Tailscale without a second app

The app embeds a Tailscale node of its own. Machines behind NAT, a home router or a corporate firewall become reachable without installing the Tailscale app or capturing your phone's whole network.

Why embedded rather than the system VPN

Android allows one VPN at a time. A system-wide Tailscale connection routes your entire device and conflicts with a work VPN. The embedded node is a userspace WireGuard implementation used only by this app: your tailnet is reachable inside the terminal, and nothing else on the phone is affected.

Browsing your tailnet

Rather than typing a 100.x.y.z address, you can list the devices on your tailnet and add one as a host in a tap. Machine names come across, so hosts read as names rather than addresses.

Headscale and self-hosted control servers

The control server URL is configurable, so the app works with Headscale or any compatible coordination server. If you run your own mesh rather than using Tailscale's hosted service, this works the same way.

Authentication

Authenticate with a pre-authorised key, or let the app show a URL to approve the node in your browser. The auth key is held in the encrypted vault like any other credential.

Combining with other modes

Tailscale answers "how do I reach this machine". It does not authenticate the SSH session, so hosts using it still need a key or password — and pairing it with a hardware-backed key gives you a private network plus a non-exportable credential.

This mode is free.