theoretical throughput ceiling is similar across the board. WireGuard’s lean codebase and kernel-level implementation on Linux routinely outperform IPsec and OpenVPN in independent testing, and none of these three vendors claims to meaningfully beat WireGuard’s own performance envelope. The differentiation happens at the connection-establishment and routing layer, not inside the tunnel itself.
Where real-world performance actually diverges is in how often a given topology forces a relay hop instead of a direct connection. Tailscale and NetBird, as true mesh architectures, both attempt direct device-to-device paths first and only fall back to a relay when NAT traversal fails, which is common with symmetric NAT setups found on some corporate and mobile carrier networks. Twingate’s Connector-based model routes through the Connector by design in most configurations, which trades a small, consistent latency overhead for tighter control over exactly what traffic can reach a given private network segment. For latency-sensitive workloads like remote database administration or live debugging sessions, the mesh-first approach used by Tailscale and NetBird tends to have an edge. For environments where administrators want every packet crossing a single audited chokepoint, Twingate’s model is the more deliberate choice.
Security Model: ACLs, DNS Filtering, and Device Posture
All three platforms support group-based access control lists that map identities to resources, and all three integrate with common identity providers for single sign-on. Where they differ is in the extras layered on top. Twingate has made DNS Filtering a named, separately billed capability, letting administrators apply content and category-based DNS rules at the router or firewall level, which is a genuinely useful control for organizations that also want basic content filtering baked into their access layer rather than bought as a separate product.
Tailscale and NetBird both support DNS-level policy as well, through MagicDNS-integrated ACLs on Tailscale’s side and routing policy on NetBird’s, but neither packages it as a distinctly named, separately priced feature the way Twingate does. All three support device posture checks to varying degrees, gating network access on whether a device has disk encryption enabled, an up-to-date OS, or an active endpoint security agent, though the depth of posture-check integration varies by plan tier on each platform.
Self-Hosting and Open Source: NetBird’s Core Differentiator
This is the section that decides a lot of enterprise procurement conversations in 2026, so it deserves its own space rather than a table row. NetBird is licensed under a BSD-3 and AGPLv3 dual license and publishes the full source for its client, management server, signaling server, and relay components. A team with in-house platform engineering capacity can deploy the entire stack on infrastructure it controls, with no vendor in the data path at all if they choose not to use NetBird’s hosted relay network.
Tailscale occupies a middle position. Its client software and some coordination-server code are open source, and the community-maintained Headscale project reimplements enough of the control plane that self-hosted Tailscale-compatible networks are genuinely running in production today. But Headscale is not an officially supported Tailscale product, so teams choosing that path accept that new Tailscale features often land in the commercial control plane well before, or instead of, Headscale.
Twingate offers no self-hosting path for its controller at all. Every Twingate deployment, no matter how large, depends on Twingate’s cloud-hosted control plane, with only the lightweight Connector component running on customer infrastructure. For organizations bound by strict data-sovereignty rules, particularly around where authentication metadata and policy definitions are stored, this is the single clearest disqualifying factor among the three.
Platform and Device Support
All three platforms ship native clients across the major desktop operating systems (Windows, macOS, Linux) and mobile platforms (iOS, Android), which has become table stakes for this category. Router-level support is where things vary: Tailscale has the broadest ecosystem of subnet router and exit node configurations documented for common router firmware and NAS platforms, reflecting its larger and older open-source community. NetBird, as a newer and smaller project relative to Tailscale, has fewer third-party integration guides published, though its core Linux, Windows, and macOS clients are functionally complete. Twingate’s Connector approach means router-level installation is less central to its model in the first place, since the Connector typically runs as a container or lightweight VM inside the network being protected rather than on consumer router hardware.
Real-World Use Cases: Where Each Platform Actually Wins
Specs and pricing only tell part of the story. Here are six concrete scenarios where the choice between these three platforms tends to be clear-cut in practice.
A five-person startup connecting laptops to a single cloud database. Tailscale’s free Personal tier covers this outright at zero cost, with MagicDNS making the database reachable by a stable hostname instead of a rotating internal IP. This is close to the platform’s best-case scenario.
