Tailscale vs ZeroTier

Tailscale builds a layer 3 mesh. Every device gets a 100.x.y.z address inside your tailnet, WireGuard tunnels carry the packets, and a coordination server run by Tailscale handles key exchange and device identity. You log in with an existing identity provider (Google, GitHub, Microsoft, or any OIDC source), and only IP traffic crosses the wire. It is deliberately boring in the best way.

ZeroTier builds a layer 2 virtual Ethernet switch. Its VL1 transport layer is a custom encrypted peer-to-peer protocol (Curve25519 keys, AES-GMAC-SIV or Salsa20/Poly1305 ciphers), and VL2 emulates real Ethernet on top: ARP, broadcast, multicast, even non-IP protocols. Devices join a network by punching in a 16-digit network ID, then you authorize them in the ZeroTier Central web console. No SSO login on the device itself, which is genuinely convenient for headless boxes.

In practice, layer 2 means mDNS discovery, Chromecast, SMB browsing, LAN game discovery, and bridging a remote segment into your home VLAN all work across sites. That is real capability Tailscale does not have. But be honest about whether you will use it. If your remote access needs are SSH, HTTP dashboards, and an occasional RDP session, layer 2 is machinery you will never touch.

Tailscale overhauled pricing on April 8, 2026, and the free Personal plan got noticeably better. It now covers up to 6 users, unlimited personal devices, 50 tagged resources (your servers, VMs, and containers), 1,000 ephemeral-node minutes per month, and 3 ACL groups. The old 100-device cap is gone and the paid Personal Plus tier was retired outright. Paid plans start at $8 per user per month (Standard) and $18 (Premium).

ZeroTier moved the other direction. Accounts created after November 5, 2025 get a free tier of 10 devices, 1 network, and 1 admin. That number has been shrinking for years: 50 devices, then 25 in 2023, now 10, with older accounts grandfathered on what ZeroTier calls Legacy Central. The entry paid plan runs $18/month flat with 10 devices included, $2 per additional device, and up to 10 networks. The Scale tier is $179/month for 100 devices.

Do the homelab math. A hypervisor, a NAS, four VMs, two Pis, your phone, your laptop, and your partner's laptop is 11 devices, and you have already outgrown ZeroTier's free tier. The same setup on Tailscale's free plan does not even register against the 50 tagged-server allowance. For a shared family lab, this category is not close.

If you want zero dependence on a vendor cloud, Tailscale's answer is Headscale, a community-built open source (BSD-3) reimplementation of the coordination server, currently at 0.27. Official Tailscale clients work against it, and Tailscale employs Headscale's lead maintainer, so it is tolerated rather than fought. Tailscale's own control plane stays closed source, though the Linux and Android clients are open.

ZeroTier used to have the stronger self-host story, since any node can act as a network controller. Version 1.16.0 (August 2025) changed the deal: the core engine was relicensed from the old BSL to MPL 2.0, which is genuinely more open, but the controller moved to a commercial source-available license and was dropped from default binary builds. Personal, non-commercial homelab use is still free. Any use benefiting a business, nonprofit, or government agency now requires a paid license, and that definition is broad.

So the old assumption flipped. In 2026 the cleanest fully open source self-hosted control plane is Headscale plus Tailscale clients, not ZeroTier. For a purely personal lab, both routes cost nothing, but if there is any chance your setup drifts toward commercial use (say, an MSP side business), the ZeroTier controller license is a real constraint and Headscale is not.

Tailscale runs wireguard-go in userspace but added UDP segmentation offloads that pushed it past 10 Gbps between Linux hosts in its own published testing. On typical homelab hardware, saturating a gigabit link through Tailscale is routine. ZeroTier's custom userspace data path is CPU-bound and generally lands below WireGuard-based tools in community throughput tests, which you will feel on low-power boxes like a Pi or an N100 mini PC during big transfers. Latency is a wash since both establish direct peer-to-peer paths through NAT, and both fall back to encrypted relays (Tailscale's DERP servers, ZeroTier's roots) when they can't.

Day to day, Tailscale behaves like a finished product. MagicDNS gives every machine a name like jellyfin.your-tailnet.ts.net, Taildrop moves files between devices, Tailscale SSH handles keys for you, exit nodes route your coffee-shop traffic through home, and Funnel can publish a service to the public internet. ZeroTier gives you a powerful per-network flow rules engine and the ZeroNSD companion for DNS, but the extras are add-ons you assemble yourself. ZeroTier is a very good network primitive; Tailscale is a toolkit.