A network fabric, not an anonymity VPN - and the honest category match for it is 'Hamachi successor with an enterprise SDN conscience'. ZeroTier connects YOUR devices into flat virtual Layer 2 (or routed Layer 3) networks with end-to-end encryption, works behind CGNAT, and its free Personal tier still costs nothing. The trust questions are the same shape as Tailscale's, answered differently: the four planetary root servers are run by ZeroTier Inc. and see peer identities and IP metadata (payload is end-to-end encrypted and roots only relay ciphertext), the hosted controller is closed, and the 2021 Pulse Security research showed root-server trust is real attack surface - responsibly fixed, but instructive. The 2025 story is commercial: a new CEO, a $13.5M Series A, a free tier cut to 10 devices/1 network, Essential jumped to $18/month with $2 per extra device, and the controller code moved into a 'nonfree' source-available directory with commercial-use restrictions. The homelab community that built ZeroTier's reputation is visibly migrating to Tailscale, NetBird and Nebula; the technology (true L2 bridging, non-IP traffic, moons) remains genuinely differentiated. The full Trail of Bits code audit promised 'after 2.0' never appeared - ZeroTier 2.0 itself is still effectively vapor in the mainline product.
auditopen source4 red flagsfacts verified - operator pages (pricing + machine-readable pricing.md, platform, about, Terms of Service, privacy policy, docs security/protocol/controller pages, GitHub README plus all three license files, status.zerotier.com), Wikipedia, Pulse2 press, the Trail of Bits audit PDF, the Pulse Security 2021 advisory, an academic mesh-VPN performance thesis PDF, VPNSmith and OpenSourceForU editorial, and the arctic-shift + HN Algolia community archives were all fetched live by this site on 2026-11-03; arctic-shift body-search on r/selfhosted and r/VPN returned 422 and 429 (the known rate-limit failure mode), so community voices come from r/zerotier thread fetches and HN Algolia instead; businesswire.com returned 403 and the Series A facts are cited from Pulse2 and Wikipedia
September 2021 Pulse Security disclosure: root servers accepted unverified public keys and silently overwrote existing identities, and clients implicitly trusted WHOIS-learned identities - chained into certificate harvesting and packet injection into private networks. Root fix landed within one day of the report, collision detection and client 1.6.6 followed within days; the researcher estimated a funded attacker could enumerate the full 40-bit address space in about a year with roughly NZD 500k of GPUs
Post-investment pricing squeeze: $13.5M Series A and new CEO Andrew Gault (July 2024) were followed by successive price increases the community read as investor-driven ('enshittification of yet another service', November 2025 r/zerotier)
License churn: the repository now splits MPL-2.0 agent code from a nonfree source-available controller (2025 license text), narrowing what 'open source' means here without a clean public migration story on the fetched pages
+1 more red flags - expand before signing up
Legacy Central outages reported in October 2026 by r/zerotier users ('devices are going down very often') during the forced migration to the new Central platform
Review
draft generated by Qwen3, fact-checked by the vpncomparison editorial desk · review version 3 · prose updated 2026-11-03 · facts as of 2026-11-03 · how we verify
Honesty note: we have not run our own tests on ZeroTier yet (leak tests, speed, kill switch). Everything on this page is source-based meta-research with dated links. When we test it, results appear here and on the change log.
Overview
ZeroTier homepage - live capture 2026-09-29
ZeroTier is a self-hostable peer-to-peer virtual network fabric, not a consumer anonymity VPN. It creates flat Layer 2 or routed Layer 3 networks across your devices using end-to-end encryption, ideal for LAN gaming, homelab access behind CGNAT, or bridging non-IP traffic. Run by ZeroTier, Inc. in the U.S. (a Five Eyes country), it relies on four hosted root servers and a closed-source network controller. The free tier remains usable for small personal setups, but trust is centralized in the operator.