A mid-size company granting time-limited contractor access to one internal API. Twingate’s Connector model and its granular, resource-scoped access rules are built for exactly this: a contractor can be scoped to reach one API endpoint and nothing else on the private network, with DNS Filtering layered on top if the company also wants basic content controls for that contractor’s sessions.
A regulated European fintech that cannot let access-policy metadata leave EU infrastructure. NetBird’s self-hosted deployment, published under an open-source license with euro-denominated Business pricing already reflecting its EU-heavy customer base, is the only one of the three that can guarantee the control plane itself never touches infrastructure outside the company’s chosen region.
A DevOps team managing ephemeral CI/CD runners that need database access for minutes at a time. Tailscale’s tagged-resource model, which includes ephemeral-resource minutes as a named allowance on its Personal plan and scales into paid tiers, is purpose-built for short-lived infrastructure that needs network identity without a persistent seat.
An agency managing access across a dozen client cloud environments simultaneously. Twingate’s per-network Connector model maps naturally onto this kind of segmented, client-by-client access boundary, since each client’s VPC or data center gets its own Connector and its own isolated policy set, reducing the chance of cross-client access mistakes.
A homelab enthusiast or small team wanting zero recurring cost with full control. NetBird’s self-hosted option, running on a single small VPS, delivers a fully functional mesh VPN with no per-seat license fee, which is a genuinely different value proposition from anything Tailscale’s free tier or Twingate’s free tier offers once a team grows past a handful of users.
Migration Guide: Moving From a Legacy VPN or Between ZTNA Providers
Migrating off a traditional site-to-site VPN, or switching between these three ZTNA platforms, follows a similar sequence regardless of destination. Here is the general path most teams follow.
- Inventory every resource currently reachable through the existing VPN, including databases, internal APIs, admin dashboards, and any legacy on-prem systems, before writing a single access rule on the new platform.
- Map each resource to the identity groups that actually need access to it, rather than replicating the old VPN’s flat, network-wide access model on the new platform.
- Stand up the new platform’s control plane in parallel with the existing VPN rather than as a hard cutover. Tailscale and NetBird both support this cleanly since devices can run both a legacy VPN client and the new mesh client simultaneously during the transition.
- Deploy connector or router components (Twingate Connectors, Tailscale subnet routers, or NetBird’s routing peers) into each private network segment that needs to be exposed.
- Migrate a single low-risk resource first, such as an internal wiki or a staging database, and validate that access rules behave as expected before moving anything production-critical.
- Roll out client software to end-user devices in waves, starting with the platform team, and only after the tool is standard on all machines should administrators start decommissioning old VPN concentrator rules.
- Turn on device posture checks and any DNS-level filtering once the base connectivity migration is stable, since layering security controls on top of an unstable rollout makes troubleshooting far harder.
- Decommission the legacy VPN infrastructure only after a full billing cycle has passed with zero connections logged against it, giving stragglers time to surface.
Teams migrating from Tailscale to NetBird, or the reverse, have an easier path than either migration from Twingate, simply because the underlying mesh architecture and ACL-style policy language are conceptually similar. Migrating to or from Twingate involves more redesign work, since its Connector-based segmentation model does not map one-to-one onto a flat mesh network, and access policies typically need to be rewritten rather than translated.
Pros and Cons of Each Platform
Tailscale
Pros: Genuinely free tier that covers real small-team use cases, fastest path from install to a working connection, MagicDNS removes manual DNS work, largest GitHub community and router/NAS integration ecosystem of the three.
Cons: Coordination server is not officially self-hostable at full feature parity, April 2026’s move to per-seat billing raises costs for teams with many low-usage seats, Premium tier at $18 per user per month is the most expensive self-serve plan of the three.
Twingate
Pros: Most granular per-resource access segmentation via its Connector model, DNS Filtering as a distinct built-in capability, recent 20 percent price cut makes its top tier the cheapest self-serve premium plan of the three at $12 per user per month.
Cons: No self-hosting option for the control plane at all, requires deploying and maintaining a Connector in every private network segment, closed-source client and controller mean no independent code audit is possible.
