Amnezia VPN (self-hosted with obfuscation) vs Tailscale (managed WireGuard mesh): which wins in 2026?
Head-to-head on the facts that decide the purchase: real prices in the provider's own unit, minimum, KYC, proof, payment and terms - every number sourced in the linked reviews.
The most credible self-hosting on-ramp in the VPN space, built by and for people inside the censorship: the app is free and open source, you connect it to your own $5 VPS over SSH and it deploys the server for you, so your traffic never touches an Amnezia-operated machine. Its signature AmneziaWG protocol is the WireGuard cryptographic core with a serious anti-DPI layer (dynamic headers, randomized packet sizes, QUIC/DNS mimicry), and version 3.1 was rushed out after Russia's June-July 2026 hybrid attack - mass IP blocking, DDoS, and phishing against the team - that knocked the service around for a month and a half. The honesty ledger cuts both ways: security audits by 7ASecurity in 2022/2024/2025 and open code, but also a corporate structure that has drifted from Portugal (IP holder) to Estonia (operations) to a Cyprus-registered entity per today's footer, no public ledger of funding beyond donations and its paid services, self-hosting advocates calling the setup wizard opaque, and an open GitHub issue (since Aug 2024) documenting AmneziaWG being DPI-detected on Russian mobile networks. It is a censorship tool first; as an anonymity or streaming product it is the wrong category.
The gold standard for connecting your OWN devices, and a poor substitute for a consumer VPN - which is exactly what it says on the tin. Tailscale is a WireGuard mesh coordinator: traffic flows device-to-device end-to-end encrypted, the closed-source coordination server sees device/key/connection metadata including which nodes talk to which, and exit nodes are your own machines unless you pay for the Mullvad add-on. The free Personal tier (6 users, unlimited devices, verified live 2026-11-02) is genuinely generous and homelab communities adore it. Honest caveats: no public audit of the closed control plane (SOC 2 and Latacora reports are on-request only), client logs stream to Tailscale by default unless disabled, business payments are non-refundable per the terms, and October 2026's uncoordinated 'Tailworm' disclosure (11 SSH findings, root socket-forwarding escalation, fixed in v1.104.4) showed how fast a trusted tool can need urgent patching. Fully self-hosted users escape the trust question via Headscale, the third-party open-source control server - which Tailscale tolerates rather than builds. Dossier data quality: all operator pages, GitHub files, Wikipedia, the independent review, news, the Tailworm report and community archives were fetched live by this site on 2026-11-02; the coordination backend itself cannot be independently verified by anyone outside the company.
Short answer: Amnezia VPN (self-hosted with obfuscation) wins overall (6.2/10 vs 4.9/10). Tailscale (managed WireGuard mesh) is the better pick if you care most about honest value. Facts checked 2026-11-02.
The facts
 Amnezia VPN (self-hosted with obfuscation) |  Tailscale (managed WireGuard mesh) | |
|---|---|---|
| Overall score (0-10) | 6.2 | 4.9 |
| Privacy & proof | ||
| Logging claim | 'If you use the AmneziaVPN app for a self-hosted VPN, we do not collect any data about… | Tailscale cannot read your traffic: end-to-end WireGuard encryption, private keys never… |
| Logging evidence | independently audited | promise only (no proof) |
| Audits | 7ASecurity 2024, 7ASecurity 2022, 7ASecurity 2025 | Aprio (SOC 2 Type II) 2023, Cyberdione Labs (Tailworm report… moreAprio (SOC 2 Type II) 2023, Cyberdione Labs (Tailworm report, uncoordinated disclosure) 2026 |
| Jurisdiction | Site footer (live 2026-11-02) names the operator as EUPHORIA… moreSite footer (live 2026-11-02) names the operator as EUPHORIATECH LIMITED, Akropoleos 82, Nicosia, Cyprus, reg HE 484287. TorrentFreak survey answers (added 2025) disclosed: 'The intellectual property rights are registered in the Portuguese jurisdiction with Amnezia LDA. The operational activities are carried out through Privacy Technologies, an entity based in Estonia.' The project was created in 2020 inside Russia at a Roskomsvoboda-supported hackathon (Wired, fetched 2026-11-02). For a self-hosted user the operative jurisdiction is actually wherever their own VPS is hosted - the developer's Cyprus registration does not sit on the user's traffic path. | Canada - Tailscale Inc., Toronto, Ontario (Wikipedia, Bloomb… moreCanada - Tailscale Inc., Toronto, Ontario (Wikipedia, Bloomberg); a Five Eyes member country; privacy policy names processing locations in Canada, Germany, the US and the UK |
| Owner | unknown | unknown |
| Money | ||
| Intro price | $5 /USD/mo VPS (self-hosted) | $8 /USD per user per month (Standard business seat) |
| Renewal price | not published | $8/mo |
| Anonymous payment | unknown | fiat |
| Account | ||
| Personal info | none | email or SSO identity required (Google, Microsoft, GitHub, O… moreemail or SSO identity required (Google, Microsoft, GitHub, Okta, etc.); no government-ID verification |
| Kind | Self-hosted | Self-hosted |
| Facts checked | 2026-11-02 | 2026-11-02 |
Score breakdown
Amnezia VPN (self-hosted with obfuscation) leads on privacy & logging (+3), security (+2.5), censorship resistance (+6) · Tailscale (managed WireGuard mesh) leads on honest value (+4.5).
