Tailscale Pricing 2026: When Self-Hosting Headscale or NetBird Beats Seat Pricing

Self-hosting instead of seat pricing? Managed NetBird starts from €349.90 excluding VAT monthly with monitoring, updates, backups, support and Essential. The VPN migration sprint provides a pilot group and rollback for a controlled move from Tailscale or an existing VPN.

Two news items reshaped the market for modern mesh VPNs in 2026. Tailscale overhauled its pricing and now bills business plans per seat. And NetBird, the Berlin-based open-source alternative, raised a USD 10M Series A in January 2026 and shipped dual-stack IPv6 with version 0.71. For IT and OT leads in the DACH region this raises a concrete question: do we keep paying per head to a US cloud, or do we host the control plane ourselves with Headscale or NetBird?

This article sets out the pricing change factually, works through the break-even, and gives a decision guide: when Tailscale Cloud remains the right call, when Headscale is enough, and when NetBird is the better platform.

Table of contents

• What changed in 2026: Tailscale, NetBird, Headscale
• Tailscale seat pricing v4 in detail
• Cost example: when seat pricing gets expensive
• Headscale vs. NetBird: two routes to self-hosting
• Decision guide: when to choose what
• Sovereignty: why EU hosting and open source matter
• How we work at WZ-IT

What changed in 2026: Tailscale, NetBird, Headscale

Three developments belong together if you want to answer the cost question honestly in 2026.

1. Tailscale pricing v4 (blog post dated 08 April 2026). Tailscale moved its business plans from usage-based to seat-based pricing. The vendor's rationale: customers wanted predictable bills instead of amounts that fluctuate with monthly active users. The former Starter plan is now Standard, the free Personal plan covers up to 6 users with unlimited user-owned devices, and business plans gain features such as SCIM, device posture, user management APIs, and webhooks. Tailscale states existing customers have at least 12 months before migration to the new plans becomes mandatory.

2. NetBird Series A (13 January 2026). The Berlin-based open-source company raised USD 10M led by Pace Capital, with Nauta Capital, InReach Ventures, and Antler. NetBird positions itself as a European, open-source alternative to legacy SSL VPN vendors. The project has been public on GitHub since 2021.

3. NetBird v0.71 (14 May 2026). This release brings dual-stack overlay networking: every peer receives an IPv4 and an IPv6 address from a per-account prefix, with full DNS, ACL, exit-node, and network-route support.

The common thread: all three options build on WireGuard. The difference is not the tunnel protocol but who hosts the control plane and how you pay for it.

Tailscale seat pricing v4 in detail

Seat-based means you pay for a number of seats on your tailnet. A user occupies a seat when they first log in to the admin console or first authenticate a device. That makes the bill predictable - but it grows with every additional employee who needs access.

For many B2B setups the Personal plan is too constrained (no central user management, no advanced policies), so Standard or Premium are the realistic options - and that is where the cost dynamic begins.

Cost example: when seat pricing gets expensive

Seat logic is linear: twice the users, twice the bill. Self-hosting inverts that model - infrastructure and operations cost is largely fixed, whether you connect 30 or 300 users.

Since July 2026 that comes with one refinement: NetBird has published a self-hosting licence tier below Enterprise. The Community Edition stays free and without a user limit; high availability and SCIM cost a flat 2,000 euros per year - still independent of user count. The assessment is in NetBird self-hosting licence 2026.

Note: Prices as of June 2026 per Tailscale Pricing. The official vendor figures are authoritative.

A self-hosted control server (Headscale or self-hosted NetBird) runs comfortably on a small server; the meaningful costs are operations, updates, monitoring, and SSO integration. Once the user count moves into double digits - and especially when Premium features are required - the break-even in favour of self-hosting usually sits at a few dozen seats. We work through the break-even logic in detail in the guide NetBird vs. Tailscale.

Headscale vs. NetBird: two routes to self-hosting

Self-hosting does not mean a "DIY VPN". There are two mature routes, and they differ fundamentally.

Headscale is an open-source, self-hosted implementation of the Tailscale coordination server. You keep using the official Tailscale clients but point them at your own control server. Upside: lean, Tailscale-compatible, ideal when you like the Tailscale experience but do not want the control plane in the US cloud. Details in the knowledge article What is Headscale.

