ZeroTier review
by ZeroTier, Inc.Zero-trust access and business VPN
A peer-to-peer virtual network priced per device: free for 10 devices for personal use, $18 a month for 10 devices on Essential and $179 for 100 on Scale.
- Free plan
- Self-serve
- Seat + usage
- Public prices
What you're paying for
- Saves engineering time (main value)
- Worth the price
A peer-to-peer virtual network at Layer 2 and Layer 3 for laptops, servers and embedded devices, priced per device rather than per user.
ZeroTier joins devices into virtual networks that behave like one Ethernet or IP network, with traffic sent directly between peers and end-to-end encrypted. Pricing counts devices, not users: Essential is $18 a month with 10 devices and $2 for each extra one, and Scale is $179 with 100. The client is open source (MPL-2.0), the rules engine supports tags and capabilities for microsegmentation, and a TCP relay can be self-hosted.
- Priced per device, unlimited usersScale includes 100 devices for $179 a month with unlimited users and networks; extra devices are $1.80 each, and a device in several networks is counted once.Evidence: Pricing page, pricing.md and node-counting FAQ (2026-10-16)
- Layer 2 and Layer 3 networksVirtual Layer 2 and Layer 3, bridging, multipath and custom routes let one network span offices, clouds and devices without a gateway in the middle.Evidence: pricing.md, bridging and routing docs (2026-10-16)
- A rules engine with tags and capabilitiesCustom flow rules on Scale use a text rules language with tags and capabilities, enforced by both the sender and the receiver of each packet.Evidence: Flow rules docs (2026-10-16)
- Best for
- Teams that connect many devices, including servers, IoT or embedded hardware, and want a flat virtual network priced per device.
- Good to know
- There is no device posture, SCIM, DNS filtering or vendor-hosted flow log, and OIDC sign-in works on desktop operating systems only.
How ZeroTier compares
Against 3 other products we reviewed in Zero-trust access and business VPN: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
| Metric | ZeroTier | Cloudflare Zero Trust | Twingate | Tailscale |
|---|---|---|---|---|
| What you're paying for | Saves engineering timeA peer-to-peer virtual network at Layer 2 and Layer 3 for laptops, servers and embedded devices, priced per device rather than per user. | Worth the priceZero-trust access, DNS and web filtering and device posture for up to 50 users at no cost, with a $7 per-user plan above that. | Worth the priceResource-by-resource access to private networks through connectors you run, with Google Workspace sign-in and posture checks from $5 per user. | Saves engineering timeA private WireGuard network for every laptop, phone and server, reached through your identity provider and one policy file instead of a VPN gateway. |
| Overall score | 5.2 | 8.2Best | 7.3 | 6.8 |
| Free option | Free plan | Free plan | Free plan | Free plan |
| Card to start | –Not measured | –Not measured | –Not measured | –Not measured |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $18/mo | $7/user/mo | $5/user/mo | $8/user/mo |
| Pricing model | Seat + usage | Per seat | Per seat | Per seat |
| Pricing page | Public prices | Public prices | Public prices | Public prices |
| Billing unit | Flat monthly base with included devices, then per device; no per-user fee | Per user who authenticates; no device count published | Per user per month, counting admins, pending and disabled users and service accounts | Per user per month; user devices unlimited; 50 tagged resources included, then $1/mo each |
| Free option | Personal: free, 10 devices, 1 network, non-commercial only | Free plan for up to 50 users, business use allowed; no trial | Starter: free for 5 users; 14-day trial of paid plans | Personal: free for up to 6 users, non-commercial only; 14-day Enterprise trial for company domains |
| Reference scenario (25 users) | $179/mo on Scale (100 devices included, 60 used), $7.16 per user, computed | $0/mo on Free (25 of 50 users), computed | $125/mo on Teams ($5 × 25, yearly), $5 per user, computed | $200/mo on Standard ($8 × 25), $8 per user, computed |
| Annual vs monthly price | Monthly prices only | $7 per user on Pay-as-you-go; pages disagree on monthly or annual billing | Teams $5 yearly or $6 monthly; Business $10 or $12 | One price per plan with no billing term; annual plans through sales |
