Self-hosted WireGuard on a cheap VPS vs ZeroTier: which wins in 2026?
Head-to-head on the facts that decide the purchase: real prices in the provider's own unit, minimum, KYC, proof, payment and terms - every number sourced in the linked reviews.
Not a VPN service - the protocol every commercial VPN wants to be built on, and the most evidence-backed tunnel protocol in existence. You are the provider: generate keys, run wg-quick on a 5-dollar VPS or a Raspberry Pi, and there is no company to subpoena, no privacy policy to believe, and no logs unless you write them yourself. The receipts are unusual even by open-source standards: roughly 4,000 lines of code against 600,000 for OpenVPN+OpenSSL, four independent formal/security analyses (Tamarin symbolic proof, eCK computational proof, INRIA's CryptoVerif proof of the entire protocol including data transport, and the ProVerif Noise-IK model), machine-verified Curve25519 code, a clean third-party audit before 1.0, and mainline Linux kernel status since 5.6 (January 2020 merge, March 2020 release). The trade-offs are structural, not incidental: UDP only with a fingerprintable handshake (Russia began blocking OpenVPN/WireGuard connections in 2024; AmneziaWG exists precisely for this), key management is entirely yours, per-process split tunneling is clumsy enough that HN users call it a huge usability issue, and the Windows client lives at the mercy of Microsoft's driver signing (an April 2026 signing termination forced an emergency release). It will also never anonymize you from your own VPS provider or home ISP - a self-hosted exit IP is just your own identity in a new place.
A network fabric, not an anonymity VPN - and the honest category match for it is 'Hamachi successor with an enterprise SDN conscience'. ZeroTier connects YOUR devices into flat virtual Layer 2 (or routed Layer 3) networks with end-to-end encryption, works behind CGNAT, and its free Personal tier still costs nothing. The trust questions are the same shape as Tailscale's, answered differently: the four planetary root servers are run by ZeroTier Inc. and see peer identities and IP metadata (payload is end-to-end encrypted and roots only relay ciphertext), the hosted controller is closed, and the 2021 Pulse Security research showed root-server trust is real attack surface - responsibly fixed, but instructive. The 2025 story is commercial: a new CEO, a $13.5M Series A, a free tier cut to 10 devices/1 network, Essential jumped to $18/month with $2 per extra device, and the controller code moved into a 'nonfree' source-available directory with commercial-use restrictions. The homelab community that built ZeroTier's reputation is visibly migrating to Tailscale, NetBird and Nebula; the technology (true L2 bridging, non-IP traffic, moons) remains genuinely differentiated. The full Trail of Bits code audit promised 'after 2.0' never appeared - ZeroTier 2.0 itself is still effectively vapor in the mainline product.
Short answer: too close to call (4/10 and 4.1/10). The deciding factor is your priority: Self-hosted WireGuard on a cheap VPS for censorship resistance, ZeroTier for honest value. Facts checked 2026-11-03.
The facts
 Self-hosted WireGuard on a cheap VPS | ZeroTier | |
|---|---|---|
| Overall score (0-10) | 4 | 4.1 |
| Privacy & proof | ||
| Logging claim | none by design - WireGuard is stateless and logs nothing; the only logging that exists… | We collect minimal metadata about active networks and devices; ZeroTier routes traffic… |
| Logging evidence | no logging claim at all | promise only (no proof) |
| Audits | Benjamin Dowling and Kenneth G. Paterson (Royal Holloway, Un… moreBenjamin Dowling and Kenneth G. Paterson (Royal Holloway, University of London) 2018, Kevin Milner and Jason A. Donenfeld (Tamarin prover) 2018, Benjamin Lipp, Bruno Blanchet, Karthikeyan Bhargavan (INRIA) 2019, Nadim Kobeissi and Karthikeyan Bhargavan (Noise Explorer, ProVerif) 2018, HACL* and Fiat-Crypto projects 2019 | Trail of Bits 2020, Pulse Security (Denis Andzakovic) 2021 |
| Jurisdiction | none - a protocol and codebase with no servers, no accounts… morenone - a protocol and codebase with no servers, no accounts and no operator entity to subpoena; copyright and the WireGuard trademark are held by Jason A. Donenfeld (wireguard.com footer, fetched 2026-11-03) | United States - ZeroTier, Inc., 548 Market St, San Francisco… moreUnited States - ZeroTier, Inc., 548 Market St, San Francisco, CA (privacy policy); a Five Eyes member country; ZeroTier Europe B.V. in Utrecht acts as GDPR representative |
| Owner | unknown | unknown |
| Money | ||
| Intro price | $5 /mo | $18 /mo |
| Renewal price | not published | $18/mo |
| Anonymous payment | unknown | fiat |
| Account | ||
| Personal info | none | email only for the hosted controller service; no government-ID verification |
| Kind | Self-hosted | Self-hosted |
| Facts checked | 2026-11-03 | 2026-11-03 |
Score breakdown
Self-hosted WireGuard on a cheap VPS leads on security (+1.5), censorship resistance (+5) · ZeroTier leads on privacy & logging (+2), honest value (+4.5).
