ZeroTier

What ZeroTier actually is

ZeroTier is not a host — it is virtual networking software that makes scattered devices behave as if they share one Ethernet switch. You install a small agent on each device, join it to a 16-character network ID, approve the device in a web controller, and the machines can reach each other directly wherever they physically are. For anyone comparing options in our private networking category, the distinction that matters is this: ZeroTier is a true layer-2 network. Its VL1 layer handles encrypted peer-to-peer transport and NAT traversal, and VL2 emulates Ethernet on top, so broadcast and multicast actually work. LAN games, discovery protocols, and legacy software that expects a flat local segment behave the way they would in a single office. WireGuard-based overlays, including Tailscale, are layer-3 routed networks and do not give you that.

The practical consequence is that ZeroTier can connect things other overlays struggle with: industrial controllers, NAS boxes, home lab VMs, a Raspberry Pi behind carrier-grade NAT, and a laptop on hotel Wi-Fi. Clients cover Windows 10/11, macOS, Linux, iOS, Android, Docker, and MikroTik at the first support tier, with FreeBSD, OpenWRT, Ubiquiti, OPNsense, and Teltonika behind them. The agent claims under 16 MB of memory, which we find plausible given how little chatter these meshes produce once peers are connected.

Devices discover each other through ZeroTier's root servers — the documentation says there are currently four. When two peers cannot punch a direct path, traffic falls back to relaying, which the docs themselves call free but slow. Since version 1.16 the project has also shipped network-specific relays in preview, and the pricing page lists paid Premium Relays as coming soon. This architecture is the honest core of the trust conversation: when a direct path exists, traffic never touches ZeroTier's infrastructure and the company says it cannot observe or modify packets. When it does not, encrypted frames transit ZeroTier's relays. End-to-end encryption is constant either way, but so is a dependency on the vendor's root servers for discovery and coordination.

One more structural note, because it has changed recently: self-hosting the network controller used to be a headline benefit. Through version 1.14 the code was under the Business Source License 1.1, and the controller shipped in default builds. Version 1.16.0 (August 2025) split the licensing — the client core moved to the Mozilla Public License, while the controller moved to a source-available non-commercial licence and was dropped from default binaries. Today a for-profit company that wants a self-hosted or air-gapped controller is buying Enterprise. Hobbyists running a private controller are on much firmer ground, though the popular third-party ztnet web UI sits in a licensing grey zone for commercial use that ZeroTier has not clarified.

Pricing: what you really pay

ZeroTier's current price list took effect on 4 August 2026: US dollars, billed monthly, no published annual option, charges per device rather than per seat. The free plan is called Personal, and it is narrower than many people remember. It covers 10 devices on a single network with one admin, for personal non-commercial use only, with CLI, UI and webhooks but no API, no local DNS, no access controls, and no audit logs. (Old-timers will recall 25 nodes and unlimited networks as recently as 2023; the tier has been shrinking since.)

Essential runs $18 per month and includes 10 devices, then $2.00 per additional device, with 10 networks, five admins, API access, OIDC single sign-on and 30-day audit logs. Scale is $179 per month for 100 devices, then $1.80 each, adding unlimited networks, custom flow rules, and ticketed support with an SLA. Enterprise is quoted for 500-plus devices or compliance and self-hosting requirements, and the separate ZeroTier Quantum product prices per deployment. A 14-day Essential trial appears in the Central plan picker even though the marketing site is quiet about it.

What that math looks like in practice: a 25-device Essential fleet costs about $48 per month ($18 plus 15 devices at $2.00), 90 devices lands near $178 — almost the price of Scale — and 150 devices on Scale runs about $269 ($179 plus 50 at $1.80). Above roughly 90 devices, Scale is both the bigger and the cheaper plan. Registered charities and educational organisations can negotiate up to 50 percent off. Subscriptions invoice in advance, auto-renew, and are non-refundable except at the company's discretion, with cancellation required at least three days before the next term. If you stop paying, existing devices keep talking but configuration locks. In our view, anyone beyond the free tier should use the trial first and treat the monthly commitment as real money.