| Devices per user | No per-user limit; devices counted once per organization | Not stated | 5 on every plan; custom on Enterprise | Unlimited on every plan |
| Okta / Entra ID sign-in | Essential and up (OIDC, desktop only) | Every plan (any SAML or OIDC provider) | Business and up; Google Workspace on every plan | Every plan (OIDC) |
| SCIM | Not offered | SAML and OIDC providers; no plan restriction stated | Business and up (Okta SCIM) | Standard and up (Okta, Entra ID, Google Workspace) |
| Device posture | Not offered | Built-in checks and EDR or MDM integrations on every plan | Native checks on every plan; MDM and EDR integrations from Business | Built-in checks on every plan; MDM and EDR integrations from Standard |
| Network flow logs | Not offered by the vendor | Every plan; 24 hours on Free, 30 days on Pay-as-you-go | Every plan; 24 hours Starter, 7 days Teams, 30 days Business | Premium and up, 30 days |
| SIEM streaming | Not offered; webhooks from Essential | Logpush on Contract per the plans page; the docs say all customers | Business and up per the docs; the plan table also ticks Home | Premium and up |
| Self-hosted parts | TCP relay; controller under licence or Enterprise | cloudflared connector (open source) | Connectors (always customer-run) | DERP relays and peer relays |
| SOC 2 / ISO 27001 | SOC 2 Type II; ISO 27001 "coming soon" | SOC 2 Type II (in the dashboard, under NDA); ISO 27001:2022 | SOC 2 Type 2 (trust portal, on request); ISO 27001 not stated | SOC 2 Type II (on request); ISO 27001 not stated |
| HIPAA BAA | Not stated | Enterprise-level customers handling PHI | Not stated; the HIPAA page says to ask by email | Not offered |
| EU data storage | Not stated | Data Localization Suite, Enterprise add-on | No; data stored in the US | Not guaranteed; coordination server in Frankfurt |
| Bottom line | From its public pages, ZeroTier is a flexible per-device virtual network with an open-source client and a strong rules engine. It does not offer device posture, SCIM or vendor-hosted flow logs, which many zero-trust buyers check for. | From its public pages, Cloudflare Zero Trust puts access, filtering and posture on a Free plan for up to 50 users. Activity logs are short below Contract, and SIEM export, egress IPs and EU storage go through sales. | From its public pages, Twingate offers per-resource access through your own connectors at $5 per user on Teams, with posture checks and an audit log. Enterprise identity providers, SCIM and longer logs start on Business, and data is stored in the US. | From its public pages, Tailscale gives a team identity-aware access to every device and server from the first plan, with unlimited user devices and policy as code. Flow logs and SIEM streaming start on Premium, and there is no BAA or EU residency guarantee. |
Evidence: ZeroTier: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Cloudflare Zero Trust: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Twingate: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Tailscale: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Score
- Pricing clarity
- 4.0 / 10, Fair
- scenario plan priced; can be bought online; one billing term published; a Legacy Central guide says the free plan covers small business use up to 25 devices, while the pricing page says non-commercial, 10 devices; pricing page lists OIDC SSO on Personal in one row and not in another, and the SSO docs say paid plans only; pricing pages list webhooks on Personal, while the webhooks docs say paid plans only; Essential support is "Ticketed support with SLA" on one pricing card and "Community support" on another; docs and the SLA name Commercial, Basic and Premium plans that the pricing page does not sell
- Price for 25 users
- 8.9 / 10, Excellent
- $179/mo: Scale at $179 with 100 devices included, enough for 60 nodes, only a monthly price published; $7.16 per user per month; group rules with device tags need custom flow rules, which start on Scale (Essential, $118 a month for 60 nodes, has templated network-wide rules only), and OIDC sign-in with Okta or Entra ID and the 30-day audit log are included; assumes groups are expressed as device tags in custom flow rules, since the docs say rules are not yet integrated with OIDC
- Free plan and trial
- 3.0 / 10, Fair
- free plan for non-commercial use only, 10 users; no IdP sign-in or access rules on free; no trial stated
- Access controls
- 5.0 / 10, Fair