Amnezia VPN (self-hosted with obfuscation) at a glance
++ What holds up
- Self-hosted mode is free, GPL-3.0 open source, and requires no account - your traffic goes only to your own VPS (GitHub README + FAQ, fetched 2026-11-02)
- AmneziaWG is documented in unusual technical depth, protocol mechanism by mechanism, with the WireGuard crypto core unchanged (docs.amnezia.org)
- Survived the largest state attack in its history (summer 2026: IP/subnet blocking, DDoS, API probing, phishing) and published a candid postmortem with compensation to subscribers
- Built and battle-tested where it matters: Russia, Iran, Myanmar, Turkmenistan, China are the actual user base, and an HN user confirmed the setup scripts were 'above board' on a throwaway VPS
- Free tier in genuinely censored countries (Instagram/Facebook/X access) and a Civil Rights Defenders partnership giving free Premium to journalists and activists
- Independent 7ASecurity security audits of clients and protocols in 2022, 2024 and 2025
-- What to watch
- You own the failure modes: a single-user VPS is trivial to block, and Iranian/Russian authorities block hoster IP ranges wholesale - community threads show constant server-hopping
- AmneziaWG has been detected by DPI before (open GitHub issue #1010 since Aug 2024, Russian MTS) and the project itself admits each protocol version is a temporary answer in an arms race
- Corporate opacity: operator entity is a small Cyprus company (EUPHORIATECH LIMITED) per the site footer, while the 2025 TorrentFreak answers named a Portugal IP holder and Estonia operator - jurisdiction depends on which page you read
- No public accounting of funding beyond donations (Patreon/crypto) and revenue from Premium/Hosting/Business - reviewers and community threads raise the question and get no ledger
- Setup wizard hands the app your VPS SSH credentials and historically hid its server scripts; HN users found buggy UI and a server private key embedded in exported config JSON (2025-12)
- Weak OpenWrt packaging (community-maintained packages), Premium torrenting limited to Netherlands and Switzerland with no port forwarding, and Amnezia Free is speed-capped at 8 Mbps without YouTube
- Useless during full internet shutdowns - Amnezia itself says so for Iran-style whitelists, where only satellite or mesh links work
Tailscale (managed WireGuard mesh) at a glance
++ What holds up
- Free Personal plan: up to 6 users and unlimited devices, no card required (live pricing page 2026-11-02)
- End-to-end WireGuard encryption; private keys never leave devices; DERP relays only forward ciphertext (operator security page fetched 2026-11-02)
- Open-source BSD-3 clients and DERP relay code, and a thriving third-party self-host path via Headscale
- Frictionless: SSO login, NAT punching that just works, and the tailnet keeps working even when the coordination server is down (operator docs)
- Mullvad exit-node add-on at $5/month per 5 devices borrows a genuinely respected no-logs operator
- Security transparency: public CVE-style security bulletins, and the Oct 2026 Tailworm response went from disclosure to patched release in about 4 days
-- What to watch
- Closed-source coordination server sees your device inventory, public IPs and which nodes connect to which - trust in Tailscale Inc. is structural
- No public audit report: SOC 2 Type II and ongoing Latacora audits are on-request or account-gated only
- Not an anonymity VPN: no rented server network, exit nodes are your own machines, streaming and geo-unblocking are out of scope
- Payments are non-cancelable and non-refundable per the Terms of Service (fetched 2026-11-02)
- Client session logs go to log.tailscale.com by default unless you opt out with --no-logs-no-support
- Feature sprawl since 2024 (PAM, Aperture AI gateway, DNS filtering) - community voices warn the simple core is getting buried under enterprise add-ons
FAQ
Which is cheaper, Amnezia VPN (self-hosted with obfuscation) or Tailscale (managed WireGuard mesh)?
Amnezia VPN (self-hosted with obfuscation) publishes a price (from $5 /USD/mo VPS (self-hosted)); Tailscale (managed WireGuard mesh) does not publish a comparable figure - and unknown is not free. Compare only the same unit before concluding anything.
Which has better logging evidence, Amnezia VPN (self-hosted with obfuscation) or Tailscale (managed WireGuard mesh)?
Amnezia VPN (self-hosted with obfuscation) has the stronger logging evidence; Tailscale (managed WireGuard mesh) relies on claims alone.
Which renewal price is honest, Amnezia VPN (self-hosted with obfuscation) or Tailscale (managed WireGuard mesh)?
Tailscale (managed WireGuard mesh) documents renewal at $8/mo; Amnezia VPN (self-hosted with obfuscation) hides its renewal price - unknown is not cheap.
Which needs less KYC, Amnezia VPN (self-hosted with obfuscation) or Tailscale (managed WireGuard mesh)?
At least one provider does not document its KYC policy - treat it as unknown, not as "no KYC".
Which has the longer track record?
Tailscale (managed WireGuard mesh) has the longer track record (since 2019).
Scores and facts: meta-reviews with dated sources - Amnezia VPN (self-hosted with obfuscation) · Tailscale (managed WireGuard mesh). Method: how we verify. More: all providers compared · all head-to-heads.