NetBird
Pros: Only fully open-source, fully self-hostable option of the three, zero licensing cost if self-hosted, euro-denominated Business plan at roughly $13 per user per month is competitive even on the hosted SaaS path.
Cons: Smallest GitHub community and integration ecosystem of the three, self-hosted deployment is a genuine DevOps project rather than a quick setup, fewer third-party router and NAS integration guides published compared to Tailscale.
Which One Should You Choose
Choose Tailscale if you want the fastest possible setup, a free tier that genuinely covers a small team indefinitely, and you are comfortable with a vendor-hosted control plane. It remains the default recommendation for startups and small engineering teams that just need devices to reach cloud infrastructure without friction.
Choose Twingate if per-resource segmentation and built-in DNS filtering matter more to you than raw setup speed, especially if you manage access across many separate client networks or need contractor access scoped tightly to single services. The September price cut also makes it the most price-competitive premium tier of the three right now.
Choose NetBird if data residency, vendor independence, or long-term licensing cost are board-level concerns, and your team has the DevOps capacity to run and maintain a self-hosted control plane. It is also the strongest option for cost-sensitive teams and homelabs willing to trade a faster GUI experience for full ownership of the stack.
The Verdict: What the Data Actually Shows
None of these three products is objectively “best.” Tailscale wins on onboarding speed and community size, with roughly 36,900 GitHub stars on its core repository and the only unambiguous, fully-documented free tier of the three. Twingate wins on per-resource access granularity and, as of September 8, 2026, on price, with its top self-serve tier now 20 percent cheaper at $12 per user per month. NetBird wins on architectural independence, as the only platform of the three where the entire stack, not just the client, can run on infrastructure you control, with no per-seat fee if you choose to self-host.
If forced to pick a single default recommendation for a general-purpose engineering team in September 2026, Tailscale remains the safest first choice, purely on the strength of its free tier and setup speed. But that recommendation flips quickly the moment segmentation, self-hosting, or long-term licensing cost become priorities, at which point Twingate and NetBird each have a legitimate, data-backed claim to the top spot.
Frequently Asked Questions
Is Tailscale, Twingate, or NetBird free to use?
All three offer a free tier. Tailscale’s Personal plan is the most clearly documented, covering up to six users with unlimited devices at no cost. NetBird can be run entirely free if self-hosted, since the software itself carries no license fee under its open-source terms. Twingate has a free tier as well, though its exact user and device limits are not itemized on the current public pricing page.
Which of the three is easiest to set up for a small team?
Tailscale generally gets a small team from signup to a working connection the fastest, thanks to MagicDNS handling hostname assignment automatically and its peer-to-peer mesh requiring the least manual network configuration.
Can I self-host Twingate’s control plane?
No. Twingate’s controller is cloud-hosted only. The only component that runs on your own infrastructure is the lightweight Connector, which routes traffic into your private network but does not host the policy engine itself.
What changed with Tailscale’s billing in 2026?
On April 8, 2026, Tailscale switched from monthly-active-user billing to per-seat billing, meaning every assigned seat is billed regardless of whether that user actually connects during the billing period.
Why did Twingate cut its pricing in September 2026?
Twingate reduced its top self-serve tier by 20 percent, from $15 to $12 per user per month, effective September 8, 2026, positioning it as the cheapest premium self-serve tier among the three platforms compared here.
Is NetBird a good replacement for a corporate VPN?
Yes, particularly for organizations that want to avoid vendor lock-in. Its WireGuard-based mesh architecture and full self-hosting option make it a strong replacement for legacy site-to-site VPNs, though the self-hosted path requires real DevOps investment to deploy and maintain.
Do these platforms work on mobile devices?
Yes, all three ship native iOS and Android clients alongside their desktop applications, so devices can join the mesh or access private resources from phones and tablets in addition to laptops and servers.
Which platform has the largest open-source community?
Tailscale’s core client repository carries roughly 36,900 GitHub stars, ahead of NetBird’s approximately 28,600. Twingate does not have a comparable public repository, since its client and controller are closed source.