- Okta or Entra ID sign-in on the scenario plan; SCIM not listed; group or port rules on the scenario plan; posture with MDM or EDR not listed; connectors or subnet routing on the scenario plan; DNS filtering or web gateway not listed; OIDC device sign-in on desktop operating systems only, Google Workspace not supported; subnet routing through a router node you run
- Visibility and exit
- 5.5 / 10, Fair
- audit log on the scenario plan; flow logs not listed; SIEM streaming not listed; admin API or Terraform; policy as code or export; self-hosted TCP relay; controller under a commercial licence or Enterprise; events through webhooks; the Terraform provider may not be fully compatible with New Central
- Compliance and data
- 5.0 / 10, Fair
- SOC 2 Type II, no ISO 27001 stated, HIPAA BAA not listed, self-serve DPA, EU data storage not listed, admin-console SSO not listed, subprocessor list published, ISO 27001 listed as coming soon; console SSO type not stated
Review
Review from public pages
Written from ZeroTier's public pages (pricing, security or privacy, and docs) as read on Oct 16, 2026. We did not sign up, and no hands-on run is published yet.
What the public pages show
We read ZeroTier's pricing page and its machine-readable pricing file (pricing.md, "Effective 4 August 2026"), the terms, DPA, privacy policy, Trust Center and subprocessor list, and docs on SSO, flow rules, webhooks, audit logs, the API, Terraform, routing, exit nodes, relays, roots, the self-hosted controller, node counting and security on Oct 16, 2026. We did not sign up or create a network.
The pricing is simple to compute: a flat monthly base with included devices and a price per device beyond them, billed monthly, with no annual price published. For our scenario, group rules need custom flow rules with device tags, which start on Scale; Essential has templated, network-wide rules only.
Several pages disagree. A Legacy Central guide says the free plan covers small business use up to 25 devices, while the pricing page says non-commercial use and 10 devices. OIDC SSO and webhooks are listed on the free plan in parts of the pricing pages but described as paid features in the docs. Docs and the SLA also name Commercial, Basic and Premium plans that the pricing page does not sell.
Strengths
- Unlimited users, priced by device
Essential, Scale and Enterprise list unlimited users; only authorized devices are counted, once per organization.
vs Cloudflare Zero Trust: Tailscale, Cloudflare Zero Trust, Twingate and NordLayer all bill per user.
- Open-source client and a relay you can host
The agent is MPL-2.0, a TCP relay can be self-hosted with the vendor’s container, and the controller is source-available.
- Direct, end-to-end encrypted traffic
Traffic goes directly between peers and is end-to-end encrypted, so ZeroTier’s infrastructure cannot observe or modify packets, per the security docs.
- API and audit log from Essential
Essential adds the Central API with service accounts, webhooks and a 30-day audit log; Enterprise keeps 90 days.
Things to know
- No posture, SCIM or DNS filtering
The pages describe no device posture checks, SCIM provisioning, DNS filtering, just-in-time access or session recording on any plan.
- Sign-in limits
Device SSO uses OIDC with PKCE on desktop operating systems only; Google Workspace is not supported directly, and the docs say rules are not yet integrated with OIDC.
Workaround: The docs suggest Keycloak as a broker for Google Workspace and SAML providers.
- No vendor-hosted flow logs or SIEM
There are no hosted flow logs or SIEM streaming; rules can copy traffic to an observer node you run, and events go out through webhooks.
- Monthly billing, no refunds
Only monthly prices are published; unused time is not refunded, and cancelling must be done at least 3 days before the next term.
Pricing reality
ZeroTier bills a flat monthly base plus extra devices, with no per-user fee. For our scenario, 60 nodes (50 user devices and 10 servers) on Scale cost $179 a month, or $7.16 per user (computed), because group rules with device tags need custom flow rules. Essential would cost $18 + 50 × $2 = $118 a month (computed) with templated rules only. Only monthly prices are published. Scale covers 100 devices before $1.80 per extra device. Enterprise (500+ devices, self-hosting, FIPS) and Quantum are priced by sales. Charities and educational organizations get up to 50% off.
