Mullvad VPN

Mullvad exists because its founders believed that privacy is a right, not a product feature — and that the VPN industry’s marketing practices were fundamentally at odds with genuine privacy protection. Launched in 2009 by Mullvad AB in Gothenburg, Sweden, Mullvad has built the most privacy-respecting VPN architecture in the mainstream market by systematically eliminating every point at which user information could be collected, stored, or disclosed.

This review covers Mullvad’s privacy model, technical architecture, pricing philosophy, server network, open-source credentials, and who should (and should not) choose it over larger competitors like NordVPN.

The No-Identity Architecture

The defining feature of Mullvad is not its server count, its speed, or its streaming library. It is the structural decision to make customer identity unnecessary.

When you visit mullvad.net, there is no “Sign Up” form asking for your name, email address, or phone number. Instead, you click “Generate account number,” and the website creates a random 16-digit number. That number is your entire relationship with Mullvad.

No email means:

• No account recovery emails (if you lose your number, you lose your account)
• No marketing emails
• No data breach exposure of email addresses
• No correlation between your identity and your account

Mullvad’s reasoning is explicit on their website: they want to know as little about their customers as technically possible. This is not a privacy claim on a marketing page — it is the structural reality of how the service is built.

Anonymous Payment Methods

The account number removes identity at the registration level. Mullvad completes the privacy picture by accepting payment methods that remove identity at the financial level:

Cash (physical mail): Write your account number on a piece of paper, put it in an envelope with banknotes of any currency, and mail it to Mullvad’s office in Gothenburg. This is the most anonymous payment method available — no bank record, no digital trail, no name on the envelope required. Mullvad publishes their postal address publicly and has a clear process for handling cash payments.

Monero (XMR): Monero is a privacy-focused cryptocurrency with ring signatures and stealth addresses that make transactions non-traceable on the blockchain. Unlike Bitcoin (which is pseudonymous but traceable), Monero transactions cannot be linked to sender or recipient with current forensic tools. Paying with Monero from a wallet you control completely severs the payment-to-user chain.

Bitcoin: Accepted but significantly less private than Monero. Bitcoin transactions are permanently recorded on a public blockchain. With sufficient blockchain analysis, Bitcoin payments can be traced.

Credit/debit cards and PayPal: Accepted. Convenient but creates a financial record linking your payment method to your Mullvad account number. Still more private than most VPN services because no personal data (name, email) is attached to the account.

Open-Source Clients: Verifiable Claims

Most VPN providers make privacy claims that users must accept on faith, because the applications are closed-source and cannot be independently verified. Mullvad takes a different position: all client applications are published under the GPLv3 open-source license on GitHub.

This means:

• Security researchers can read the code and verify that no undisclosed data collection occurs
• The no-logs claim can be verified at the implementation level, not just on a policy page
• Community contributors can identify and report security vulnerabilities
• The code can be compiled independently and compared to the distributed binary to detect tampering

Mullvad’s GitHub repositories include the desktop client (Windows, macOS, Linux), the iOS app, and the Android app — all open-source. The VPN daemon, network configuration tools, and GUI are all independently auditable.

Independent Security Audits

Mullvad has commissioned external security audits from Cure53, a German penetration testing firm with an established record of auditing security-critical software. Unlike some providers who commission audits but share only a favorable summary, Mullvad publishes full audit reports including all findings (both critical and minor) and the remediation steps taken.

Published audits cover:

• The desktop VPN application (macOS, Windows, Linux)
• The iOS application
• Infrastructure and server configuration components

This transparency distinguishes Mullvad from providers whose audits are marketing exercises rather than genuine accountability mechanisms.

DAITA: Defense Against AI-Guided Traffic Analysis

Encryption prevents an observer from reading your internet traffic — but it does not prevent an observer from analyzing the pattern of your traffic. The timing of packets, their size distribution, and the intervals between bursts create a signature that can be used to identify what you are doing online without ever breaking the encryption.

Recent academic research (and intelligence agency practice) has demonstrated that machine learning models can analyze encrypted VPN traffic patterns to:

• Identify specific websites being visited
• Detect the use of certain applications
• De-anonymize users based on behavioral patterns

DAITA (Defense Against AI-guided Traffic Analysis) counters this by:

1. Adding cover traffic: Sending dummy packets at random intervals to disrupt timing pattern analysis
2. Padding packets: Adding randomized padding to packet sizes, disrupting size-based fingerprinting
3. Randomizing burst patterns: Introducing delays to break timing correlations between real traffic events

DAITA is available in Mullvad’s desktop applications and represents a technical capability that no mainstream competitor currently offers. For users in high-risk environments where adversaries may have traffic analysis capabilities — journalists, activists, researchers working on sensitive topics — DAITA provides a meaningful additional layer of protection.

Technical Architecture: WireGuard and OpenVPN

Mullvad supports two VPN protocols:

WireGuard: The modern protocol. Mullvad was one of the first commercial VPN providers to implement WireGuard, and the WireGuard protocol itself was partially developed with Mullvad’s collaboration. WireGuard delivers the fastest speeds and lowest CPU overhead. All Mullvad servers support WireGuard.

