![\"Project](\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\")
Last validated: Jan 5, 2026
\nThe current version of the Tailscale client requires macOS Monterey 12.0 or later.
\nThe best way to install Tailscale on macOS is to download and install our application from our package server.
\n\nHowever, there are three ways (variants) to run Tailscale on macOS. You can choose the method that best fits your needs.
\ntailscale + tailscaled CLI-only distribution from our GitHub repository.Installing Tailscale on macOS - YouTube
\nTap to unmute
\nInstalling Tailscale on macOS Tailscale
\nTailscale68.5K subscribers
\nAll three variants share the same core functionality for connecting your macOS device to Tailscale. However, there are subtle differences in the way that the variants are packaged and how they interact with macOS. You should choose the variant that best fits your use case.
\nWe recommend downloading and installing the Standalone variant Tailscale app directly from our package server, as this variant offers more features, is not subject to limitations imposed on apps distributed through the App Store, and provides more control over the deployment of updates.
\nWe always recommend installing the Standalone variant of the Tailscale application on macOS.
\nIn macOS Catalina 10.15, Apple added support for the system extensions\r\napproach to implement VPNs. System extensions offer a more secure alternative to the legacy Kernel Extensions technology\r\npreviously used by many security and networking tools on older macOS versions. These extensions run with root privileges\r\nbut remain within a sandbox, ensuring that Tailscale operates isolated from the macOS kernel. A key advantage of system extensions\r\nis their ability to be distributed outside of the Mac App Store. This lets us offer a version of Tailscale that doesn't require\r\nan Apple ID for installation — you can open our .pkg installer to begin using Tailscale.
With the Standalone variant of our app, security updates are promptly distributed since they don't need to undergo Apple's App Store review process.\r\nAdditionally, Tailscale can detect third-party tools interfering with the VPN tunnel and notify you when conflicts are detected.
\nTo be in the Mac App Store, applications are required by Apple to run in the macOS App Sandbox,\r\nisolating the app from the rest of the system. When running in a sandbox, VPN applications need to be a Network Extension\r\nto implement VPNs or VPN-like functionality. The Network Extension system does not work for applications distributed outside of the Mac App\r\nStore.
\nThe main advantage of installing Tailscale through the Mac App Store is that it is very easy to get started. However, because both the Tailscale app and its Network Extension are sandboxed and running as the local user, there are a number of limitations.\r\nFor instance, a very common issue is that the Screen Time web filter can conflict with the Tailscale version distributed on the App Store.
\ntailscaled variantIt is possible to run the open source Tailscale code (tailscaled) on macOS.\r\nThis uses the kernel utun interface,\r\nrather than the Network Extension or System Extension frameworks. However, this variant does not include a graphical user interface (GUI); all functionality must be managed from the command line. Additionally when using the open source tailscaled variant, you won't be able to manage Tailscale from the VPN settings on macOS.
tailscaled on macOS is only recommended for unattended installs managed by\r\nexperienced macOS system administrators.
Always start by downloading and installing our Standalone variant macOS app. Install Tailscale from the Mac App Store only if you are unable to install the Standalone variant, or\r\nif you're deploying Tailscale in an environment where relying on the Mac App Store for install and updates is essential.
\nDo not install the Mac App Store variant and the Standalone variant on the same machine. Having both variants running simultaneously can prevent the Tailscale extension from launching. To safely switch between macOS variants, delete the Tailscale.app currently installed, empty the Trash, and reboot your Mac before attempting to install a different variant.
This table presents the major differences in functionality between the three variants:
\n| | App Store
Network Extension | Standalone
System Extension | tailscaledutun interface |\r\n| --- | --- | --- | --- |\r\n| Available | yes | yes | yes |\r\n| GUI | yes | yes | no |\r\n| CLI | yes | yes | yes |\r\n| Minimum macOS | macOS Monterey 12.0 | macOS Monterey 12.0 | macOS Monterey 12.0 |\r\n| Requires Apple ID | yes | no | no |\r\n| Run before login | no; sandboxed | no | yes |\r\n| Keychain used | user | none; files on disk | none; files on disk |\r\n| Sandboxed | yes | system ext only | no |\r\n| Auto-updates | yes; managed by the App Store | yes; managed in-app ( Sparkle) | no |\r\n| Open Source | no | no | yes |\r\n| MagicDNS | yes | yes | yes |\r\n| Taildrop | yes | yes | incomplete |\r\n| Funnel | no | no | yes |\r\n| Exit nodes | yes | yes | partial; can advertise as exit node but cannot use them |\r\n| MDM support | yes | yes | no |\r\n| Can be a Tailscale SSH server | no | no | yes |\r\n| Can be a Tailscale SSH client | yes | yes | yes |\r\n| Supports tailscale ssh CLI command | no, must use the regular ssh command | yes | yes |\r\n| Supports services collection | no | yes | yes |\r\n| Compatible with Screen Time web filter | no | yes | yes |\r\n| Can generate configuration reports for support | limited | yes | no |
To automate installs of the Mac App Store version of Tailscale, the\r\nmas-cli tool lets you run:
mas install 1475387142\nTo review common macOS issues and suggestions to help resolve them, refer to the Troubleshooting guide.
\nAsk AI
\nreCAPTCHA
\nRecaptcha requires verification.
\nprotected by reCAPTCHA
\n"}