PAGES
← all tools
◆ Secure Access (VPN / SASE / ZTNA)

ZeroTier

June 15, 2026 commercial

ZeroTier is a virtual networking tool that creates secure, encrypted peer-to-peer networks connecting devices globally as if on a local LAN.

Summary

ZeroTier is a commercial secure-access platform that creates virtual networks joining devices across locations as if they were on the same LAN. It runs as a hosted service through ZeroTier Central, with a management layer for defining networks, members, and policy rather than a self-hosted controller you maintain yourself. Custom Flow Rules, available on Scale and Enterprise plans, let administrators write micro-segmentation policy in ZeroTier's own rule language, restricting traffic by tag so that only servers tagged appropriately can reach tagged databases, which points this at network and platform engineers rather than end users. Webhooks add real-time alerts on membership and network changes, and the Central API v2, paired with scoped service-account tokens, gives automated workflows and CI/CD pipelines programmatic control over organizations and access.

ZeroTier is a virtual networking tool that creates secure, encrypted peer-to-peer networks connecting devices globally as if on a local LAN.

ZeroTier publishes no documentation we track, so the description above is written from general knowledge rather than the vendor's own words.

How ZeroTier helps

Which devices across my different sites and networks can actually reach each other right now?

joins them into one virtual network as if they shared a LAN, so reachability is defined by network membership rather than physical topology or VPN tunnels configured hop by hop

Can a compromised server reach my database if it isn't supposed to?

custom flow rules restrict traffic by tag, so only members tagged as servers can reach members tagged as databases, and anything untagged is denied regardless of network path

Who added or removed a device from a sensitive network, and when?

webhooks push real-time notifications on membership and network changes, giving a live record of joins and changes as they happen rather than requiring a manual check of the member list

How do I let a deploy pipeline manage network membership without handing it my own login?

scoped service-account tokens with configurable expiration give the Central API v2 programmatic control over organizations, networks, and members limited to what that token is granted

Did the network's access policy actually change, or does it just look different in the editor?

the rule editor validates and highlights the custom rule language before it takes effect, so the enforced policy matches what was written rather than a syntax error silently falling back to a default

all 7 features, with the evidence for each →

Languages

Not documented

Features

7 capabilities

Built from ZeroTier's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What ZeroTier offers you

  • Administrative audit log1
  • CI/CD pipeline integration1
  • Multi-tenant management1
  • Outbound webhooks (the product notifies you)1
  • REST API1
  • Role-based access control1
All capabilities 7 capabilities
Flow Rules and network micro-segmentation shipped Enables enforcement of traffic policies on a network using capabilities, tags, and the full ZeroTier rule language, with a rule editor offering templated and custom modes, syntax highlighting, and validation. 6 releases · 3 other sources · first seen Jun 2026

release

  • Adds Custom Flow Rules to New Central, enabling sophisticated network micro-segmentation policies using capabilities and tags June 15, 2026 · Jun 2026 · source · release history
  • New Flow Rules interface supports both templated and custom rule modes with a rule editor featuring syntax highlighting and validation. June 15, 2026 · Jun 2026 · source · release history
  • Adds a comprehensive rule editor with syntax highlighting and validation June 15, 2026 · Jun 2026 · source · release history
  • Enhances the flow rules interface with support for both templated and custom rule modes June 15, 2026 · Jun 2026 · source · release history
  • Adds Custom Flow Rules to New Central for network micro-segmentation using capabilities and tags June 15, 2026 · Jun 2026 · source · release history
  • Adds Custom Flow Rules to New Central, enabling network micro-segmentation policies using capabilities, tags, and the full ZeroTier rule definition language (Scale and Enterprise plans). June 15, 2026 · Jun 2026 · source · release history

example

  • Create micro-segmentation policies in New Central using the new Custom Flow Rules engine In New Central, go to Network Settings > Security and configure 'Custom Flow Rules' with capabilities and tags June 15, 2026 · Jun 2026 · source
  • When you want to enforce micro-segmentation on a ZeroTier network in New Central — e.g., allow only tagged servers to reach tagged databases. In New Central, go to your Network > Flow Rules, select 'Custom' mode, and enter rules using capabilities and tags (e.g., `accept` / `drop` statements against `tag` and `cap` matchers) in the… June 15, 2026 · Jun 2026 · source
  • Create sophisticated micro-segmentation policies in the New Central web UI In New Central, navigate to Network Settings > Flow Rules and select 'Custom' mode to define rules using capabilities and tags. June 15, 2026 · Jun 2026 · source
Central REST API shipped Provides programmatic access to organizations, network groups, networks, members, and access controls via a versioned RESTful API. 6 releases · first seen Dec 2025