Performance & infrastructure

There are no servers for us to provision here, so we won't pretend our usual benchmark methodology applies. What we can assess is the design. Direct peer-to-peer paths mean latency between two nearby devices is essentially the physical route between them — there is no gateway VM in the middle to add overhead. That is the performance argument for this category in general, and ZeroTier's layer-2 approach adds one more advantage: the 6PLANE IPv6 mode delegates a routable /80 to every host and uses NDP emulation to skip multicast entirely, which keeps connection setup fast and lets a single node front a whole subnet of containers or VMs. RFC 4193 unique-local addressing and public IPv6 delegation are supported as well, so IPv6 deployments are well covered.

The weak spot is the fallback. Relayed connections lose the peer-to-peer advantage, and free relays are explicitly described as slow. Deployments that expect a meaningful share of relayed traffic — mobile clients on restrictive networks, for instance — should benchmark their own paths before committing. On the security side, the protocol documentation is admirably blunt: keys are Curve25519/Ed25519, packets use 256-bit Salsa20 with Poly1305 authentication, and as of today the project does not implement forward secrecy. A stolen long-term device key could in principle decrypt previously recorded traffic from that device. WireGuard-based rivals do provide forward secrecy, and this is the single biggest technical caveat in the product. Version 1.16 added an optional encrypted HELLO to reduce handshake metadata, and 1.16.1 turned metrics collection off by default. On compliance, ZeroTier states it is SOC 2 Type II certified and lists FIPS 140-3 certificate #5424 on its pricing page.

Where it falls short

The free tier is the first complaint we hear, and it is legitimate. Ten devices on one network, non-commercial only, with a single admin, is enough for a home lab but leaves no room to grow — a second network or any business use means paying from $18 per month. Second, the licence trajectory of the controller has removed the old "self-host everything for free" story exactly as the hosted plans tightened. Third, the missing forward secrecy is a genuine cryptographic gap against WireGuard-based alternatives. Fourth, the commercial terms are strict: non-refundable subscriptions, three-day cancellation notice, and configuration lockout if you lapse. Finally, the hosted controller necessarily knows your networks, members and addresses, and the privacy policy retains usage data without fixed periods — fine for many teams, disqualifying for some.

Who should pick this

We'd pick ZeroTier when a real LAN matters: LAN games, discovery protocols, bridging industrial or legacy gear, or a fleet with many devices and few human users. It is also our pick in private networking for homelabs under 10 devices, where the free Personal plan still does honest work. We'd steer elsewhere when people are the unit of scale and you want identity-based access on the free tier — that is Tailscale's shape — or when you want two or three static server-to-server tunnels and nothing else, where plain WireGuard is simpler and its crypto is stronger. Teams that must own their control plane commercially should price Enterprise before falling in love with the architecture.

Key takeaways

• True layer-2 virtual Ethernet — broadcast, multicast and flat-LAN software work, which WireGuard-based overlays do not provide.
• Free Personal plan is now 10 devices, one network, one admin, non-commercial only; paid plans start at $18/month (Essential) with per-device overage at $2.00.
• Scale at $179/month beats Essential on price above roughly 90 devices; billing is monthly-only and non-refundable.
• IPv6 is well supported (RFC 4193, 6PLANE with /80 delegation, public prefix routing) — our earlier no-IPv6 note was wrong.
• Crypto lacks forward secrecy (Salsa20/Poly1305), and since v1.16 a commercial self-hosted controller requires Enterprise.
• Best fit: homelabs, LAN-dependent software, and device-heavy, user-light fleets; look at Tailscale or plain WireGuard for people-centric or point-to-point needs.

Sources

• https://zerotier.com/pricing
• https://zerotier.com/about/
• https://en.wikipedia.org/wiki/ZeroTier
• https://theproofdesk.com/zerotier-review
• https://docs.zerotier.com/docker-6plane
• https://docs.zerotier.com/exitnode