Logging & privacy
ZeroTier claims it collects minimal metadata - IP addresses of network members and admin access logs - but cannot see payload content due to end-to-end encryption. This claim is policy-only, with no independent audit or court test verifying it. The 2020 Trail of Bits audit reviewed only the cryptographic design, not actual logging practices. The 2021 Pulse Security disclosure revealed root servers could be exploited to overwrite identities and inject traffic, confirming the root layer as a real attack surface. No warrant canary exists, and while SOC 2 Type II is claimed, the report is gated. You must trust ZeroTier Inc. with peer metadata.
Pricing & the renewal trap
ZeroTier pricing page - live capture 2026-09-29
Pricing starts at $18/month for the Essential plan (10 devices, then $2.00 per extra device), with no introductory discount. The renewal rate is identical at $18/month, making the renewal ratio 1 - no hidden jump, but also no savings for long-term commitment. There is no refund window (0 days), and all payments are non-refundable per the ToS. The free Personal tier allows 10 devices and 1 network for non-commercial use. The derived three-year cash total is not computable due to lack of multi-year billing, but monthly payments continue indefinitely.
Features & performance
ZeroTier apps / download page - live capture 2026-09-29
ZeroTier uses its proprietary VL1/VL2 protocol with Curve25519, Ed25519, and Salsa20/Poly1305, offering true Layer 2 bridging, multicast, and broadcast - rare in mesh VPNs. It supports split tunneling and works on Windows, Mac, Linux, Android, iOS, and routers. No kill switch, multihop, or obfuscation is available. P2P is core to its design, with fallback relaying. Server and country counts are irrelevant - it’s a peer-to-peer system. Streaming geo-unblocking is not supported. No performance tests have been run by this site; real-world reliability reports vary, with some users citing instability on cellular networks or during Central migrations.
Ownership & track record
ZeroTier, Inc. is based in San Francisco, with no parent company disclosed. Founded in 2013 by Adam Ierymenko, it transitioned to CEO Andrew Gault after a $13.5M Series A in 2024. The 2025 pricing overhaul - cutting the free tier and raising costs - sparked community backlash, with users migrating to Tailscale, NetBird, and Nebula. Red flags include the 2021 root-server vulnerability, license changes moving the controller to non-commercial source-available terms, and ongoing outages during the Central platform migration. Despite technical respect, trust erosion is evident in community sentiment.
Censorship resistance
ZeroTier offers no obfuscation features. Its protocol does not disguise traffic, making it easily detectable and blockable on censored networks like those in China, Iran, or Russia. The lack of obfuscation means this tool is NOT for bypassing state-level firewalls. Users in restrictive regions should consider tools with proven obfuscation like Shadowsocks, Outline, or commercial providers with obfuscated servers.
Verdict
Use ZeroTier if you need true Layer 2 networking for LAN gaming, homelab access, or bridging legacy protocols - not for anonymity or streaming. The free tier still works for small setups, but the 2025 changes have damaged trust. You're betting on U.S.-based ZeroTier, Inc. staying online and honest. There’s no evidence this provider pays review sites, but its business model now leans heavily on enterprise customers, not the open-source community that built its reputation.
