Two Tailscale accounts on one machine, both live: work + personal in 2026

With the official Tailscale client you can be logged into two accounts on one machine — but only one is ever live. The client stores both; a device transmits on a single tailnet at a time, and switching to the other logs the first out of the network in every way that matters. With TailMux, both accounts are genuinely live at once: each account runs as its own isolated profile, and traffic reaches the right one based on the hostname you're connecting to.

That distinction — stored vs live — is the whole answer, so let's take it apart.

“Logged in” is not “connected”#

The question shows up in r/Tailscale almost word for word: “Is there a way to easily have two Tailscale accounts configured on a single machine?” Usually it's work and personal, and what the person wants is both reachable at the same time — without logging out, without switching networks between tasks.

The official client separates two things people conflate:

• Accounts it remembers: several. Credentials for work and personal both sit on the machine.
• Accounts that are connected: exactly one. Whichever is active owns your routes, your DNS, your packets. The other is parked — its hosts unreachable, its MagicDNS names dead.

Making both connected at once is a feature request (#183) that has been open for years. Tailscale's interim answer, fast user switching, moves which one is parked — it never unparks both. If that's the piece you want dissected, read fast user switching vs simultaneous tailnets.

One profile per account, each with its own identity#

TailMux models each account as a profile, and each profile runs its own embedded Tailscale node with its own state, its own login, and its own node key. Your work account sees one node; your personal account sees a different node. Neither knows the other exists, and — important on a work machine — the official Tailscale app, its account, and its session are never touched. TailMux runs beside it, not inside it.

The config is the clearest way to see the model — two accounts, two profiles, each owning the DNS suffixes of its tailnet:

1profiles:2  personal:3    suffixes:4      - .home-lab.ts.net5  work:6    accept_routes: true7    suffixes:8      - .work.ts.net9      - .internal.example

A loopback-only router matches each request's hostname against those suffixes and dials the owning profile — so which account handles a connection is decided by the name you typed, automatically.

“The two networks need to stay separate”#

For work + personal, isolation isn't a nice-to-have — it's the reason you kept two accounts in the first place. TailMux enforces it structurally:

• A hostname owned by one profile is never dialed through the other. There is no fallback path to misroute onto.
• Overlapping suffixes are rejected when the config is validated — two accounts can't both claim a name, ever.
• A .ts.net name that no profile owns is refused, not guessed.
• Profiles never bridge: nothing on your home tailnet can transit your machine to the work tailnet, or vice versa.

Personal traffic can't wander onto the corporate network by accident, and work names can't leak to your homelab. The design behind these guarantees is covered in the architecture explainer.

A day with both accounts live#

What this actually feels like, versus switching:

• 9:00 — tailmux ssh admin@host.work.ts.net opens a shell on a work server, routed through the work account automatically. In the next tab, your NAS sync to nas.home-lab.ts.net keeps running on the personal account. Neither knows about the other.
• All day — a Service Tunnel keeps the work database on a fixed local port through the work profile: point your database GUI at 127.0.0.1:15432 once and it connects to db.internal.example:5432 whenever the profile is up. (Tunnels are managed in the app under Open → Tunnels — see the tunnels docs.)
• In the browser — wiki.work.ts.net and jellyfin.home-lab.ts.net load in adjacent tabs, each resolved and dialed by its own account.
• Never — you flip an account, drop an SSH session, or wait for a tailnet to come back up.

The consultant variant: a client's tailnet as account #3#

The same model scales past two. If a client invites you into their tailnet, add it as a third profile owning that tailnet's suffixes. You manage their systems and yours in the same hour — “without having to switch networks”, which is the exact phrase people use when they ask for this — and the client tailnet gets the same hard isolation from both of your own.

Setting it up#

Three commands and two logins:

$brew install --cask cq-fabrication/tap/tailmux   # macOS; Linux: brew install cq-fabrication/tap/tailmux$tailmux init && tailmux config validate$tailmux up && tailmux profile login personal && tailmux profile login work

The full walkthrough — PAC for the browser, tailmux ssh, tunnels, verification — is in the platform guides: macOS and Linux.

The bottom line#

Two Tailscale accounts on one machine is easy; two accounts live at the same time is the part the official client doesn't do. Give each account an isolated profile and route by hostname, and the question dissolves: work names go to the work account, personal names to the personal one, nothing leaks, and nothing ever needs switching. See the work & personal use case, download TailMux, or check current pricing (a one-time purchase with a year of updates).