Direct answer: assuming one device per person, annual pricing and 10/50/200 users or devices, zero-trust/VPN in 2026 costs about: 10 users — ZeroTier 18, Twingate Teams 50, Tailscale Standard 80; 50 — ZeroTier 98, Twingate 250, Tailscale 400; 200 — ZeroTier 359 (Scale), Twingate 1,000, Tailscale 1,600 USD per month. ZeroTier bills per device and is cheapest; Twingate bills per user and is below Tailscale Standard; Tailscale bills per user with unlimited devices, fitting one-person-many-devices/full-mesh. The “user/device/network” definitions and zero-trust scope differ: ZeroTier is closer to SD-WAN/overlay, while Twingate/Tailscale focus on identity-aware access; do not compare only “per user”.
This guide is for IT, security and procurement teams running remote work, branch interconnection, dev/prod access, third-party operations and VPN replacement. Data cut-off: 6 November 2026; prices come from the US pricing pages of Tailscale, Twingate and ZeroTier, in USD, excluding tax; all TCOs are editorial calculations, not vendor quotes. The billing units and capability boundaries differ, so official facts, editorial assumptions and non-comparable items are kept separate.
Tailscale Standard 8/user/month, unlimited devices; Twingate Teams 5/user/month, Business 10; ZeroTier Essential 18/month includes 10 devices then 2/device, Scale 179/month includes 100 then 1.80. At 10/50/200: ZeroTier 18/98/359, Twingate 50/250/1,000, Tailscale 80/400/1,600. ZeroTier is cheapest but overlay/SD-WAN-oriented; Twingate/Tailscale are more zero-trust access.
Three meters: per user, per user+device, per device
Tailscale: Personal free up to 6 users; Standard 8/user/month, unlimited devices, SCIM, up to 10 ACL groups and 50 tagged resources; Premium 18/user/month, up to 300 ACL groups and 10,000 ephemeral minutes; Enterprise custom; Mullvad 5 per 5 devices/month, extra tagged resource 1 each/month. Twingate: Starter free for 5 users; Teams 5/user/month annual, up to 100 users, Google Workspace SSO and SaaS app gating; Business 10/user/month annual, up to 500 users, Okta/Entra SSO and SCIM/automated least privilege; Home 15/month (non-commercial, up to 7 users); Enterprise custom. ZeroTier: Free 10 devices/1 network; Essential 18/month includes 10 devices, then 2/device, 10 networks/5 admins, OIDC SSO and 30-day audit; Scale 179/month includes 100 devices, then 1.80/device, unlimited networks/10 admins and custom flow rules; Enterprise custom for 500+ devices.
| Platform/tier | Meter | Published price/allowance | Boundary |
|---|---|---|---|
| Tailscale Standard | User | 8/user/month; unlimited devices | SCIM, 10 ACL groups, 50 tagged resources |
| Tailscale Premium | User | 18/user/month | 300 ACL groups, 10k ephemeral minutes |
| Twingate Teams | User | 5/user/month annual | ≤100 users, Google SSO, SaaS gating |
| Twingate Business | User | 10/user/month annual | ≤500 users, Okta/Entra, SCIM |
| ZeroTier Essential | Device | 18/month includes 10; +2/device | 10 networks/5 admins, OIDC, 30-day audit |
| ZeroTier Scale | Device | 179/month includes 100; +1.80/device | Unlimited networks/10 admins, flow rules |
Sources: Tailscale Pricing, Twingate Pricing and ZeroTier Pricing (US, accessed 6 November 2026). USD, excluding tax; Tailscale uses public monthly prices; Twingate uses annual prices (monthly may be higher); ZeroTier uses monthly prices. Enterprise, Mullvad, extra tagged resources, support and migration are separate.
