zerotier-idtool

Generate a new ZeroTier identity and output the secret part to stdout

$ zerotier-idtool generate

$ zerotier-idtool generate [path/to/identity.secret] [path/to/identity.public]

$ zerotier-idtool generate [path/to/identity.secret] [path/to/identity.public] [vanity_prefix]

$ zerotier-idtool getpublic [path/to/identity.secret]

$ zerotier-idtool sign [path/to/identity.secret] [path/to/file]

$ zerotier-idtool verify [path/to/identity.public] [path/to/file] [signature_hex]

$ zerotier-idtool validate [path/to/identity.public]

$ zerotier-idtool help

zerotier-idtool subcommand <arguments>...

generate <public_file> <private_file> <secret_file>
    Generate random identity: 256-bit public key, 10-byte private seed, 24-byte secret.

signroot <signer_public> <signer_private> <root_file>
    Sign JSON root_file with identity; output signed root to stdout.

verifyroot <root_file> <verifier_public>
    Verify root signature against public key; exit 0 if valid.

dump <file>
    Output JSON dump of identity.public or signed root file.

zerotier-idtool is a command-line utility from the ZeroTier One suite, used for cryptographic identity operations in ZeroTier virtual networks. ZeroTier creates secure, software-defined networks using Curve25519 elliptic curve cryptography for authentication, encryption, and network authorization. This tool handles key generation, root signing for network controllers, signature verification, and data dumping.

It generates identity triples: a 256-bit public key (identity.public, 40 hex chars), a 10-byte private seed (identity.private, 20 hex chars), and a 24-byte handshake secret (identity.secret, 48 hex chars). Controller identities sign root files—JSON descriptions of network rules, world IDs, and stable endpoints—which peers use to authorize network membership.

Essential for custom controllers or self-hosted setups, it ensures tamper-proof network configs. Nodes verify roots against trusted controller public keys during joins. The tool outputs to stdout for signing/dumping, enabling piping. Errors exit non-zero, aiding scripting.

Protect private files rigorously, as they derive node identities. Widely used in enterprise VPN alternatives, IoT, and SD-WAN deployments.

Private files are sensitive; store securely.
Files must be exact hex lengths or fail silently.
Signing outputs to stdout; redirect to save.
No global options; subcommands only.

identity.public: 40 hex chars.
identity.private: 20 hex chars (seed).
identity.secret: 48 hex chars (salt).
root: JSON with "id", "signingKey", rules.

Developed by ZeroTier, Inc. since 2014 with ZeroTier One v1.0. Evolved for SDN security; current in v1.12+. Open-source under BSL.

zerotier-cli(1), zerotier-one(8)