Shared capability: REST API

Also counts toward: REST API

release

  • New Central API v2 RESTful API provides programmatic access to organizations, network groups, networks, members, and access controls. April 15, 2026 · Apr 2026 · source · release history
  • New Central API v2 provides RESTful programmatic access to organizations, network groups, networks, members, and access controls. April 15, 2026 · Apr 2026 · source · release history
  • Metrics collection is now disabled by default and must be explicitly enabled via the enableMetrics setting in local.conf. December 22, 2025 · Dec 2025 · source · release history
  • enableMetrics config option in local.conf controls metrics collection December 22, 2025 · Dec 2025 · source · release history
  • Metrics collection is now disabled by default in ZeroTier One v1.16.1. December 22, 2025 · Dec 2025 · source · release history
  • enableMetrics config key in local.conf allows enabling metrics collection, which is now disabled by default December 22, 2025 · Dec 2025 · source · release history
Role-based and relationship-based access control shipped Provides granular permissions via a hierarchical organization structure, Role-Based Access Control (RBAC), and Relationship-Based Access Control (ReBAC) with comprehensive audit logging. 6 releases · first seen Nov 2025

Also counts toward: Administrative audit log, Multi-tenant management, Role-based access control

release

  • Introduces Relationship-Based Access Control (ReBAC) model for granular permissions November 4, 2025 · Nov 2025 · source · release history
  • User role-based access controls with audit logging November 4, 2025 · Nov 2025 · source · release history
  • Adds hierarchical organization structure support for multi-tenant hierarchy management November 4, 2025 · Nov 2025 · source · release history
  • Enables user role-based access controls with comprehensive audit logging November 4, 2025 · Nov 2025 · source · release history
  • Hierarchical organization structure for managing networks and devices November 4, 2025 · Nov 2025 · source · release history
  • Relationship-Based Access Control (ReBAC) for permissions November 4, 2025 · Nov 2025 · source · release history
Optimized peer discovery shipped Improves network performance by optimizing peer discovery across all platforms. 3 releases · 1 other source · first seen Aug 2025

release

  • Enforces plan downgrade restrictions to ensure current usage stays within lower-tier entitlements March 20, 2026 · Mar 2026 · source · release history
  • Improved network performance with optimized peer discovery August 21, 2025 · Aug 2025 · source · release history
  • Optimizes peer discovery to improve network performance across all platforms August 21, 2025 · Aug 2025 · source · release history

example

  • Attempt a plan downgrade in the UI and observe the new restriction if current usage exceeds the target plan's limits. In the ZeroTier Central console, navigate to Account > Billing and attempt to switch to a lower tier. The system will block the change if your current usage exceeds the entitlements of that plan. March 20, 2026 · Mar 2026 · source
Mobile topology deployment via QR code shipped Allows deploying custom ZeroTier topologies to mobile devices by scanning a QR code containing the planet file URL. 2 releases · 2 other sources · first seen Aug 2025

release

  • Adds support for loading custom planet files on mobile clients via URL or QR code August 21, 2025 · Aug 2025 · source · release history
  • Mobile clients now support loading custom planet files via URL or QR code August 21, 2025 · Aug 2025 · source · release history

example

  • Deploy a custom ZeroTier topology to mobile devices by scanning a QR code containing the planet file URL. Scan the generated QR code on your mobile client's network settings screen August 21, 2025 · Aug 2025 · source
  • Deploy a custom ZeroTier infrastructure to mobile devices by sharing the planet file configuration via a QR code for quick onboarding. Open the ZeroTier app on your mobile device and scan the QR code containing the URL to your custom planet file. August 21, 2025 · Aug 2025 · source
Webhooks shipped Allows subscribing to real-time event notifications so external systems receive alerts when network membership or configuration changes. 1 release · 1 other source · first seen May 2026

Shared capability: Outbound webhooks (the product notifies you)

Also counts toward: Outbound webhooks (the product notifies you)

release

  • New Webhooks feature lets you subscribe to real-time event notifications for network changes, member activity, and organization updates. May 6, 2026 · May 2026 · source · release history

example

  • Enable webhooks in ZeroTier Central to receive real-time alerts when members join or networks change. In the ZeroTier Central console, go to your Organization settings, select Webhooks, and create a new webhook by entering your endpoint URL and choosing the event types to monitor (e.g. May 6, 2026 · May 2026 · source
Service Accounts and API tokens shipped Lets teams create service accounts with scoped, expiring API tokens to support automated workflows and CI/CD pipelines. 2 releases · first seen Apr 2026

Also counts toward: CI/CD pipeline integration

release

  • Adds Service Accounts with scoped API tokens for automated workflows and CI/CD pipelines, with customizable token expiration dates. April 15, 2026 · Apr 2026 · source · release history
  • Service accounts allow creation of API tokens with customizable expiration dates for automated workflows. April 15, 2026 · Apr 2026 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface

Five scores for ZeroTier, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail ZeroTier puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

9 entries

  1. June 20262
  2. May 20261
  3. April 20262
  4. March 20261
  5. December 20251
  6. November 20251
  7. August 20251
    Show

    9 entries

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →