Mullvad VPN Honest Review: What’s True, What’s Not

Disclosure: Mullvad does not run an affiliate program, and we have no commercial relationship with them. Nothing in this review earns us a commission either way — which, fittingly, is part of why the company is interesting.

Mullvad occupies a strange position in the VPN market. It spends almost nothing on the influencer sponsorships that fund most “best VPN” content, it refuses to run an affiliate program, and yet it is the default recommendation in nearly every serious privacy community. When a product earns a reputation that way — without paying for it — the reputation is usually worth examining. It’s also worth pressure-testing, because reflexive praise calcifies into myth, and some of what gets repeated about Mullvad is no longer accurate.

This review covers what Mullvad verifiably does well, what it deliberately doesn’t do, and where the conventional wisdom has drifted from reality. Claims below reflect Mullvad’s service as of early June 2026; the VPN landscape moves quickly, so check dates on anything you read about any provider — including this.

The Facts That Hold Up

The account model is genuinely anonymous-by-design. Signing up for Mullvad generates a random numbered account. No email address, no username, no password reset flow, no personal details. The number is the account. If you pay with cash — Mullvad accepts envelopes of cash mailed to its Gothenburg office — or with cryptocurrency, the company holds essentially nothing that links the account to a person. Most competitors claim “no logs”; Mullvad’s architecture means there’s barely an identity to log against in the first place. This is the single biggest structural difference between Mullvad and almost everyone else.

Flat pricing, no games. Mullvad costs €5 per month. It has cost €5 per month since 2009. There are no “83% off — but only with this YouTuber’s link” promotions, no teaser rates that triple at renewal, and no multi-year lock-ins. You can pay for one month or sixty; the price per month is identical. If you have spent any time in the VPN market, you know how anomalous this is. The pricing model is itself a trust signal: a company that doesn’t need to trap you with sunk costs is implicitly betting that you’ll stay because the product works.

The audit record is real and ongoing. Mullvad commissions regular independent security audits of its apps and infrastructure and — crucially — publishes the reports, including the unflattering findings, on its website. Firms including Cure53, Assured, and Radically Open Security have audited the apps, the infrastructure, and the no-logging claims across multiple engagements. Audits are point-in-time snapshots, not guarantees, but a multi-year public audit trail with remediation notes is about the strongest evidence a VPN can offer. Mullvad maintains the full list on its security audits page, and the cryptographic protocols it builds on are documented in the open — WireGuard’s design has been formally analyzed in peer-reviewed academic work.

The 2023 police raid found nothing — because there was nothing. In April 2023, Swedish police executed a search warrant at Mullvad’s offices intending to seize servers containing customer data. They left without taking anything, after Mullvad’s lawyers demonstrated that no customer activity data existed to seize. This is the rare case where a no-logs policy was tested by state action rather than by a paid audit, and it held. It remains the strongest single data point in Mullvad’s favor, and it’s legitimate to weight it heavily.

RAM-only, diskless infrastructure. Mullvad has migrated its VPN servers to run from RAM with no disks in service, meaning a powered-down or seized server retains nothing. Combined with the account model, the realistic attack surface for retroactive data recovery is unusually small.

Genuinely open source. The desktop and mobile apps are open source and reproducibly buildable. Mullvad also co-develops the Mullvad Browser with the Tor Project — a Firefox derivative that applies Tor Browser’s anti-fingerprinting engineering to non-Tor browsing. Whatever you think of the VPN, that collaboration produced one of the few browsers that meaningfully resists fingerprinting out of the box.

The Claims That Don’t Hold Up

“Mullvad does everything the big VPNs do, but more privately.” Not true, and Mullvad would be the first to say so. The company has repeatedly removed features in service of its threat model. Port forwarding was eliminated in mid-2023 because it created abuse problems and correlation risk. OpenVPN support has been phased out — announced in 2024 and removed in January 2026 — leaving WireGuard as the sole protocol. If you depend on a feature Mullvad considers privacy-hostile or operationally distracting, it will not accommodate you, and history says the feature list shrinks rather than grows.

“It’s great for streaming.” It is not designed for streaming, and Mullvad explicitly declines to play the cat-and-mouse game of cycling IP ranges to evade streaming-service VPN blocks. Some services work on some servers on some days. If unblocking video catalogs is your primary use case, Mullvad is the wrong tool and the company will not pretend otherwise.