++ What holds up
Free Personal tier (10 users, 10 devices, 1 network) - verified live 2026-11-03, though nerfed from the historical 25-node free tier per community reports
True Layer 2 emulation: broadcast, multicast, LAN discovery, Ethernet bridging and non-IP traffic that WireGuard-based meshes cannot carry natively (protocol docs + VPNSmith)
End-to-end encryption with keys that never leave devices; roots only relay ciphertext (operator security docs + founder statement on HN)
Self-hostable controller and user-defined 'moon' root servers reduce dependency on ZeroTier Inc. infrastructure (operator docs)
Two independent security research engagements engaged with and fixed: Trail of Bits crypto design review (2020, public summary) and Pulse Security root-identity research (2021, patched in 1.6.6 within days)
FIPS 140-3 validated variant and SOC 2 Type II for the enterprise path; post-quantum Quantum platform for CNSA 2.0 mandates
-- What to watch
The November 2025 pricing restructure cut the free tier to 10 devices/1 network and raised Essential to $18/month plus $2 per extra device - r/zerotier documented a >250 percent increase for legacy customers and a visible exodus to Tailscale, NetBird and Nebula
The four planetary root servers are operated by ZeroTier Inc. in a Five Eyes jurisdiction and see member identities and IP metadata; the hosted Central controller is closed source
Controller code now sits in a 'nonfree' directory under a source-available license that forbids commercial use without a paid license - the self-host path is narrower than it was under the old open-source positioning
No forward secrecy in the standard VL1 protocol (documented in the operator's own protocol page); VPNSmith notes the proprietary transport has not received the breadth of independent audit and benchmarking that WireGuard has
No public SOC 2 report (trust-center gated); the promised full Trail of Bits code audit never materialized
ToS: all payments non-refundable, mandatory individual arbitration and class-action waiver, and 28 days of nonpayment leads to subscription deactivation and permanent deletion of network records
Pricing reality check
Intro price
$18 /mo · renews $18/mo
Renewal price
$18/mo
Notes
Live pricing page and pricing.md (effective 20 October 2026): Personal free (10 users, 10 devices, 1 network, 1 admin, personal non-commercial use only); Essential $18/month (10 devices included, then $2.00 per additional device per month, 10 networks, 5 admins, 30-day audit logs); Scale $179/month (100 devices included, then $1.80 each, unlimited networks, 10 admins); Enterprise and Quantum custom quotes (self-hosted and air-gapped deployment, FIPS 140-3 certificate #5424, 90-day audit logs). Prices in USD, billed monthly via Stripe per the ToS.
email only for the hosted controller service; no government-ID verification
Payment
fiat
Apps
windows, mac, linux, android, ios, router
Check the renewal price above before any multi-year plan - true-cost calculator.
Is ZeroTier legit?
Legal domicile: United States - ZeroTier, Inc., 548 Market St, San Francisco, CA (privacy policy); a Five Eyes member country; ZeroTier Europe B.V. in Utrecht acts as GDPR representative. Logging claim: We collect minimal metadata about active networks and devices; ZeroTier routes traffic directly between peers, so our infrastructure cannot observe or modify packets on user networks; no additional data or telemetry leaves a device without explicit opt-in - evidence class: promise only (no proof). No incidents on file in our research - absence of evidence is not proof of innocence. Facts verified - operator pages (pricing + machine-readable pricing.md, platform, about, Terms of Service, privacy policy, docs security/protocol/controller pages, GitHub README plus all three license files, status.zerotier.com), Wikipedia, Pulse2 press, the Trail of Bits audit PDF, the Pulse Security 2021 advisory, an academic mesh-VPN performance thesis PDF, VPNSmith and OpenSourceForU editorial, and the arctic-shift + HN Algolia community archives were all fetched live by this site on 2026-11-03; arctic-shift body-search on r/selfhosted and r/VPN returned 422 and 429 (the known rate-limit failure mode), so community voices come from r/zerotier thread fetches and HN Algolia instead; businesswire.com returned 403 and the Series A facts are cited from Pulse2 and Wikipedia (not fully verified) as of 2026-11-03 - read the sources below.
The money trail - what review sites earn by recommending this
affiliate status not verified yet
If we sign up for this program, every link here becomes rel="nofollow sponsored" and routes through /go/. Until then our links point straight to the provider's website with zero tracking. Ranking logic physically cannot read affiliate fields - here is the proof.
On the website
Captured by our screenshot bot from the live site (or its public archive). A capture is evidence of what the page showed at capture time - not an endorsement.
ZeroTier homepage - live capture 2026-09-29ZeroTier pricing page - live capture 2026-09-29ZeroTier apps / download page - live capture 2026-09-29
Before you pay: check the renewal price, the refund window, and whether a cheaper or free path covers your use case - the honest checklist.
Based on our checks as of 2026-11-03: ZeroTier scores 4.1/10 in our weighted review. We logged 4 red flags (listed above). User reports, ownership and the incident record are documented with dated sources in the meta-review below.
What do I actually get with the free plan?
