Tailscale SSH session recording alternatives now that tsrecorder is deprecated
Tailscale has stopped offering tsrecorder, its session recorder for Tailscale SSH, to new users, and support for existing setups ends in August 2027. You can keep your recorder running until then, ask Tailscale sales about its replacement, Tailscale PAM (in beta), or switch to another recorder. shellz records on each Linux server, so your tailnet and access rules stay as they are.
Choose shellz if
- You want to keep Tailscale for networking and record every login on the server, including regular SSH, consoles, SFTP and
docker exec. - You want to stop running the
tsrecordercontainer and remove it from your Tailscale policy. - You want sessions encrypted on the server before upload, with keys only your team holds on every plan.
- You run a homelab or small startup: free for up to 10 servers, or $1 a month billed annually on Personal Pro.
Choose Tailscale PAM if
- You want networking and access rules for privileged systems in one Tailscale admin console.
- You need one tool to control access to SSH, Kubernetes, databases, RDP and web apps, with approvals in Slack.
- You want access control and recording in one product. shellz only records and never decides who can log in.
- You're fine adopting a beta sold through sales, with recordings passing through Tailscale's servers.
At a glance
| Capability | shellz | tsrecorder | Tailscale PAM |
|---|---|---|---|
| Status | Generally available | Deprecated; support ends August 2027 | Beta since August 27, 2026 |
| How you get it | Sign up and install, one command | Existing setups only | Through Tailscale sales |
| Where recording happens | On the Linux server, in the login shell | Server streams the session to your recorder over the tailnet | A Tailscale connector you run in your network |
| Regular SSH (`sshd`) and console logins | Yes | No, Tailscale SSH only | No, only sessions through the connector |
| `docker exec` sessions | Yes, linked to the SSH login | No | Not documented |
| Databases, Kubernetes, RDP | No | Partial: Kubernetes only | Yes, with recordings where supported |
| What's recorded | Full replay plus transcript; password prompts excluded | Screen output only, no keystrokes | Session logs and recordings |
| Where recordings are stored | shellz storage that can't be edited, encrypted on your server first | Recorder's disk or your S3 | Tailscale's storage; your S3 on Premium |
| Recordings pass through the vendor | Yes, encrypted; with Perfect Secrecy only your team's passkeys can decrypt them | No, streamed inside your tailnet | Yes, through Tailscale's servers |
| Extra infrastructure | None beyond the install on each server | The tsrecorder container | Connectors in your network |
| Pricing | Free tier; paid from $1 a month | Was included on Personal and Enterprise plans | Not published; your own S3 needs Premium |
The options
01shellz
Records each login on the server, whether it comes over your tailnet or a public IP. That covers regular SSH,
su -, consoles, desktop terminals, SFTP anddocker exec. Bots and AI agents that SSH in with their own account are recorded too (recording AI agents).- best for
- Tailscale users who want every terminal session on their Linux servers recorded, with no recorder to run.
- pricing
- Free for up to 10 active servers. Personal Pro is $1 a month billed annually. Commercial is $10 per member a month plus $1/GB.
- watch out
- Linux only (systemd distributions on amd64 and arm64). It doesn't record Kubernetes, databases or RDP, doesn't control access, and can't be self-hosted.
02Keep tsrecorder until August 2027
Your recorder container keeps receiving sessions over your tailnet and saving them to local disk or S3. Tailscale never sees the contents.
- best for
- Homelabs and small teams whose current setup works and who can wait.
- pricing
- Included for existing setups until support ends in August 2027.
- watch out
- It only records Tailscale SSH (and Kubernetes through Tailscale's operator), never regular SSH. By default, sessions go ahead unrecorded if the recorder is down. If you make recording mandatory, a full recorder disk ends open sessions and blocks new logins.
03Tailscale PAM
Built on Border0, which Tailscale bought in March 2026, and in beta since August 27, 2026. Connectors you run in your network handle sessions. Engineers sign in with your identity provider and request access in Slack.
- best for
- Teams who want one Tailscale console for networking and temporary access to SSH, Kubernetes, databases, RDP and web apps.
- pricing
- Sold through Tailscale sales, with no public price. Storing recordings in your own S3 needs the Premium plan ($18 per user a month).
- watch out
- Still beta. Even if you store recordings in your own S3, they pass through Tailscale's servers on the way.
04Teleport
An access gateway that can run alongside your tailnet or replace Tailscale SSH. It records interactive sessions on each server through its own SSH service.
- best for
- Startups that want certificate-based access to SSH, Kubernetes, databases and desktops, with replay, in one system.
- pricing
- Community Edition is free for personal use and for companies under 100 employees and $10M in revenue. Enterprise is quoted.
- watch out
- More to run than
tsrecorder. You need a Teleport cluster (or Teleport Cloud) and an agent on each server, and logins that skip Teleport aren't recorded.
05Warpgate
A single program that proxies SSH, web, RDP, VNC, Kubernetes, PostgreSQL and MySQL connections. You replay SSH, Kubernetes, RDP and VNC sessions in its admin page.
- best for
- Self-hosters who want a free bastion with replay in the browser and no client software.
- pricing
- Free and open source (Apache-2.0), with every feature included. Paid support from EUR 650 a month.
- watch out
- Self-hosted only, so patching and backups are on you. Direct SSH logins that skip Warpgate aren't recorded.
