Free and self-hosted, or managed with an official console.
Headscale is free, open-source software — not a company — that lets you self-host a control server for the official Tailscale client apps. Here's how that compares to meshr's managed platform, honestly.
meshr vs Headscale, feature by feature.
Headscale has no pricing tiers to compare — it's free software you run yourself. The real differences are in tooling, identity, and support.
| Headscale | meshr | |
|---|---|---|
| What it is | Free, open-source reimplementation of Tailscale's control server — not a company | Managed mesh VPN platform (self-hosted option on the roadmap) |
| Underlying protocol | WireGuard, via the official Tailscale client apps | WireGuard |
| Control plane scope | Self-hosted only, officially scoped to a single tailnet | Managed cloud today; multi-org / MSP support built in |
| Admin UI | No official web UI — CLI + API only (community UIs like headscale-ui/headplane exist, unofficial) | Official native admin console, included |
| Pricing | $0 — free and open-source, self-hosted only (you cover hosting/ops) | Free: $0 (5 users) · Pro: $7/user/mo (managed cloud) |
| Mobile onboarding | Official Tailscale apps, but iOS needs a manual server-override step | Native mobile apps built for meshr, no manual override |
| Identity / SSO | OIDC-based registration — OIDC groups can't be used in ACL policies (documented limitation) | OIDC SSO (SAML soon) with group-based ACLs |
| SSH access | Policy-based SSH rules with re-auth checks | Web SSH + session recording, included |
| Support | Community only, no SLA | Vendor support options |
| Multi-org / MSP | Not supported — single tailnet by design | Built in |
Feature details reflect Headscale's public documentation as of July 2026. It's an actively developed open-source project — verify current specifics before deciding.
Where each one actually wins.
Free-and-DIY vs managed-with-official-tooling is a real tradeoff. Here it is without the spin.
Where meshr wins
- An official native admin console ships out of the box — Headscale has no official web UI, only CLI/API (community UIs exist but are unofficial and vary in polish).
- Native mobile apps are built for meshr, so there's no manual server-override step to point a client at your instance.
- Multi-org / MSP support is built in; Headscale is explicitly scoped to a single tailnet.
- OIDC groups work directly in access policies — Headscale's documented limitation means OIDC groups can't drive ACLs.
Where Headscale wins — honestly
- It's free forever with full data sovereignty from day one — meshr's self-hosted option is still on the roadmap, not shipped.
- It runs the official, polished Tailscale client apps out of the box on desktop and mobile.
Already running Headscale?
Try meshr's managed cloud alongside your Headscale deployment — no need to give up on self-hosting long-term, meshr's own self-hosted control plane is on the roadmap.
curl -fsSL https://get.meshr.to/install.sh | sudo bash meshr login -t <setup-key> meshr up Common questions.
Is Headscale a company or a paid product?
No — Headscale is free, open-source software maintained by its community. There's no commercial tier or official managed hosting; the only cost is your own hosting and operations time.
Does Headscale have an official admin dashboard?
No. Headscale itself is CLI- and API-only. A handful of community projects (like headscale-ui and headplane) add a web UI, but they're unofficial, third-party, and vary in quality and mobile support.
Can I use my identity provider's groups for access policies in Headscale?
You can wire up OIDC for registration, but Headscale has a documented limitation where OIDC groups can't be used directly in ACL policies — you have to manage group membership another way.
Does meshr have a self-hosted option like Headscale?
Not yet. meshr runs as a managed cloud service today; a self-hosted control plane is on the roadmap. Headscale, being open-source, is self-hosted from day one — that's the honest tradeoff.
Can I run the official Tailscale mobile app against a Headscale server?
Yes — that's Headscale's whole design, it speaks the same protocol as Tailscale's official clients. On iOS specifically, pointing the app at your own server needs a manual server-override step, which is rougher than a client built for that purpose from the start.
Want managed tooling without giving up the mesh?
Start with a free account. No credit card required. Works with any infrastructure.
# Try meshr in 3 commands
$ curl -fsSL https://get.meshr.to/install.sh | sudo bash
$ meshr login -t <setup-key>
$ meshr up
✓ Connected! IP: 10.0.0.5
✓ DNS: my-server.meshr
✓ SSH: meshr ssh my-server
✓ Tunnel: meshr tunnel http 3000