Self-hosted WireGuard on a cheap VPS at a glance
++ What holds up
- Formally verified four independent ways - Tamarin symbolic proof, eCK computational proof, INRIA CryptoVerif proof of the full protocol incl. transport data messages, ProVerif Noise-IK model (operator formal-verification page, IACR ePrint, Noise Explorer - all fetched 2026-11-03)
- About 4,000 lines of code vs 600,000 for OpenVPN+OpenSSL - attack surface an individual can actually review (Ars Technica 2018, fetched live)
- In the Linux kernel mainline since 5.6 (merged Jan 2020, shipped Mar 2020) - first-party kernel module, no DKMS rebuilds (Ars Technica 2020)
- Stateless: no logs exist unless the operator configures them; no provider means no subpoena target and no policy to doubt (operator protocol docs)
- Runs on anything: official packages for Windows/macOS/iOS/Android/BSDs/OpenWRT plus a Go userspace implementation; HN users run peers on 128 MB-RAM VPSes (install page + HN voices fetched 2026-11-03)
- Instant handshakes: about 100 ms connect vs 8+ seconds for OpenVPN in Ars Technica's testing (2018 review)
- Linus Torvalds on the code: compared to OpenVPN and IPsec, 'it's a work of art' (LKML, quoted in the fetched Ars review)
-- What to watch
- UDP only and trivially identifiable - no obfuscation in the core; Russia began blocking OpenVPN/WireGuard connections in January 2024 (439-pt HN thread) and AmneziaWG is a whole fork built to patch this
- Key management is all yours: generation, rotation, distribution and per-peer AllowedIPs hygiene, with no dashboard in wg-quick
- Scoping a VPN to a subprocess is clumsy - HN: 'Wireguard has huge usability issues due to that'; workarounds like wireproxy exist (HN, Oct 2026)
- Windows distribution depends on Microsoft code signing - in April 2026 Microsoft terminated the signing account and WireGuard shipped an emergency release (HN thread 47719942)
- Port quality varies outside Linux: kernel-mode support was pulled from FreeBSD 13.0 in 2021 before being reintroduced via pfSense packages (Wikipedia, fetched 2026-11-03)
- No geo-unblocking value: your exit IP is your own VPS/home IP, so no streaming catalog changes, no shared clean IPs
ZeroTier at a glance
++ What holds up
- Free Personal tier (10 users, 10 devices, 1 network) - verified live 2026-11-03, though nerfed from the historical 25-node free tier per community reports
- True Layer 2 emulation: broadcast, multicast, LAN discovery, Ethernet bridging and non-IP traffic that WireGuard-based meshes cannot carry natively (protocol docs + VPNSmith)
- End-to-end encryption with keys that never leave devices; roots only relay ciphertext (operator security docs + founder statement on HN)
- Self-hostable controller and user-defined 'moon' root servers reduce dependency on ZeroTier Inc. infrastructure (operator docs)
- Two independent security research engagements engaged with and fixed: Trail of Bits crypto design review (2020, public summary) and Pulse Security root-identity research (2021, patched in 1.6.6 within days)
- FIPS 140-3 validated variant and SOC 2 Type II for the enterprise path; post-quantum Quantum platform for CNSA 2.0 mandates
-- What to watch
- The November 2025 pricing restructure cut the free tier to 10 devices/1 network and raised Essential to $18/month plus $2 per extra device - r/zerotier documented a >250 percent increase for legacy customers and a visible exodus to Tailscale, NetBird and Nebula
- The four planetary root servers are operated by ZeroTier Inc. in a Five Eyes jurisdiction and see member identities and IP metadata; the hosted Central controller is closed source
- Controller code now sits in a 'nonfree' directory under a source-available license that forbids commercial use without a paid license - the self-host path is narrower than it was under the old open-source positioning
- No forward secrecy in the standard VL1 protocol (documented in the operator's own protocol page); VPNSmith notes the proprietary transport has not received the breadth of independent audit and benchmarking that WireGuard has
- No public SOC 2 report (trust-center gated); the promised full Trail of Bits code audit never materialized
- ToS: all payments non-refundable, mandatory individual arbitration and class-action waiver, and 28 days of nonpayment leads to subscription deactivation and permanent deletion of network records
FAQ
Which is cheaper, Self-hosted WireGuard on a cheap VPS or ZeroTier?
Self-hosted WireGuard on a cheap VPS is cheaper at $5 /mo versus $18 /mo.
Which has better logging evidence, Self-hosted WireGuard on a cheap VPS or ZeroTier?
ZeroTier has the stronger logging evidence; Self-hosted WireGuard on a cheap VPS makes no no-logs claim at all.
Which renewal price is honest, Self-hosted WireGuard on a cheap VPS or ZeroTier?
ZeroTier documents renewal at $18/mo; Self-hosted WireGuard on a cheap VPS is free - no renewal price exists.
Which needs less KYC, Self-hosted WireGuard on a cheap VPS or ZeroTier?
At least one provider does not document its KYC policy - treat it as unknown, not as "no KYC".
Which has the longer track record?
ZeroTier has the longer track record (since 2013).
Scores and facts: meta-reviews with dated sources - Self-hosted WireGuard on a cheap VPS · ZeroTier. Method: how we verify. More: all providers compared · all head-to-heads.