Download ZeroTier One for PC

ZeroTier One builds private virtual Ethernet networks over the public internet, so a laptop in one city and a server in another behave as if they share a switch. Devices join a network by its 16-digit Network ID, get approved by the network's owner, and then talk directly with encryption, without port forwarding or new hardware. On a computer, the route that works is the vendor's own client for Windows or macOS, installed from zerotier.com/download and paired with a network you create in ZeroTier Central.

What a desktop node adds to a ZeroTier One network

The machines people actually want to reach are usually desktops and servers: a file share, a Remote Desktop host, an SSH box, a NAS admin page, a game server on a spare PC. Installing ZeroTier One on the computer turns it into a reachable member of the network rather than something that only reaches out.

On Windows and macOS, ZeroTier One splits into two parts. A system service runs with administrator rights and does all the networking; a small tray or menu bar app, running as the normal user, talks to that service to join and leave networks. Because the virtual adapter belongs to the service, every program on the machine can use it. File Explorer paths, Remote Desktop, a browser pointed at an internal dashboard, and backup software all travel the same network without per-app setup.

The desktop is also where ZeroTier One can be scripted. The zerotier-cli command works anywhere there is a terminal, so a node can be joined, queried, and rebuilt from a script. Dropping an empty file named after a network ID into the service's networks.d folder makes the machine join that network when the service starts. Phones offer none of this, and Android allows only one VPN connection on the device at a time, which makes a handset a poor place to anchor a permanent site link.

Ways to reach a ZeroTier One network from Windows or macOS

• Official desktop client. ZeroTier publishes installers for Windows and macOS on its download page, plus packages for Debian and RPM based Linux distributions through a repository script, official Docker images, and builds for FreeBSD. This is the route for anyone who wants their computer on the network.
• The browser. ZeroTier Central is the hosted control plane. It is where networks are created, devices authorized, and rules written, and it does not carry traffic. Central tells clients which networks they belong to and what policy applies. A browser alone cannot make a computer a member of a network.
• The Android package under an emulator. The Android build runs inside Android's VPN interface, so under an emulator only the software inside that virtual Android system reaches the network. Windows or macOS programs on the host see nothing, and the emulated node still consumes a member slot in Central. With native clients for both desktop operating systems, this route has no purpose.

Native NAS packages for Synology, QNAP, ASUSTOR and Western Digital are deprecated; ZeroTier now points NAS users to the Docker container instead.

How the desktop client behaves compared with the phone app

Setup on a computer starts from the tray icon on Windows or the menu bar icon on macOS, where Join New Network... takes a Network ID. A desktop node can hold several networks at once and stays joined across reboots because the service, not the interface, owns the connection.

Two settings are off until asked for. Allow DNS lets a network push DNS servers to the machine, and Allow Default lets ZeroTier One take over the system's default route, which is how full tunnel mode is switched on. Both default to no on a fresh install, and changing them from the interface or the CLI rewrites the client's configuration file. Managed DNS is supported on Windows, macOS, Android and iOS.

There is no account sign-in inside the client. Each installation generates its own 10-digit node address, and that address is what gets approved in Central's member list. A phone, a desktop and a server on the same network are three separate members, each authorized separately, and each counting against the device allowance on the plan in use. Reinstalling on a wiped machine produces a new address, which appears as a new unauthorized member. One desktop quirk has no phone equivalent: the tray app needs access to the service's local authentication token, which the installer copies to the installing user's location. A different user account without that access can see the app but cannot join or leave networks.

What ZeroTier One needs on a computer

macOS 10.13 and newer is supported. On Windows, current releases dropped Windows 7 and Server 2012 at version 1.8, and ZeroTier directs those systems to the older 1.6.6 build instead. Builds exist for 32-bit and 64-bit Intel and for 32-bit and 64-bit ARM, so Apple Silicon Macs and ARM based Windows machines are covered along with ordinary x64 hardware.

ZeroTier supports the current major client release and the two major releases before it, and all versions remain compatible with each other on the same network. The engine is single-threaded, so a machine with more than two cores gains little from the extra silicon; the same code runs on hardware as modest as a first-generation Raspberry Pi. ZeroTier does not publish minimum RAM or disk figures for the desktop clients. Installation needs administrator rights on Windows and an approved system extension on macOS.

Where ZeroTier One installs stall, and what fixes them

The client joined but nothing is reachable. Private networks require approval. Open the network in Central, find the member whose node address matches the one shown by the client or by zerotier-cli info, and tick its authorization box. Until then the device sits in the list with no managed IP.

PORT_ERROR on macOS. This means the tun/tap driver did not load. Approve the ZeroTier extension in the General pane of the system's security settings, then reload the service with launchctl, or simply restart. Extension approval cannot be completed through a remote session; the click has to happen at the machine's own console.

The Windows tray icon crashes or vanishes. The service usually keeps running underneath. Open Command Prompt as administrator and use zerotier-cli info, zerotier-cli listnetworks and zerotier-cli join to confirm status and manage networks while the interface is broken.

The Windows installer fails or the adapter never appears. ZeroTier's own checklist is to confirm administrator rights, remove other VPN software that may conflict, look at antivirus suites whose internet security features take over firewall duties, and try reinstalling after a reboot.

Names do not resolve, or Remote Desktop drops during install. DNS pushed by a network only applies when Allow DNS is enabled, and on macOS tools such as dig, host and nslookup do not read that type of resolver even when it is working. Installing the network adapter over Remote Desktop can interrupt the session, and ZeroTier documents a separate procedure for installing on a machine reached that way.

FAQ

Can I use ZeroTier One from a browser without installing anything?

No. The web side, ZeroTier Central, creates networks, authorizes devices and holds the rules, but it carries no traffic. A computer only joins a network when the client is installed on it.

Does the desktop client need a login?

The client itself has no sign-in. Every installation generates a 10-digit node address, and you approve that address in Central. The account exists on the web side, not in the tray app.

Can my phone and my PC be on the same ZeroTier One network?

Yes. Each is a separate member with its own address and its own authorization, and both count toward the device allowance on your plan. Note that Android runs only one VPN connection at a time, so an always-on VPN will block the ZeroTier One app.

Is ZeroTier One free on Windows and macOS?

The clients are free to download and the free plan covers a limited number of devices for testing, personal and non-commercial use. Paid plans add device packs and business features such as SSO.

Will installing over Remote Desktop cut me off?

It can, because the installer adds a network adapter. ZeroTier publishes a separate procedure for installing on a machine you reach through Remote Desktop; follow that rather than the normal installer flow.