06ShellHub
An agent on each device connects out to ShellHub, so you can SSH in without opening ports. The Cloud and Enterprise editions record sessions and include a web player.
- best for
- Homelabs and remote Linux devices behind NAT that need SSH access and playback without opening ports.
- pricing
- Cloud is free for up to 3 devices, then billed per device monthly. The self-hosted Community edition is free with no device limit.
- watch out
- The free self-hosted edition doesn't record sessions. Logins to the device's own SSH server aren't recorded either.
07Cloudflare Access for Infrastructure
Sends SSH through a Cloudflare tunnel and Cloudflare's client, and servers trust certificates Cloudflare issues. Command logs are encrypted with a key you provide.
- best for
- Teams already on Cloudflare Zero Trust, with under 50 users, who want short-lived SSH certificates.
- pricing
- Free for up to 50 users, then $7 per user a month.
- watch out
- There's no player in the dashboard. You download each log and decrypt it yourself, and the free plan keeps logs for 24 hours. Running Cloudflare's client next to Tailscale means two overlay networks.
tsrecorder support ends in August 2027
tsrecorder is the container Tailscale users run to record Tailscale SSH sessions. In March 2026 Tailscale bought Border0, a privileged access startup. On August 27 it launched Tailscale PAM in beta and marked tsrecorder as deprecated. New users can't get it, and support for existing users ends in August 2027.
If you already run it, it keeps recording until then. New tailnets are pointed to Tailscale PAM, a beta sold through sales that records through connectors in your network.
Each option records in a different place
With tsrecorder, each server streams the session's screen output over your tailnet to the recorder. Tailscale's docs say it records Tailscale SSH only, never regular SSH over a Tailscale IP, and that it doesn't record keystrokes. If the recorder's disk fills up, open sessions end and new ones are refused until you change your Tailscale policy.
Tailscale PAM records in a connector you run. Even if you store recordings in your own S3 bucket, which needs the Premium plan ($18 per user a month), they pass through Tailscale's servers first.
shellz records on the server and leaves the network alone. One install command per server puts the recorder in place, and sessions are encrypted there before upload. The security page explains how keys are handled.
We haven't certified Tailscale SSH with shellz yet. Tailscale SSH has its own SSH server, but it still starts the user's normal login shell, which is where shellz records. Before you remove tsrecorder, run tailscale ssh into one server on the free plan and check that the session shows up live.
For a homelab, start free. For SOC 2, check what your auditor asks for
Ten homelab VMs fit in the shellz free plan, and paid plans go up from there. For a self-hosted bastion that also handles RDP or VNC, run Warpgate in Docker. For Raspberry Pis behind NAT without Tailscale, ShellHub's free plan covers 3 devices.
A startup preparing for SOC 2 that already controls production access with Tailscale and SSO can add shellz for tamper-evident recordings on every Ubuntu or Debian server. Engineers connect the same way as before.
shellz is young, has no SOC 2 report of its own yet, and doesn't handle database or Kubernetes access. If your auditor also wants Slack approvals and database query logs, pick a gateway from the StrongDM alternatives or read whether you need PAM at all.
Questions
When does Tailscale tsrecorder stop working?
Tailscale stopped offering tsrecorder to new users in 2026, and support for existing users ends in August 2027. Existing recorders keep working until then.
What is Tailscale replacing tsrecorder with?
Tailscale PAM, which entered beta on August 27, 2026 after Tailscale bought Border0. It's sold through Tailscale sales.
Does shellz record sessions over Tailscale?
Yes for regular SSH over your tailnet, the same as any other login. Tailscale SSH should be recorded too, because it starts the user's login shell, but we haven't certified it yet. Test one server before you retire tsrecorder.
Does tsrecorder log keystrokes or passwords?
It records what appears on screen, never keystrokes. Anything echoed to the screen is in the recording. Password prompts hide what you type, so passwords aren't captured.
What are the free alternatives to tsrecorder?
The shellz free plan (10 servers, last 50 recordings), self-hosted Warpgate, ShellHub Cloud for up to 3 devices, Cloudflare Access for Infrastructure for up to 50 users, and Teleport Community Edition for small companies.
Related comparisons
- Teleport vs shellz for SSH session recording/compare/teleport
- HashiCorp Boundary alternatives after the Community Edition archive/alternatives/hashicorp-boundary
- PAM vs session recording: do you need a PAM suite yet?/guides/pam-vs-session-recording
- AWS Session Manager session recording vs shellz/compare/aws-session-manager
Sources
Competitor details come from public documentation and pricing pages, last checked on November 3, 2026. Products change; if something here is out of date, tell us at hello@shellz.dev and we will correct it.
- Tailscale docs: Tailscale SSH session recording (deprecation notice)
- Tailscale blog: Tailscale PAM beta (August 27, 2026)
- Tailscale blog: Border0 is joining Tailscale (March 17, 2026)
- Tailscale docs: Store Tailscale PAM session recordings in S3
- Tailscale pricing
- Teleport: Community Edition license change
- Teleport docs: Session recording architecture
- Warpgate
- Warpgate docs: Session recordings
- ShellHub Cloud
- ShellHub pricing
- ShellHub docs: Self-hosted vs Cloud
- Cloudflare One docs: SSH command logs
- Cloudflare docs: Access for Infrastructure SSH setup
- Cloudflare Zero Trust plans