Exit path
Networks, members and flow rules can be read through the Central API from Essential and managed with Terraform, though the docs say the provider may not be fully compatible with the New Central API. Flow rules are a text language. The DPA offers a copy of covered data on request within 60 days after the agreement ends; deleting the organization deletes all its networks.
Compared with
- Pick ZeroTier when
- You want to pay per device, need Layer 2 networking, or want a controller you can host under licence.
- Pick Tailscale when
- You need device posture, SCIM, flow logs or identity-provider sign-in on phones.
- Pick ZeroTier when
- You want a flat network across many devices rather than per-resource access through connectors.
- Pick Twingate when
- You want posture checks, Google Workspace sign-in and a free plan you can use for business.
- Pick ZeroTier when
- You want direct peer-to-peer traffic that the vendor’s infrastructure cannot observe.
- Pick Cloudflare Zero Trust when
- You want posture checks, DNS filtering and SAML or OIDC sign-in, free for up to 50 users.
Choose it if
- You connect many servers or embedded devices and want to pay per device.
- You need virtual Layer 2 networking or bridging.
- You want an open-source client and a relay you can host yourself.
Look elsewhere if
- You need device posture checks, SCIM or DNS filtering.
- Your users sign in with Google Workspace or from phones.
Bottom line
From its public pages, ZeroTier is a flexible per-device virtual network with an open-source client and a strong rules engine. It does not offer device posture, SCIM or vendor-hosted flow logs, which many zero-trust buyers check for.
Plan limits at a glance
| Limit | As recorded |
|---|---|
| Billing unit | Flat monthly base with included devices, then per device; no per-user fee |
| Free option | Personal: free, 10 devices, 1 network, non-commercial only |
| Reference scenario (25 users) | $179/mo on Scale (100 devices included, 60 used), $7.16 per user, computed |
| Annual vs monthly price | Monthly prices only |
| Devices per user | No per-user limit; devices counted once per organization |
| Okta / Entra ID sign-in | Essential and up (OIDC, desktop only) |
| SCIM | Not offered |
| Device posture | Not offered |
| Network flow logs | Not offered by the vendor |
| SIEM streaming | Not offered; webhooks from Essential |
| Self-hosted parts | TCP relay; controller under licence or Enterprise |
| SOC 2 / ISO 27001 | SOC 2 Type II; ISO 27001 "coming soon" |
| HIPAA BAA | Not stated |
| EU data storage | Not stated |
Read from the vendor's public pages on Oct 16, 2026. No hands-on run is published yet. How we check
We have not published a sign-up run for ZeroTier yet. The access facts above were read from its sign-up and pricing pages on Oct 16, 2026.
We have not published API calls for ZeroTier yet.
ZeroTier lists 4 plans. The cheapest paid plan, Essential (10 devices), costs $18/mo.
- ZeroTierFreePersonal$0/mo10 devices, 1 network, 1 admin; non-commercial use only
- CLI and web UI
- No API, flow rules or audit log
- Community support
- ZeroTierLowest priceEssential$18/mo10 devices included, then $2 per device a month; billed monthly
- 10 networks, 5 admins
- API, service accounts and webhooks
- OIDC single sign-on and templated flow rules
- 30-day audit log
- ZeroTierScale$179/mo100 devices included, then $1.80 per device a month; billed monthly
- Unlimited networks, 10 admins
- Custom flow rules with tags and capabilities
- Ticketed support
- ZeroTierEnterpriseContact sales
- Sized for 500+ devices
- Self-hosted and air-gapped deployment
- 90-day audit log
- FIPS 140-3 validated cryptography on one SKU
Prices as listed, USD, excluding tax; observed 2026-10-16.
Source: zerotier.com pricing page. Prices change; the observed date above is when our agent read them.