Six plans,
no surprises
Start free with no credit card. Upgrade in one click when you need BYO Exit, more devices, or multi-site capacity. On-premise deployment available under enterprise agreement.
- 1 user
- 10 devices
- 3 networks
- 1 native-LAN network
- 1 host node
- 1 API token
- 7-day history retention
- Community support
- 1 user
- 20 devices
- 10 networks
- 3 native-LAN networks
- 3 host nodes
- BYO Exit (Mullvad / Proton / custom)
- 3 API tokens
- 30-day history retention
- 5 users
- 30 devices
- 25 networks
- 10 native-LAN networks
- 10 host nodes
- BYO Exit included
- 10 API tokens
- 90-day history retention
- Priority email support
- 25 users
- 100 devices
- 50 networks
- Unlimited native-LAN networks
- 50 host nodes
- BYO Exit included
- Access profiles included
- 25 API tokens
- 120-day history retention
- Priority email support
- 100 users
- 200 devices
- 100 networks
- Unlimited native-LAN networks
- Unlimited host nodes
- BYO Exit included
- 50 API tokens
- 180-day history retention
- Priority email support
- 1,000 users
- 2,000 devices
- 1,000 networks
- Unlimited native-LAN + hosts
- BYO Exit included
- 200 API tokens
- 365-day history retention
- Enterprise support + SLA
- On-premise deployment available
- SSO / SAML coming
- Audit log export coming
Full feature comparison
Every plan includes the full product surface — overlay + native-LAN networks, route-all VPN, automatic NAT traversal (zero firewall changes), REST API, MCP server, and the four-state presence model. The tiers differ on quantity caps and a couple of paid-only features.
| Feature | Free | Basic | Team Starter | Teams | Large Teams | Enterprise |
|---|---|---|---|---|---|---|
| Pricing | ||||||
| Monthly price | $0 | $10 | $20 | $50 | $150 | From $500 |
| Quantity caps | ||||||
| Users | 1 | 1 | 5 | 25 | 100 | 1,000 |
| Devices | 10 | 20 | 30 | 100 | 200 | 2,000 |
| Networks | 3 | 10 | 25 | 50 | 100 | 1,000 |
| Native-LAN networks | 1 | 3 | 10 | Unlimited | Unlimited | Unlimited |
| Host nodes (gateway machines) | 1 | 3 | 10 | 50 | Unlimited | Unlimited |
| Personal access tokens (PATs) | 1 | 3 | 10 | 25 | 50 | 200 |
| History retention | 7d | 30d | 90d | 120d | 180d | 365d |
| Core networking (every tier) | ||||||
| Overlay networks | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Native-LAN mode | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Route-all VPN through host | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Same-LAN detection + routing | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| NAT traversal (zero firewall changes) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| QR mobile provisioning | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| BYO Exit (Mullvad / Proton / custom) | ||||||
| Upload + activate provider WireGuard config | — | ✓ | ✓ | ✓ | ✓ | ✓ |
| Per-host upstream health monitoring | — | ✓ | ✓ | ✓ | ✓ | ✓ |
| Per-client BYO Exit selection | — | Coming | Coming | Coming | Coming | Coming |
| Observability + API | ||||||
| Four-state presence model | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Per-node traffic time-series | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Real post-NAT endpoint visibility | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| REST API + OpenAPI 3.1 spec | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| MCP server for AI agents | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Audit log export | — | — | — | — | — | Coming |
| Team management | ||||||
| Access profiles (self-service device onboarding) | — | — | ✓ | ✓ | ✓ | ✓ |
| Multi-user org membership | 1 | 1 | 5 | 100 | 1,000 | |
| Role-based access (owner / admin / member) | — | — | ✓ | ✓ | ✓ | ✓ |
| Team manager scoped roles | — | — | ✓ | ✓ | ✓ | ✓ |
| Auth + security | ||||||
| Per-device secrets + protocol v2 | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| PAT rotation + revocation | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| SSO / SAML / OIDC | — | — | — | — | — | Coming |
| Support | ||||||
| Community support ([email protected]) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Priority email support | — | — | ✓ | ✓ | ✓ | ✓ |
| Dedicated onboarding | — | — | — | — | — | ✓ |
| Uptime SLA | — | — | — | — | — | Yes |
| On-premise deployment | — | — | — | — | — | ✓ |
Frequently asked questions
What are the free tier caps?