Three tiers: ZeroTier from 18, Tailscale most expensive per person
One device per person, annual: 10 users — ZeroTier Essential 18, Twingate Teams 50, Tailscale Standard 80; 50 — ZeroTier 98 (18 + 40 × 2), Twingate 250, Tailscale 400; 200 — ZeroTier Scale 359 (179 + 100 × 1.80), Twingate 1,000, Tailscale 1,600. Annual: 216/600/960; 1,176/3,000/4,800; 4,308/12,000/19,200. ZeroTier’s per-device model is cheapest at 1:1; if each person has 3 devices, ZeroTier bills 30 devices while Tailscale still bills one user, so the ranking changes — count people and devices first.
| Users/devices (1:1) | Tailscale Standard | Twingate Teams | ZeroTier |
|---|---|---|---|
| 10 | 80.00 | 50.00 | 18.00 (Essential) |
| 50 | 400.00 | 250.00 | 98.00 (Essential) |
| 200 | 1,600.00 | 1,000.00 | 359.00 (Scale) |
Editorial calculation, not a quote. Tailscale = users × 8; Twingate = users × 5; ZeroTier = 18 + max(0, devices − 10) × 2 (≤100 devices) or 179 + max(0, devices − 100) × 1.80 (>100). Excludes tax, enterprise, Mullvad, extra tagged resources, support and migration; Twingate monthly prices are not used here.
One person, many devices: the per-user vs per-device divide
With per-device billing, device count is the main variable: 50 people × 3 devices (150 devices) — ZeroTier Essential 18 + 140 × 2 = 298, Scale 179 + 50 × 1.80 = 269; Tailscale remains 50 × 8 = 400; Twingate 50 × 5 = 250. Here Twingate is lowest, ZeroTier Scale 269 next, Tailscale 400. Conversely, 100 people with only 100 devices: ZeroTier Scale 179, Twingate 500, Tailscale 800. Count people, devices and devices-per-person before choosing a meter.
| Scenario | Tailscale | Twingate | ZeroTier |
|---|---|---|---|
| 10 people / 10 devices | 80 | 50 | 18 |
| 50 people / 150 devices | 400 | 250 | 269 (Scale) |
| 100 people / 100 devices | 800 | 500 | 179 (Scale) |
| 200 people / 600 devices | 1,600 | 1,000 | 1,079 (Scale) |
Editorial calculation, not a quote. ZeroTier uses Essential at ≤100 devices and Scale above 100; Tailscale/Twingate bill per user with unlimited (Tailscale) or per-user (Twingate) devices. Excludes tax, enterprise, add-ons, support and migration.
Feature boundaries: overlay/SD-WAN vs zero-trust access
ZeroTier is a Layer 2/3 overlay/SD-WAN: it puts devices/branches into a virtual network and bills per device, fitting many devices, few people, site interconnection and dev/test networks; identity/SSO/audit start at Essential, flow rules at Scale. Tailscale is WireGuard full-mesh: per user, unlimited devices, ACL/SSO/SCIM/tagged resources/exit nodes, fitting one-person-many-devices, dev/ops access and VPN replacement. Twingate is zero-trust network access (ZTNA): per user, connectors to internal resources, Google/Okta/Entra SSO, least privilege and SaaS gating, fitting “users access apps/internal networks” rather than “site interconnection”. They are not fully equivalent: ZeroTier is cheap for device networks, Twingate/Tailscale charge for identity-aware access.
| Capability | Tailscale | Twingate | ZeroTier |
|---|---|---|---|
| Billing unit | User (unlimited devices) | User | Device |
| SSO/SCIM | From Standard | Teams/Business | OIDC at Essential; SCIM higher |
| ACL/least privilege | ACL groups | ZTNA policies | Flow rules (Scale) |
| Site/branch interconnection | Subnet routes/exit nodes | Connector to internal network | Strong (overlay/SD-WAN) |
| Audit | Tier-dependent | Tier-dependent | 30 days (Essential) |
| Typical use | Full mesh/dev-ops | Zero-trust app access | Device network/branch |
Sources: the three official pricing/product pages (accessed 6 November 2026). This is a public tier overview; SSO/SCIM, ACL, audit, connectors, subnet routes, SLA and compliance depend on tier/contract. No feature-equivalence assumption is made.
