Tailscale without a second app

The app embeds a Tailscale node of its own. Machines behind NAT, a home router or a corporate firewall become reachable without installing the Tailscale app or capturing your phone's whole network.

Why embedded rather than the system VPN

Android allows one VPN at a time. A system-wide Tailscale connection routes your entire device and conflicts with a work VPN. The embedded node is a userspace WireGuard implementation used only by this app: your tailnet is reachable inside the terminal, and nothing else on the phone is affected.

Browsing your tailnet

Rather than typing a 100.x.y.z address, you can list the devices on your tailnet and add one as a host in a tap. Machine names come across, so hosts read as names rather than addresses.

Headscale and self-hosted control servers

The control server URL is configurable, so the app works with Headscale or any compatible coordination server. If you run your own mesh rather than using Tailscale's hosted service, this works the same way.

Authentication

Authenticate with a pre-authorised key, or let the app show a URL to approve the node in your browser. The auth key is held in the encrypted vault like any other credential. See the Tailscale setup guide for step-by-step instructions on both options.

Combining with other modes

Tailscale answers "how do I reach this machine". For an ordinary SSH server it does not authenticate the session, so those hosts still need a key or password — and pairing it with a hardware-backed key gives you a private network plus a non-exportable credential.

The exception is a machine running Tailscale SSH on port 22. The app signs you in with this device's tailnet identity — no key to import, no password to type, nothing to rotate — and your tailnet's own SSH rules decide who may connect. The host picker marks the tailnet machines that run it; a host on any other port keeps using the key or password you saved.

This mode is free.