jssh vs Tailscale
Tailscale alternative for device fleets: isolation without a mesh
When to choose Tailscale: Your problem is "my team needs to reach our own servers, VMs and laptops as a private network". For team-to-own-infrastructure access, Tailscale is the right tool and you should use it.
A mesh is the wrong shape for a fleet
Tailscale creates a network where joined machines can reach each other, then you constrain it with ACLs. That is ideal for a team, and exactly backwards for a fleet:
- No device-to-device traffic. Fleet devices must never reach each other. In a mesh you get connectivity by default and write ACLs to remove it, so the segmentation is only as good as the ACLs you maintain and audit forever. jssh has no path between devices to begin with: one isolated relay endpoint per device, and lateral movement is impossible by construction.
- Multi-tenant by design. An MSP managing 30 customers’ hardware on one tailnet has to police a single ACL set, and separate tailnets per customer multiply admin overhead. jssh keeps each customer as a separate organization with its own devices, access rules and audit trail, on every plan.
- Per-seat pricing misfits a fleet. Tailscale prices per user ($8 to $18 per user per month), which is sensible for teams. Fleet devices join a tailnet as tagged resources, billed as of June 2026 at 50 included, then $1 per device per month, so a 500-device fleet is about $450 a month in device fees before you count seats, and network flow logs sit in the $18 Premium tier. Source: tailscale.com/pricing, retrieved June 2026 (archived). jssh charges neither per device nor per seat. What it meters is how many sessions are open at the same time, and the monthly figures are on the pricing page.
Where we deliberately match them
Tailscale set the bar for connectivity that just works, and we hold ourselves to it:
- NAT traversal: sessions negotiate direct peer-to-peer when the network allows it and fall back to an anycast relay when it does not, including networks that block UDP entirely, where the session runs over TLS on 443.
- Latency: we measured 7.4 ms p50 on the direct path and about 33 ms over TLS on 443 with UDP blocked at both ends, and neither number is a timeout.
- One-command onboarding on the device, single sign-on for operators.
Where we differ on purpose
| jssh | Tailscale | |
|---|---|---|
| Model | Device-isolated relay (no network) | Mesh VPN (a network) |
| Device to device | Impossible by architecture | Allowed unless ACL’d away |
| Multi-tenant (MSP) | Separate organizations, scoped operators, per-organization audit | Per-tailnet workarounds |
| Pricing axis | Concurrent sessions. Devices and seats are both uncounted | Per user |
| Agent | About 4 MB on ARM, static musl with no libc dependency on Linux | Go binary; heavier on tiny targets |
| Scope | SSH, RDP and VNC to fleet devices (focused) | General networking (broad) |
| Audit | Per-session, on every plan | Network logs on higher tiers |
Using both
Plenty of teams will: Tailscale so engineers reach the company’s own cloud, jssh so support reaches devices in the field one at a time with an audit trail behind it. They solve different problems and they do not conflict on the host, because the jssh agent creates no interface and adds no route.
Last reviewed .