Uninstall Tailscale on Mac
Tailscale connects this Mac to a private mesh network (a tailnet), so removing the app is not the same as leaving the network: the Mac can stay listed as a device in your tailnet's admin console until you log out or remove it there. This guide covers the Homebrew cask tailscale-app, which installs Tailscale's standalone pkg build; Tailscale also ships a separate Mac App Store app with a different underlying installation, covered below.
Disconnect before you remove the app
Open the Tailscale menu bar item and turn networking off, or run tailscale down in Terminal, before quitting. Disconnecting first avoids leaving an active VPN configuration behind while macOS is still removing the app and its system extension.
Log out, or remove the device from the admin console
Uninstalling Tailscale from this Mac does not by itself deauthorize the device. Log out from the menu bar item, or sign in to your tailnet's admin console at login.tailscale.com/admin/machines and remove the device there. Skipping this step leaves the Mac listed as a device other people on your tailnet can still see, even after the app is gone.
App Store vs. standalone: do not mix installs
The Mac App Store version and the standalone pkg/Homebrew build are two different installations with different bundle identifiers (io.tailscale.ipn.macos for the App Store build, io.tailscale.ipn.macsys for the standalone build with its own system extension). Tailscale's own issue tracker documents real cases of a broken menu bar icon and package-registry conflicts after switching from one to the other without a full uninstall first (tailscale/tailscale#13222). If you plan to switch build, fully remove the one you have, including its system extension, before installing the other.
Quit the app and remove the system extension
Quit Tailscale from its menu bar item, then move Tailscale.app to the Trash. Tailscale installs a network system extension separately from the app bundle; macOS may prompt to remove it when you delete the app, or you can remove it yourself under System Settings › General › Login Items & Extensions › Network Extensions. Mole does not remove system extensions itself; it only flags one as still registered so you know to clear it there.
Where Tailscale keeps its state
| Location | What it holds | What to do |
|---|---|---|
/Library/Tailscale |
Node keys and daemon state, root-owned | Neither Mole's own review nor Homebrew's uninstall step in the recorded test removed this; any path containing "tailscale" is treated as protected VPN state and is never offered for deletion. Remove by hand only if you are certain you no longer need this device's identity. |
/usr/local/bin/tailscale |
Root-owned tailscale CLI symlink |
Left behind after uninstalling in the recorded test, on both the official and Homebrew paths. Inspect before removing it yourself; administrator rights are required. |
~/Library/Containers/io.tailscale.ipn.macsys.login-item-helper and ~/Library/Containers/io.tailscale.ipn.macsys.share-extension |
Small helper containers for the login-item and Share menu extensions | For the same reason as /Library/Tailscale, Mole never lists these; they were left behind, empty, in the recorded test. |
Keychain items tailscale-machinekey, tailscale-logdata, tailscale-preferences |
Local node key and app state kept in the login keychain | Not something Mole manages; remove them in Keychain Access only if you want a completely clean local state. |
Check the result
Run these read-only commands in Terminal:
pgrep -ilf tailscale
ls -d /Library/Tailscale
ls -d /usr/local/bin/tailscale
pkgutil --pkgs | grep -i tailscale
systemextensionsctl list | grep -i tailscale
No output from pgrep means no Tailscale process is running. ls -d /Library/Tailscale printing the path means node state is still on this Mac, which most users leave in place unless they are certain they will not reconnect this device. The /usr/local/bin/tailscale check works the same way; "No such file or directory" from either means that item is gone. A com.tailscale line from pkgutil means the standalone pkg's installer receipt is still registered. A line from systemextensionsctl list means the network extension is still active and needs removing under System Settings.
If you installed it with Homebrew
The next Mole update will skip --zap when its list reaches unchecked or shared data, or cannot be fully checked. Mole will still clean the leftovers you selected. Preview 290 does not include this protection.
In Preview 290, Mole removes a Homebrew-installed Tailscale like brew uninstall --cask --zap tailscale-app. The cask's zap list covers /Library/Tailscale, every per-account Application Scripts, Containers, Group Containers, HTTPStorages and preferences path under io.tailscale.ipn.macsys, and its own uninstall step separately deletes /usr/local/bin/tailscale. In the recorded test, Tailscale.app and its helper were moved to the Trash, but the Homebrew Caskroom receipt, an empty preferences file, the empty share-extension container, and the root-owned /usr/local/bin/tailscale symlink all remained afterward; /Library/Tailscale was never offered for removal by Mole's own review, for the reason in the table above. Homebrew Tailscale cask
brew uninstall --cask tailscale-app
Running it without --zap still runs the same quit and pkgutil/delete steps and removes the app and the CLI symlink, but never attempts the zap paths above, which Mole's own scan does not touch either way.
What Mole lists
This describes Mole 1.15 (currently in Preview), for the Homebrew cask tailscale-app:
/Library/Tailscale,/usr/local/bin/tailscale, and any Container or Application Scripts path whose name contains "tailscale" are never listed by Mole's own residue review, on any install channel, because Mole's safety guard treats that word as protected VPN state.- An advisory badge appears on the app row when a Tailscale system extension is still registered; Mole does not remove it, only flags it.
- The Homebrew Caskroom receipt for
tailscale-appis left behind if the zap step could not clear the root-owned paths above; a leftover receipt does not affect Tailscale's own network state.
What this test covered
Tailscale was installed from the Homebrew cask tailscale-app and uninstalled through Mole on September 17, 2026. The Mac was not signed in to a tailnet, and the VPN configuration prompt was declined during install, so signed-in device removal and the App Store build were not exercised in this test. A user report on September 23, 2026 confirmed the same three items (the two empty containers and /Library/Tailscale) remain after migrating between the App Store and standalone builds on a separate Mac, matching this record.