Where Does Tailscale Store State and Keys?
Tailscale node state and prefs on desktop, and why encrypted state turns a TPM reset into a login loop.
Last updated
Tailscale splits identity two ways. The daemon state (node keys, prefs, Taildrop) lives in tailscaled.state: /var/lib/tailscale on Linux, C:\ProgramData\Tailscale on Windows, /Library/Tailscale or Keychain sealed storage on Mac depending on build. Windows adds per user prefs in %LOCALAPPDATA%\Tailscale.
Never copy state files between machines: both halves are required and node bound, so clones break instead of migrating. The encrypted state trap is real too: a TPM reset or Keychain loss makes the client fail to unseal, and the fix is removing the node from the admin console, deleting state, and logging in fresh.
Where Tailscale stores this, by platform
/var/lib/tailscale/tailscaled.state
Node keys, prefs and Taildrop state. Override with tailscaled --statedir or --state (also kube, SSM, mem backends). Daemon flags in /etc/default/tailscaled; logs via journalctl -u tailscaled.
C:\ProgramData\Tailscale\
Machine identity (server-state.conf) plus service logs. Per user prefs and node keys in %LOCALAPPDATA%\Tailscale\prefs.conf. Policies in HKLM\SOFTWARE\Policies\Tailscale. Do not copy either side between machines.
/Library/Tailscale/tailscaled.state
Open source daemon layout; App Store and Standalone GUI builds instead use prefs plist plus Keychain sealed state (tailscale-* entries). Three variants exist, so paths may vary by install. Logs via Console search for IPN.
Frequently asked questions
Can I copy Tailscale state to a new machine?
No. State files are node bound; cloning breaks both ends. Install fresh on the new machine and approve it in the admin console, then remove the old node.
Tailscale fails with failed to unseal state file. How do I fix it?
Encryption backing changed (TPM reset or Keychain loss). Remove the node from the admin console, delete the state dirs above, and log in again to generate fresh sealed state.
Notice an outdated path? Let us know.