ZeroTier Review 2026: 10 Free Devices, $18 Essential and a Non-Commercial Controller

What ZeroTier actually is

ZeroTier is a peer-to-peer virtual network. You install a small agent on each device, join it to a 16-character network ID, approve it in a web controller, and the devices can then reach each other as if they sat on the same switch, wherever they really are.

The protocol has two layers. VL1 is the encrypted peer-to-peer transport that finds a direct path between devices through NAT. VL2 sits on top and emulates Ethernet, which ZeroTier itself describes as somewhat similar to VXLAN. That makes it a true layer-2 network: broadcast and multicast traffic work, so LAN games, device discovery and old software that expects a flat local network behave the way they would at home. Tailscale, its best-known rival, is a layer-3 WireGuard network and does not do this.

Devices find each other through ZeroTier's root servers (the docs say there are currently four). When two devices cannot connect directly, traffic falls back to what the docs call free (but slow) relaying. Network-specific relays arrived as a preview in version 1.16, and paid Premium Relays are listed on the pricing page as Coming Soon.

• Tier 1 platforms: Windows 10/11, macOS, Linux, iOS, Android, Docker and MikroTik.
• Tier 2: FreeBSD, OpenWRT, Ubiquiti, OPNsense and Teltonika.
• Tier 3 (deprecated or community): QNAP, Synology (Docker only), ASUSTOR, WD, FreeNAS, Windows 7 and Server 2008/2012. ZeroTier says its native NAS packages are deprecated and no longer maintained.
• Supported client branches are 1.16.x, 1.14.x and 1.12.x. The latest release is 1.16.2 (May 2026), and there is no 2.x client.
• ZeroTier says the agent uses less than 16 MB of memory.

ZeroTier pricing in October 2026

ZeroTier's current price list took effect on 4 August 2026. Prices are in US dollars and billed monthly. No annual plan is published. There are no per-seat charges; you pay per device above an allowance, and each plan caps how many admins you can have.

Personal - free

• Personal, non-commercial use only.
• 10 devices and one network.
• One network admin.
• CLI, UI and webhooks, with community support.
• No API, no AI agent access, and no local DNS, access control, service accounts, audit logs or Teams support.

Essential - $18 per month

• Commercial licence.
• 10 devices included, then $2.00 per device, billed monthly.
• 10 networks and five admins.
• API and AI agent access, OIDC single sign-on and 30-day audit logs.
• A 14-day trial is offered in the Central plan picker, though the marketing site does not mention it.

Scale - $179 per month

• Commercial licence.
• 100 devices included, then $1.80 per device, billed monthly.
• Unlimited networks and 10 network admins.
• Custom flow rules and ticketed support with an SLA.

Enterprise and Quantum - custom

Enterprise is quoted for companies with 500 or more devices, compliance requirements or self-hosted deployments. It adds unlimited networks and admins, self-hosted and air-gapped controllers, HSM and embedded processor support, 90-day audit logs and priority support. ZeroTier Quantum, launched at RSAC in March 2026 as an end-to-end quantum-secure platform with its own protocol, is a separate product whose pricing, in ZeroTier's words, starts with a conversation.

The free plan keeps shrinking

If you remember ZeroTier as the generous free option, that memory is out of date. Archived copies of the pricing page show how the free tier has narrowed.

• June 2023: free meant 1 admin, 25 nodes and unlimited networks.
• August 2024: free dropped to 10 devices, still with unlimited networks, alongside a new usage-based Essential plan priced at $5 a month plus $2 per authorised device. Existing free users reportedly kept their old allowances at the time.
• October 2026: free is now Personal - 10 devices, one network, one admin, and non-commercial use only. Essential starts at $18.

Ten devices on one network is still enough for a home lab, a family's laptops and phones, or remote access to a Raspberry Pi. What disappeared is the room to grow: a second network or a small business use case now means paying.

Setting up a network in New Central

Accounts and organisations created after 5 November 2025 land on New Central, which ZeroTier calls the next generation of its hosted network controller. Older accounts stay on Legacy Central at my.zerotier.com. ZeroTier has not published a date for retiring Legacy Central.

1. Create an organisation and pick a plan.
2. Create a network and copy its Network ID.
3. Install the ZeroTier agent on each device and join that Network ID.
4. Authorise each device in Central. Until you do, it cannot talk to anything on the network.

The authorisation step is the core of ZeroTier's access model on private networks: a device that knows the Network ID still needs an admin's approval. On the free plan that approval comes from your single admin, and finer access control is reserved for paid tiers.

Self-hosting after the 1.16 licence change

Self-hosting the controller used to be one of ZeroTier's selling points. It is now more complicated.

Up to version 1.14, ZeroTier One was under the Business Source License 1.1, set to convert to Apache 2.0 on 1 January 2026. It already barred running root servers or network controllers as a for-profit service and embedding the code in closed commercial apps.

Version 1.16.0, released on 21 August 2025, split the licence. The core and service moved to the Mozilla Public License, which is good news for the client. The network controller moved to a commercial source-available licence, and the default binary builds no longer contain the controller at all.

That controller licence is a Source-Available License for Non-Commercial Use. Its definition of commercial use is broad: any use by a for-profit company, a government or military body, a non-profit or a registered charity. Evaluation is limited to 30 days. In practice, a company that wants a self-hosted or air-gapped controller now buys Enterprise.

Security and what ZeroTier can see

ZeroTier's protocol documentation lists Curve25519 and Ed25519 for keys and signatures, with packets encrypted end to end using 256-bit Salsa20 and authenticated with Poly1305. The same document states plainly: as of today we do not implement forward secrecy. If a device's long-term key were ever stolen, previously recorded traffic from that device could in principle be decrypted. WireGuard-based tools such as Tailscale do provide forward secrecy.