Which option fits which scenario?
Many devices, few people, site/branch interconnection, budget-first: ZeroTier Scale/Essential, 1.80–2.00 per device; 10 people 18, 50 98, 200 359. One person with many devices, full mesh/exit node/ACL, VPN replacement: Tailscale Standard 8/user with unlimited devices; 50 people 400, still below Twingate Business 500. Users accessing internal apps/databases with ZTNA/Google/Okta/Entra SSO: Twingate Teams 5/user, 50 people 250, 200 1,000; Business 10/user adds Okta/Entra/SCIM. Enterprise compliance/private deployment/SLA: all three Enterprise quotes. Do not compare “per user” with “per device” directly; calculate devices per person first.
| Scenario | First choice | Why | Check first |
|---|---|---|---|
| Many devices/few people/branch | ZeroTier | 1.80–2.00/device, overlay/SD-WAN | SSO/audit/flow-rule tier |
| One person/many devices/full mesh | Tailscale | 8/user, unlimited devices | ACL/SCIM/tagged resources |
| ZTNA/internal app access | Twingate Teams | 5/user, connectors/SSO | User cap, SSO tier |
| Okta/Entra/SCIM | Twingate Business | 10/user, enterprise IdP | ≤500 users, audit |
| Enterprise compliance/private deploy | All three Enterprise | Contract/residency/SLA | BAA, audit, support |
| Personal/trial | Free tiers | Zero cost | User/device/network caps |
Sources: the three official pricing pages (accessed 6 November 2026). This is an editorial decision matrix, not vendor advice; actual throughput, latency, NAT traversal, connector HA, audit completeness and support response were not tested.
What should procurement and acceptance specify?
At least ten things: users, devices/devices-per-person, sites/branches, access targets (apps/databases/internal network), SSO/SCIM, ACL/least privilege, audit/logs, connectors/relays, SLA/support, data residency/compliance. Run a 2–4 week POC on real access and record connection success, latency, NAT/firewall traversal, SSO, ACL, audit and the bill; do not compare only “per user/per device”.
- People/devices: employees, contractors, service accounts; devices-per-person; BYOD.
- Access targets: internal apps, databases, Kubernetes, SSH, site-to-site.
- Identity: Google/Okta/Entra, SCIM, MFA, device posture.
- Policy: ACL/least privilege, groups, tags, flow rules.
- Network: subnet routes, exit nodes, connectors, relays, NAT traversal.
- Audit: login/access logs, retention, SIEM export.
- SLA: availability, support response, status page, regions.
- Compliance: data residency, encryption, BAA/HIPAA, SOC2.
- Contract: annual/monthly, user/device changes, overage, renewal uplift.
- POC: 2–4 weeks of real access; success, latency, NAT, SSO, ACL, audit and bill.
FAQ
What is cheapest for 10 people?
ZeroTier 18 (10 devices), Twingate Teams 50, Tailscale 80 per month. ZeroTier is cheapest per device but overlay-oriented; choose Twingate for ZTNA or Tailscale for one-person-many-devices/full mesh.
What is cheapest for 200 people?
ZeroTier Scale 359 (200 devices), Twingate 1,000, Tailscale 1,600. If 200 people have 3 devices each (600 devices), ZeroTier is 1,079, Twingate 1,000, Tailscale 1,600 — Twingate becomes lowest. Count devices.
Why is ZeroTier so cheap?
It bills 1.80–2.00 per device, with 10 devices in the 18 plan and 100 in the 179 plan; it does not bill per user. It is very cheap for few devices/people and grows linearly with devices; its identity/SSO/audit/flow-rule capabilities and tiers differ from ZTNA products.
Tailscale or Twingate?