NetBird is a standalone platform with its own agent, web dashboard, OIDC SSO, a granular policy engine, and dual-stack IPv6 since v0.71. More features out of the box, but its own ecosystem rather than Tailscale compatibility. Basics in the article What is NetBird.

For a technical comparison that also includes plain WireGuard, see NetBird vs. Tailscale vs. WireGuard.

Decision guide: when to choose what

The choice depends less on the protocol than on cost, control, and operations. As a rule of thumb:

Stay on Tailscale Cloud when ...

• the team is small (up to roughly 6 users the free Personal plan often suffices),
• you have no data-sovereignty or EU-hosting requirements,
• you deliberately want zero operational ownership of the control plane.

Choose Headscale when ...

• you like the Tailscale clients and the Tailscale model,
• the control plane should sit in-house or in the EU for sovereignty reasons,
• you prefer a lean setup without an additional platform.

Choose NetBird when ...

• you need central management, a dashboard, SSO, and policies out of the box,
• the user count grows and seat pricing becomes a tax on growth,
• you want a fully open-source platform with an active roadmap (dual-stack IPv6, SSH, Zero Trust) - see NetBird updates.

In OT environments and machine remote maintenance there is often the added need to connect edge appliances and sites securely without open ports - see Edge VPN appliances and remote maintenance.

Sovereignty: why EU hosting and open source matter

Cost is often the trigger, sovereignty usually the real reason. When the control plane sits with a US provider, metadata about your network - devices, users, connections - lives on that provider's infrastructure and legal jurisdiction. For many companies in regulated sectors, the public sector, or with GDPR-sensitive data, that is a governance concern. NIS2 further tightens the requirements for access control, audit, and traceability; a self-hosted, open-source stack can be controlled and audited cleanly here. What that looks like for remote access in practice is covered in NIS2-compliant remote access.

Open source adds: no vendor lock-in, inspectable code, your own update authority. Headscale and NetBird are both open source and can run entirely in Germany.

This article is general information and not legal advice. For a concrete assessment of NIS2 or GDPR obligations, please involve qualified counsel - we deliver the technical implementation.

Still unsure which tool fits? The orientation workshop sorts out your requirements and delivers a prioritised topic list with a recommendation per topic. From €1,490 excl. VAT, remote.

How we work at WZ-IT

We are engineers, not a call centre. For self-hosted remote access we keep it pragmatic:

1. Requirements check: user count, devices, sites, SSO, compliance, growth plan.
2. Architecture: Headscale or NetBird, hosting in Germany/EU, SSO via OIDC (e.g. Keycloak, Authentik, Okta).
3. Pilot and parallel run: pilot group, then a phased rollout; the old VPN stays active until cutover - with a clear rollback option.
4. Managed operations: updates, monitoring, alerting, and incident response, so VPN ops never become a permanent task for your team.

We run this approach in production, for example for ABCO Water Systems in Australia and nextGYM GmbH in Germany. More on the platform under Remote management platforms.

Further reading

• What is Headscale - the self-hosted Tailscale control server explained
• What is NetBird - open-source mesh VPN overview
• NetBird vs. Tailscale vs. WireGuard - technical comparison
• NetBird vs. Tailscale: detailed comparison - self-hosted vs. cloud, break-even
• NetBird updates: dashboard, SSH, Zero Trust - current roadmap
• Managed Headscale and Managed NetBird from WZ-IT

Want to know whether self-hosting is cheaper for you? We calculate your break-even and show the clean, zero-downtime migration. See our remote management platforms or book a free initial consultation.

Sources

• Tailscale: Pricing update v4 (blog, 08 April 2026)
• Tailscale Pricing
• Tech.eu: NetBird raises USD 10M Series A (13 January 2026)
• NetBird Blog (incl. v0.71 IPv6 overlay)
• NetBird Self-Hosted Guide
• Headscale (GitHub)
• WireGuard

Tailscale, NetBird, and Headscale are trademarks or projects of their respective owners. This article provides technical and economic context. Prices and features can change; the official vendor figures are authoritative.