All three build a WireGuard mesh network. The difference is how much of it you run yourself.
| You self-host | Clients | Identity | Price | |
|---|---|---|---|---|
| Tailscale | nothing (optionally a DERP relay) | open source | tied to Google/Microsoft/GitHub | Business $6/user/mo |
| Headscale | the coordination server | official Tailscale clients | punts on identity | free (community project) |
| NetBird | everything, or nothing | fully open source (BSD-3) | any OIDC provider | Cloud $5/user/mo, self-host free |
Tailscale is hosted-first: you sign in, add devices, done. Near-zero config. The coordination server is proprietary, and identity is limited to the big three SSO providers, but for a small team that just wants a VPN that works, it's the easiest path — and Business is only $6/user.
Headscale is a community reimplementation of Tailscale's control plane. You self-host the coordinator but keep using the official, polished Tailscale clients. It's the sweet spot for a homelab or a hobbyist who already likes Tailscale and wants to stop depending on the hosted control plane — but it doesn't handle identity, so you wire that up yourself.
NetBird is self-host-first with a hosted SaaS layer on top. Everything is open source under a permissive license, it plugs into any OIDC identity provider out of the box, and self-hosting costs nothing beyond your server. NetBird Cloud is $5/user/month if you don't want to run it.
Just want a team VPN that works: Tailscale. Already a Tailscale fan who wants to self-host the brains: Headscale. Need a fully open-source stack with your own IdP: NetBird, self-hosted for infrastructure cost only.