Headscale vs NordVPN Meshnet: privacy compared
Headscale and NordVPN Meshnet are both rated in mesh VPNs and private networks against the same 7 public criteria. Headscale does better on open source, no trackers or telemetry, keys stay on devices and self-hosted coordination server.
| Criterion | Headscale Our pick | NordVPN Meshnet |
|---|---|---|
| Grade | Grade B B (82/100) | Grade F F (29/100) |
| Jurisdiction | Unknown | Panama Outside Eyes |
| Open source Is all the source code needed to run the product public? | Yes source | Partial source |
| No trackers or telemetry Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default? | Yes source | No source |
| No ads or data sales Is the product funded without advertising, ad targeting or selling user data? | Yes source | Yes source |
| Independent audit Has an independent security or privacy audit been published within the last three years? | No | Unknown |
| Keys stay on devices Is traffic encrypted between devices with private keys created on each device, so the coordination server and relays cannot read it? | Yes source | Partial source |
| Self-hosted coordination server Can the coordination or control server be self-hosted with open-source software? | Yes source | No |
| No connection logs by default Are connection logs and client diagnostic logs kept off the vendor's servers unless a user or admin turns them on? | Partial source | Unknown |
Summaries
Headscale. Headscale scores 82 out of 100 (grade B) on the mesh VPNs and private networks criteria. It meets 5 of 7 criteria: open source, no trackers or telemetry, no ads or data sales, keys stay on devices and self-hosted coordination server. It partly meets no connection logs by default. It does not meet independent audit.
NordVPN Meshnet. NordVPN Meshnet scores 29 out of 100 (grade F) on the mesh VPNs and private networks criteria. It meets 1 of 7 criteria: no ads or data sales. It partly meets open source and keys stay on devices. It does not meet no trackers or telemetry and self-hosted coordination server. Still needing evidence: independent audit and no connection logs by default. It is based in Panama: Not in the Five, Nine or Fourteen Eyes.