The Personal tier includes 10 devices, 1 network, 1 admin, and non-commercial use only. No API access, FIPS, or additional features. Designed for small personal setups, not large deployments.
What is the renewal price and total cost over three years?
The monthly rate is $18 with a renewal ratio of 1 - no price jump, but no discount either. The three-year cash total cannot be computed as only monthly billing is offered, with no multi-year option.
What evidence supports the no-logs claim?
None beyond policy. The claim is unverified by audit or court test. The 2020 Trail of Bits review covered crypto design, not logging. What ZeroTier can see - peer IPs, admin logs - is not independently audited.
Can I use this in a heavily censored country like China or Iran?
No. ZeroTier has no obfuscation and uses a proprietary protocol that’s easily detectable. It will likely be blocked on state-level firewalls. Use tools with obfuscation instead.
Can I pay anonymously?
No cryptocurrency options exist. You can sign up with just an email, but payments go through Stripe, which requires identity verification. True anonymous payment isn’t supported.
What happens if ZeroTier shuts down?
The network depends on its four root servers and hosted controller. If they go offline, peer discovery fails. You can self-host a controller ("moon"), but the default setup creates dependency on ZeroTier, Inc.
What’s an honest free or cheap alternative?
For self-hosted mesh networks, consider Nebula (fully open source, no central dependency) or Tailscale with Headscale. For simple WireGuard setups, Algo or PiVPN on a $5 VPS offer more control and lower cost.
The meta-review: what the internet says about ZeroTier
We do not expect you to trust us. This review is a meta-review: below you see what other review sites claim - with their conflicts of interest labeled - what users report on Reddit and forums, and who actually operates ZeroTier. Every claim links to its source so you can verify it yourself.
What other reviewers say (2)
Every source carries a conflict label from our review-site database. "Affiliate-funded" means the site earns money if you buy what it recommends. We include critical voices deliberately.
Fetched 2026-11-03: independent editorial with disclosed affiliate links (Contabo VPS funnel). Honest scoping: ZeroTier emulates a Layer 2 LAN with a proprietary transport; Tailscale is Layer 3 on WireGuard; 'the proprietary protocol has not received the same breadth of independent audit and public benchmarking that WireGuard has'; notes the free Personal plan at 10 devices non-commercial, Essential $18/month; verdict - ZeroTier for flat LANs/LAN gaming, Tailscale for routed meshes, self-host the control plane (ZeroTier controller with ztncui, or Headscale) for sovereignty.
Fetched 2026-11-03: Open Source For You explainer describing ZeroTier as a global Ethernet switch where subscribers connect to an imaginary switch and communicate as if on the same local network, including its use as a network bridge - a period review of the technology before the enterprise pivot.
What users say (6)
Reddit, forums, HN - paraphrased and linked, never quoted out of context. Anecdotes, not proof - but refund complaints and leak reports are the best early-warning system this market has.
Fetched 2026-11-03 (25 comments): texture of the subreddit in late 2026 - admin-visibility questions answered correctly ('no he cannot'), Legacy Central outages with devices going down often, Windows 11 apt-repository install breakage, Minecraft/LAN gaming help threads working out well, account-migration bugs after linking Microsoft/Google SSO to legacy accounts.
Fetched 2026-11-03: the November 2025 pricing backlash thread - >250 percent increase quotes, free plan nerfed to 10 devices, CEO Andrew Gault responding in-thread to a 600-endpoint customer, cancellations and migrations to Tailscale (OPNsense package), NetBird and Nebula, 'enshittification' framing, recognition that L2 bridging remains genuinely differentiated.
Fetched 2026-11-03: 111 story hits including the 2021 Pulse Security vulnerability disclosure thread (135 points), the 2014 launch thread (107 points), ZeroTier 2.0 Status (2019), the 2022 SSO/new-pricing announcement thread (62 comments), and 'ZeroTier - home VPN without a public IP address' (2025).