“A VPN makes you anonymous.” No VPN makes you anonymous, Mullvad included — you are shifting visibility from your ISP to the VPN operator, full stop. Mullvad minimizes what it can know, which is meaningfully different from a marketing promise not to look. But anonymity against a capable adversary requires Tor or similar mix networks, and the EFF’s Surveillance Self-Defense guide is appropriately blunt that choosing a VPN is about choosing who you trust, not about disappearing. We covered the same trust framing in our piece on browser VPN extensions versus full clients — the question is never “am I hidden,” it’s “who can see me now, and do I trust them more.”

“The server network is too small to perform well.” Mullvad runs roughly 650–700 servers across about 45 countries — far fewer flags on the map than the brands claiming thousands of servers in a hundred countries. In practice this matters less than the spec sheet implies. WireGuard throughput on Mullvad’s network is consistently strong in independent testing, and many of the mega-networks pad their country counts with virtual locations. What the smaller footprint does cost you: if you specifically need an exit IP in an unusual country, Mullvad may simply not have one.

Feature Table

Who Mullvad Is Actually For

Mullvad is the right choice if your goal is reducing what your ISP, your network operator, or a data-hungry ecosystem can collect about you — and you want a provider whose incentives, architecture, and audit history all point the same direction. It is the obvious choice for anyone whose threat model includes legal process against the VPN provider itself, because the raid demonstrated what’s recoverable: nothing.

It is the wrong choice if you want a Netflix-region-hopping utility, if you need port forwarding for torrenting or self-hosting, or if you want a long-term subscription discount. It is also overkill in the opposite direction for some users: if you only need to mask a single browser tab’s region occasionally, a full VPN client may be more tool than the job requires — see our breakdown of what browser VPN extensions actually do before paying for anything.

One more configuration note: whichever client you run, verify your setup isn’t leaking around the tunnel. WebRTC can expose your real IP from inside the browser even with the VPN connected — our WebRTC IP leak protection guide walks through testing and fixing it.

Verdict

Most VPN reviews end with a score that was negotiated with an affiliate manager. We don’t have one of those, so here’s the honest version: Mullvad is the most credible mainstream VPN for privacy-motivated users, and the gap is structural, not incremental. The account model, the audit trail, the raid outcome, and the refusal to participate in the affiliate economy are mutually reinforcing evidence that the company’s incentives match its marketing — which is the rarest property in this product category.

The trade-offs are equally real. You give up streaming reliability, port forwarding, protocol choice, and exotic server locations. Mullvad has decided those features conflict with its mission and has shown it will keep cutting rather than compromise. Whether that’s a flaw or the entire point depends on what you bought a VPN to do.

Frequently Asked Questions

Is Mullvad really anonymous if I pay by card or PayPal?

Paying by card or PayPal links a payment to an account number, so the payment processor — and by extension Mullvad — could connect that account to a billing identity. The activity flowing through the tunnel still isn’t logged, but if payment-level unlinkability matters to you, use cash by mail or cryptocurrency. The option exists precisely for that threat model.

Did Mullvad really pass a police raid?

Yes. In April 2023, Swedish police arrived at Mullvad’s office with a warrant to seize customer data and left empty-handed after it was established that no such data existed. It is one of the few real-world tests of a no-logs claim by any VPN provider.

Why did Mullvad remove OpenVPN?

Mullvad announced in 2024 that it would phase out OpenVPN, and support ended in January 2026. The stated reasoning: WireGuard is faster, dramatically smaller in code surface, and easier to audit, and maintaining two protocol stacks split engineering attention. If your network blocks WireGuard’s UDP traffic, Mullvad offers obfuscation options, but OpenVPN-dependent setups need a different provider.

Is Mullvad good for torrenting?

It permits P2P traffic and the no-logging architecture is favorable, but the removal of port forwarding in 2023 means seeding performance suffers and some private trackers’ connectability requirements can’t be met. Torrent-heavy users who need port forwarding should look elsewhere.

Why doesn’t Mullvad appear at the top of big VPN review sites?

Most large VPN review operations are funded by affiliate commissions, and Mullvad doesn’t pay any. That doesn’t automatically make ranked lists wrong, but it explains why a provider with Mullvad’s technical record routinely sits below brands with larger marketing budgets. Follow the incentive structure before you follow the rankings.