Version 1.16 added an optional encrypted HELLO, which hides more of the handshake metadata, and 1.16.1 disabled metrics collection by default. We found no CVEs or GitHub security advisories against ZeroTier's own code for 2024 to 2026.

Access control starts with authorisation: on a private network, a device that joins is quarantined until an admin approves it, so a leaked Network ID alone does not let a stranger in.

On compliance, ZeroTier says it is SOC2 Type II certified, and its pricing page lists FIPS 140-3 Certificate #5424.

What the company sees

Because traffic goes directly between peers when a direct path exists, ZeroTier says its infrastructure cannot observe or modify packets, and that it collects minimal metadata about active networks and devices. Relayed traffic still passes through ZeroTier servers, though it stays encrypted end to end.

The privacy policy, updated 9 December 2025, names ZeroTier, Inc. in San Francisco as controller, with ZeroTier Europe B.V. in Utrecht as EU representative. It covers approximate geolocation derived from your IP address, device information including IP address and operating system, and usage data. Retention is described only as as long as required by the purpose, with no fixed periods. The hosted controller also necessarily knows your networks, members and their addresses.

Billing, cancellation and refunds

ZeroTier's terms of service are strict on money.

• Subscriptions are invoiced in advance, auto-renew and are non-refundable. Refunds are at ZeroTier's sole discretion, with none for unused time.
• Cancel through the customer portal, and confirm it at least three days before the next term starts. Access continues until the end of the paid period.
• Prices can change with 30 days' notice.
• If you stop paying, ZeroTier can lock the subscription. Existing devices keep communicating, but you cannot change configuration or add devices.
• Data from a free trial can be lost unless you buy a plan or export it.
• The terms are governed by California law.

The lock-on-non-payment rule is gentler than it sounds: your network does not go dark overnight. But overage is billed monthly per device, so adding devices to Essential raises the bill automatically.

ZeroTier vs Tailscale

The two are the default answers for a mesh network, and they solve slightly different problems. Our Tailscale review covers that product in detail; here is how they compare.

• Network type: ZeroTier is layer 2 (Ethernet, with broadcast and multicast). Tailscale is layer 3 (IP only, on WireGuard).
• Free tier: ZeroTier gives 10 devices on one network, non-commercial only. Tailscale's free plan is counted in users, covering up to 6.
• Paid pricing: ZeroTier charges per device ($18 for 10, then $2 each, or $179 for 100). Tailscale charges per user seat.
• Crypto: ZeroTier uses Salsa20/Poly1305 without forward secrecy. WireGuard provides forward secrecy.
• Self-hosting: ZeroTier's controller is non-commercial source-available, with commercial self-hosting sold as Enterprise. Tailscale's control plane is proprietary, though the community Headscale project exists.

Pick ZeroTier when you need a real LAN: games, discovery protocols, bridging industrial or legacy gear, or many devices with few people. Pick Tailscale when you have more people than devices and want identity-based access and forward secrecy.

Verdict

ZeroTier is still technically excellent at what it does uniquely: a lightweight, layer-2 network that makes scattered devices behave like one LAN. For a home lab under 10 devices it remains free and capable.

The deal around it has tightened. The free tier lost its unlimited networks and any commercial use, Essential costs $18 before overage, and a business that wants to self-host the controller now has to talk to sales. The missing forward secrecy is a real gap against WireGuard-based rivals, and non-refundable billing means you should use the 14-day Essential trial before committing.

Frequently asked questions

Is ZeroTier still free?

Yes, for personal use. The Personal plan is free for 10 devices on one network with one admin. It has no API and no access control, audit logs or local DNS.

Can I use the free ZeroTier plan for my business?

No. Personal is limited to personal, non-commercial use. Essential at $18 a month is the cheapest plan with a commercial licence.

How much does ZeroTier cost for 25 or 150 devices?

About $48 a month for 25 devices on Essential ($18 plus 15 extra devices at $2). For 150 devices, Scale costs $269 a month ($179 plus 50 extra devices at $1.80). Above roughly 90 devices, Scale is cheaper than Essential.

Does ZeroTier have a free trial or refunds?

There is a 14-day trial of Essential in the Central plan picker, but no refunds by right. Subscriptions are non-refundable, refunds are at ZeroTier's discretion, and you must cancel at least three days before renewal.

Can I self-host a ZeroTier controller?

Only for non-commercial use, unless you buy Enterprise. Since version 1.16 the controller is under a non-commercial source-available licence and is left out of default builds. For-profit companies, governments, non-profits and charities all count as commercial users.

Is ZeroTier end-to-end encrypted?

Yes, with Salsa20 and Poly1305, but without forward secrecy, which ZeroTier's own documentation acknowledges. Direct traffic never touches ZeroTier servers, and relayed traffic stays encrypted.

Should I choose ZeroTier or Tailscale?

Choose ZeroTier if you need layer-2 features like broadcast and multicast, or have many devices and few users. Choose Tailscale if you price by people, want WireGuard's forward secrecy, or need identity-based access controls on a free plan.

Key takeaways

• Free is now Personal: 10 devices, one network, one admin, non-commercial only, no API.
• Essential is $18 a month with 10 devices, then $2 per device; Scale is $179 a month with 100 devices, then $1.80 each.
• Prices are monthly only and non-refundable; cancel at least three days before renewal.
• Since 1.16 the controller is non-commercial source-available; commercial self-hosting means Enterprise.
• ZeroTier is a true layer-2 network, but its Salsa20/Poly1305 crypto has no forward secrecy.
• Best fit: home labs, LAN-dependent software and device-heavy, user-light deployments.