OpenVPN: The established protocol. Slower than WireGuard but widely compatible and well-understood. Available on all Mullvad servers in both UDP and TCP variants. Useful in network environments that restrict WireGuard traffic.

Mullvad’s multihop feature routes traffic through two sequential servers in different countries. The first server knows your IP address but not your destination. The second server knows the destination but not your real IP. This prevents any single server from correlating you with your traffic — providing higher protection than standard single-hop VPN.

Bridge servers (Shadowsocks): For users in countries that block VPN traffic, Mullvad provides SOCKS5 proxy bridge servers using the Shadowsocks protocol, which obfuscates VPN traffic to bypass deep-packet inspection.

Server Network: Quality Over Quantity

Mullvad operates approximately 700 servers across 40+ countries. This is substantially smaller than NordVPN (6,400+) or ExpressVPN (3,000+). Mullvad does not consider this a limitation — the focus is on server quality and ownership rather than raw count.

Key characteristics of Mullvad’s server infrastructure:

• Physical ownership: Mullvad owns the majority of its servers outright, rather than renting from data centers. This reduces the risk of undisclosed data center access.
• RAM-only servers: Servers do not use persistent storage for logs or session data. Data is never written to disk.
• 10 and 100 Gbps connections: High-bandwidth server links for fast speeds
• Port 80 and 443 support: VPN connections over standard web ports to bypass network-level VPN blocking

Available countries include: United States (multiple cities), United Kingdom, Germany, Netherlands, Sweden, Switzerland, France, Spain, Italy, Japan, Singapore, Australia, Canada, Czech Republic, Denmark, and others.

Pricing: Genuinely Flat and Transparent

Mullvad charges a flat €5 per month. Always. No exceptions.

There are no annual plans that save 60% in year one before jumping to full price. No “for a limited time” promotions that expire. No tiered plans with arbitrary feature gates. No upsells to a premium tier.

This is a deliberate statement about how Mullvad believes VPN services should be priced. The VPN industry’s multi-year promotional pricing is frequently criticized as deceptive — advertising a $2.99/month price that requires a two-year upfront payment of $71.76, then renews at $12.99/month. Mullvad rejects this model entirely.

One account number supports up to 5 simultaneous connections. Additional connections (additional active account numbers) cost €5/month each.

Who Should Use Mullvad

Privacy researchers and security professionals: Mullvad’s technical architecture — open-source clients, published audits, no-identity registration, cash payment acceptance, DAITA — represents the highest available privacy standard in mainstream commercial VPN products.

Journalists and activists: Those operating in environments where VPN provider identity could be subpoenaed or compelled benefit from the structural impossibility of Mullvad linking a connection to a person.

Users who are philosophically opposed to data collection: Even if the practical privacy risk of using a mainstream VPN is low, some users prefer Mullvad as a matter of principle — they do not want their email address in another database.

Privacy-conscious developers: The open-source clients allow developers to verify the code, contribute fixes, or build integrations on top of the platform.

Who Should Consider Alternatives

Streaming-first users: If your primary VPN use case is unblocking Netflix, BBC iPlayer, Disney+, or other streaming platforms, NordVPN or ExpressVPN are better choices. They dedicate significant infrastructure to maintaining streaming access; Mullvad does not.

Users who want long-term pricing discounts: If the flat €5/month price is a budget concern and you are comfortable committing to a two-year subscription, NordVPN’s 2-year plan at $3.39/month is significantly cheaper. Mullvad’s flat pricing means no discount is ever available.

Users who need an email-recoverable account: Mullvad accounts cannot be recovered if you lose your account number. For users concerned about losing access, a service with email-based account recovery is more practical.

Users in China needing guaranteed VPN access: While Mullvad has bridge mode for circumventing VPN blocking, NordVPN’s dedicated obfuscation infrastructure is generally more reliable in highly restrictive environments.

Expert Verdict

Mullvad is the gold standard for privacy in commercial VPN products. No other mainstream provider matches its combination of no-identity architecture, anonymous payment acceptance, fully open-source clients, published audit reports, and active technical research into next-generation privacy threats like traffic analysis.

The trade-offs are real: fewer servers, weaker streaming performance, and no discount pricing. For users whose primary concern is privacy and anonymity rather than entertainment, these trade-offs are appropriate.

If you are choosing a VPN for maximum privacy and are willing to accept limitations in streaming access and server count, Mullvad is the principled, technically superior choice. If you want a well-rounded VPN that does everything well, NordVPN is the stronger recommendation.

Overall rating: 4.8 / 5

Regional Context

Mullvad operates under Swedish and EU GDPR jurisdiction. Swedish privacy law is among the strongest in the European Union. The GDPR provides EU residents with substantial data rights — the right to access, correct, and delete personal data. Mullvad’s design makes these rights largely moot: there is no personal data to access, correct, or delete. The company’s Swedish incorporation means it is subject to EU law and cannot be compelled by US, UK, or Australian authorities under their respective legal frameworks without formal mutual legal assistance treaty (MLAT) processes.