On August 26, 2026, Tailscale’s Tailcat project was drawing attention as an alternative way to establish encrypted, point-to-point connections using pieces of the company’s open-source networking stack. The project is designed to resemble netcat, the long-established command-line utility for moving data across network connections, while operating over Tailscale’s data plane without relying on its control plane.
Tailcat exchanges connection details outside the Tailscale service. A server starts a listener and produces a short connection token, which a client supplies to initiate a connection. Traffic is encrypted end to end with WireGuard. The connection begins through a DERP server, while Tailscale’s magicsock component attempts NAT traversal and upgrades the session to a direct peer-to-peer UDP path when conditions allow. DERP remains available as a relay if a direct route cannot be established.
The project can run entirely in user space and does not change a machine’s routing tables or DNS settings. According to its documentation, users do not need a Tailscale account or administrator access. The default setup can use Tailscale’s free, rate-limited DERP relays, while operators can instead run their own relay or publish a separate DERP map.
Tailcat is available as both a Go library and a command-line program. Its documented uses include forwarding a local TCP port, testing whether traffic is taking a direct or relayed route, creating a SOCKS5 proxy, providing access to a server-side network and carrying SSH connections. An experimental WebAssembly browser demo can exchange text or files with the command-line client, although browser sessions currently remain on DERP rather than moving to a direct connection.
Connection identity is tied to WireGuard keys. The default server behavior creates an ephemeral key in memory, making its token unusable after the process exits. Saved keys provide a stable address across restarts, but the documentation warns that anyone who has received that address may be able to connect again unless the server restricts clients. Tailcat supports allow-listing with client public keys, and tokens may also be published through DNS TXT records.
For published, stable server addresses, the documentation recommends pinning a key to a fixed DERP region so restarts rendezvous in the same location. Self-hosted relay information can be embedded in a longer token, allowing clients to connect without consulting Tailscale’s default DERP map.
The design gives developers a compact way to experiment with encrypted connectivity and NAT traversal while choosing how peers exchange their initial metadata. It also shifts responsibility for safely sharing tokens, managing persistent keys and operating relay infrastructure to the people deploying it. Tailcat remains a developer-oriented project, with its browser path and some connection behavior explicitly described as experimental.