1 user, 10 devices, 3 networks (1 of which can be native-LAN), 1 host node, and 1 API token. 7 days of history. Hit any cap and you can either delete something to free up space or click Upgrade plan in the dashboard to move to a paid tier.
Do I need a credit card to start?
No. Sign up with email and password, create your first network, add your first device. Stay on Free as long as you want — only the paid tiers go through Stripe Checkout.
Which tier is right for me?
Basic ($10/mo) is for solo power users who want BYO Exit (Mullvad / Proton / custom WireGuard upstream) and a few extra hosts. Team Starter ($20/mo) is for one real small business — up to 5 users, multi-site native-LAN, priority email support. Teams ($50/mo) is for growing organizations that need 25 users, 100 devices, access profiles, and more room to scale before enterprise. Large Teams ($150/mo) is for serious multi-site customers — 100 users, unlimited native-LAN networks. Enterprise adds SSO (coming), audit export, dedicated support, and on-premise deployment.
Is BYO Exit included in the free tier?
No — BYO Exit (uploading a Mullvad / Proton / custom WireGuard config to one of your hosts so every device in your network egresses through it) is a paid feature. It's included on Basic and every higher tier. The free tier covers core networking, native-LAN mode, and route-all through your own host without an upstream provider.
What counts as a "device"?
Anything enrolled in a wg0 network. A Linux server with the connector, a macOS laptop with the connector, and an iPhone imported via QR all count as one device each.
What's a "host node"?
A host node is a Linux or macOS machine you put on a LAN (or VPS) so wg0 can bridge that LAN into your network or run BYO Exit upstream tunnels. The host-node cap is separate from the device cap because hosts are the heavier capability — they bridge a physical subnet and can run a provider VPN tunnel for downstream clients.
How do I upgrade?
Click Upgrade plan ▾ on the dashboard, pick a tier, complete checkout via Stripe. Your new caps are live the moment the webhook reconciles. Downgrade or cancel from the same panel via Manage billing (Stripe Customer Portal). No re-enrollment, no migration, no downtime.
Do you offer on-premise deployment?
Yes — enterprise on-premise deployment is available under enterprise agreement for customers who need strict data residency, regulated-industry compliance, or air-gapped control plane operation. Contact [email protected] to discuss your requirements.
What about support?
Free and Basic tiers: community support via [email protected]. Team Starter, Teams, and Large Teams: priority email support. Enterprise: dedicated support with an SLA, a named contact, and a structured onboarding session.
Does wg0 work with SSO / SAML?
Not yet. Today's auth is email + password + JWT for the dashboard, and personal access tokens for automation. SSO/SAML integration is on the enterprise roadmap — contact sales if it's a must-have for your deal.
What's the difference between wg0 and Tailscale / NetBird / ZeroTier?
wg0 does everything they do — user-to-device identity, role-based access profiles, team-scoped enrollment, managed heartbeat, NAT traversal — plus things they don't: native-LAN mode (reach devices you can't install agents on), BYO Exit (chain your own Mullvad/Proton upstream), multi-site gateway meshing, Docker/Kubernetes connectors, and a full REST API with an MCP server for AI agents. No per-seat pricing, no mandatory SSO tax, no SASE upsell. You get a flat account with simple device caps and every feature unlocked at your tier.
Start free in under a minute.
Sign up, create a network, add your first device. No credit card. 3 networks and 10 devices on the house.