Tailscale is 8/user with unlimited devices, full mesh/exit node/ACL, fitting dev/ops and many devices per person; Twingate is 5/user with connectors to internal apps and Google/Okta/Entra SSO, fitting ZTNA. At 50 people, Tailscale 400 vs Twingate 250; choose Tailscale for unlimited devices, Twingate for app-level access.
How do I model one person with many devices?
Tailscale bills per person with unlimited devices; ZeroTier bills per device; Twingate bills per user with unlimited devices (subject to user caps). 50 people × 3 devices: Tailscale 400, Twingate 250, ZeroTier Scale 269 — the ranking changes from “ZeroTier lowest” to “Twingate lowest”.
Are SSO/SCIM included?
Tailscale Standard includes SCIM; Twingate Teams includes Google Workspace SSO, Business adds Okta/Entra/SCIM; ZeroTier Essential includes OIDC SSO, with SCIM/higher audit at higher tiers. Put IdP and SCIM on the same comparison sheet.
Can it replace a traditional VPN?
Yes, but differently: Tailscale/ZeroTier are overlay/full-mesh, Twingate is ZTNA connectors. Before replacing VPN, confirm internal DNS, subnet routes, broadcast/multicast, legacy app compatibility, exit nodes and firewall/NAT traversal.
What hidden costs should we expect?
Extra users/devices, Mullvad, tagged resources, ephemeral minutes, enterprise SSO/SCIM, audit/log export, connectors/relays, support/SLA, migration/training and tax. ZeroTier Scale adds flow rules/unlimited networks; Tailscale’s ACL groups/tagged resources have tier caps.
Research method and limitations
This article separates “official facts” from “editorial modelling”: Tailscale Standard/Premium user prices and unlimited devices, Twingate Teams/Business user prices and user caps, and ZeroTier Essential/Scale device prices and allowances come from the three US pricing pages (accessed 6 November 2026); the 10/50/200-person and 1:1/multi-device totals are arithmetic on published unit prices, not vendor quotes. It does not compare actual throughput, latency, NAT traversal, connector HA, audit completeness or support response.
Eight limitations: (1) only US public list prices are used, excluding tax, discounts, commitments and regional differences; (2) seats/devices only, excluding Mullvad, tagged resources, ephemeral minutes, enterprise SSO/SCIM, audit export, connectors/relays, support and migration; (3) the products are not feature-equivalent: ZeroTier is overlay/SD-WAN, Tailscale is full mesh, Twingate is ZTNA; (4) one device per person is the main assumption, with a separate multi-device table; (5) throughput, latency, NAT traversal, connector HA and audit completeness were not tested; (6) Cloudflare Zero Trust, NetBird and OpenVPN are excluded; (7) enterprise contracts may include volume pricing; public annual/monthly prices are used; (8) prices and terms can change by contract, region and exchange rate. Treat this as a user/device conversion template and replace assumptions with a 2–4 week real-access POC.
Sources and basis
- Tailscale, Pricing: tailscale.com/pricing. Personal free up to 6 users; Standard 8/user/month with unlimited devices, SCIM, 10 ACL groups and 50 tagged resources; Premium 18/user/month with 300 ACL groups and 10k ephemeral minutes; Mullvad 5 per 5 devices/month, extra tagged resource 1 each/month. Accessed 6 November 2026.
- Twingate, Pricing: twingate.com/pricing. Starter free for 5 users; Teams 5/user/month annual (≤100 users, Google SSO, SaaS gating); Business 10/user/month annual (≤500 users, Okta/Entra, SCIM); Home 15/month (≤7 users, non-commercial). Accessed 6 November 2026.
- ZeroTier, Pricing: zerotier.com/pricing. Free 10 devices/1 network; Essential 18/month includes 10 devices, then 2/device, 10 networks/5 admins, OIDC, 30-day audit; Scale 179/month includes 100 devices, then 1.80/device, unlimited networks/10 admins, flow rules; Enterprise custom for 500+ devices. Accessed 6 November 2026.
Data cut-off 6 November 2026; prices are public list prices excluding tax; all models are editorial calculations. This is not procurement advice.