Fetched 2026-11-03: returned HTTP 422 - the known arctic-shift body-search failure mode on large subreddits; a follow-up body search on r/VPN returned HTTP 429 (rate limited). Community voices for this dossier therefore come from r/zerotier thread fetches and HN Algolia instead of r/selfhosted body matches.
AI fact summary - everything we know, compressed
Generated by Qwen3 on 2026-11-03 from our fact database plus the linked sources. It summarizes - it does not add facts. Check anything that matters against the linked sources.
Bottom line: ZeroTier is not a consumer VPN for anonymity or streaming. It’s a virtual Layer 2 network fabric that connects devices into a private LAN over the internet with end-to-end encryption. The free tier remains usable for small personal setups, but trust erosion from pricing changes and closed-source components has driven many users to alternatives.
The logging truth: The company claims minimal metadata logging - IP addresses of network members and admin access logs - but this is policy-only, not independently verified. The U.S. jurisdiction (Five Eyes) applies, and while traffic payloads are end-to-end encrypted and invisible to ZeroTier’s infrastructure, the four planetary root servers and hosted controller can observe peer identities and connection metadata. No court-ordered disclosures or logging contradictions are documented.
Pricing reality: Pricing starts at $18/month for the Essential plan (10 devices), with no introductory discount and no refunds. The free Personal tier was cut in 2025 to 10 devices and 1 network, triggering widespread backlash. Renewal is at the same rate, but the shift from prior pricing represented a >250% increase for some legacy users, and additional devices cost $2 each, creating a long-term cost trap.
What reviewers say vs what users say: Reviewers like VPNSmith acknowledge ZeroTier’s technical strengths in Layer 2 emulation and LAN gaming but note its proprietary protocol lacks WireGuard’s audit breadth. Users, especially on r/zerotier, report instability during the 2026 Central migration, frequent device dropouts, and frustration over the post-Series A commercialization. The conflict is clear: technical respect persists, but user sentiment has soured, with many migrating to Tailscale, Nebula, or NetBird.
Who runs it: ZeroTier, Inc., founded in 2013 by Adam Ierymenko, is now led by CEO Andrew Gault (ex-Gaikai, Oculus investor) after a $13.5M Series A in 2024. Ierymenko remains CTO. The shift from open ethos to investor-driven pricing and source-available (non-open) controller code under California jurisdiction signals a clear enterprise pivot, reducing sovereignty for self-hosted users.
Sources & how this review was built
Every external source used on this page, with the date we fetched it and its evidence class [A]-[D] (A = primary/operator, B = serious press/research, C = community, D = our own measurements). Methodology: how we verify. Sources disappear or change - if a link is dead, tell us via contact.
Evidence classes on this page:[A] A: 15[B] B: 8[C] C: 6[D] D: 0(D stays empty until our own test phase)
The most credible self-hosting on-ramp in the VPN space, built by and for people inside the censorship: the app is free and open source, you connect it to your…
auditedopen source
intro $5 /mo
Cyprus (EUPHORIATECH LIMITED, Nicosia, reg HE 484287 per site footer, verified 2026-11-02; IP rights in Portugal with Amnezia LDA, ops in Estonia) - for self-hosted users the operative jurisdiction is wherever their own VPS is hostedself-hosted vpn 11 d ago
The gold standard for connecting your OWN devices, and a poor substitute for a consumer VPN - which is exactly what it says on the tin. Tailscale is a…
auditopen source
intro $8 /user/mo
Canada - Tailscale Inc., Toronto, Ontario (Wikipedia, Bloomberg); a Five Eyes member country; privacy policy names processing locations in Canada, Germany, the US and the UKself-hosted vpn 11 d ago
The incumbent of self-hosted business VPNs, and still a safe pick in 2026 - with one honest fork in the road. Access Server is the polished, supported way to…
auditopen source
intro $7 /mo
United States - OpenVPN Inc., Pleasanton, California (about page fetched 2026-11-03); a Five Eyes member countryself-hosted vpn 9 d ago
No comments yet - be the first. Posting runs a short proof-of-work in your browser (anti-spam), no account needed.