Mullvad

Mullvad removes many of the account conveniences common in consumer VPNs in exchange for collecting as little identifying information as possible. You don't provide an email address — you receive a random number. That's not a feature decision; it's what the data minimization philosophy looks like in practice.

Account creation generates a random 16-digit number — no email, phone, or name. Payment options include Monero, Bitcoin, and cash mailed to the Gothenburg office. Cure53 (2018, 2020, 2022, June 2024), Assured (October 2025), X41 D-Sec (January 2026) audits verified the no-logs architecture with published reports. In 2023 and early 2024, Swedish police searched Mullvad's offices with a court order. No customer data was seized because the system doesn't hold any. Mullvad disclosed the search publicly within days. Sweden is 14 Eyes — the structural limitation Mullvad doesn't argue away. The response is to design a system where jurisdiction doesn't matter because the data doesn't exist.

Mullvad's security stack is deliberately minimal — fewer features, each implemented more thoroughly. WireGuard isn't just a supported protocol; Mullvad's engineers contributed to its development and added DAITA, an extension that pads traffic patterns to resist correlation analysis. The depth is in what's there, not in the breadth of options.

WireGuard is the primary protocol — Mullvad contributed to WireGuard's development and integrated DAITA (Defence Against Traffic Analysis) as a WireGuard extension. OpenVPN discontinued January 15, 2026. Kill switch operates at the OS firewall level on desktop, blocking all traffic on VPN drops, enabled by default. Shadowsocks and bridge servers handle censored network environments. Mobile kill switch uses system VPN configuration rather than firewall-level enforcement — different behavior under memory pressure. Multihop available via one-click in app UI — entry and exit server selectable in settings.

Mullvad explicitly doesn't try to bypass streaming geo-restrictions. No streaming servers, no SmartDNS, no maintained platform access. This isn't a product gap — it's a design decision consistent with a minimal-footprint philosophy that treats streaming infrastructure as incompatible with what Mullvad is trying to be.

Mullvad's stated position is that maintaining infrastructure to route around streaming detection conflicts with the product's architecture. No streaming servers exist. No SmartDNS. Netflix and major platform access is not maintained or committed to. Users whose primary use case is geo-unblocking streaming content are working against Mullvad's design rather than with it.

Smaller fleet, higher per-server quality — dedicated non-virtual hardware in a focused regional footprint. In regions where Mullvad has servers, performance is strong. In regions where it doesn't, you're routing through a geographically distant server and the distance shows.

Mullvad's infrastructure is intentionally smaller than the large consumer providers — dedicated non-virtual hardware in a focused set of regions. RAM-only deployment is complete across the entire fleet as of early 2025. WireGuard is the protocol the infrastructure is built around; DAITA runs on top. Geographic coverage gaps are real: in Asia, Africa, and parts of South America, the nearest Mullvad server may be meaningfully farther than what larger networks offer. In well-covered regions, server quality and throughput are strong.

The app exposes configuration without simplifying it. Protocol selection, DAITA toggle, multi-hop setup — visible and adjustable, without a guided onboarding flow or consumer-friendly abstraction layer. Users who want to understand what's running will find the interface appropriate; users who want something invisible will find it asks more than they expected.

The interface is functional and minimal — settings presented as settings, not abstracted into use-case modes or profiles. No browser extension by design; Mullvad's position is that VPN should operate at system level, not route only browser traffic through a proxy. No TV apps. Split tunneling on Android and Linux; macOS and iOS excluded. DAITA togglable. The interface gives you access to what's running — it doesn't simplify or hide it.

Five simultaneous connections — well below the unlimited tiers, and Mullvad has no router product to extend coverage hardware-side. For households with many devices, router configuration is the only path forward. The connection limit is the binding constraint the minimal-feature philosophy doesn't resolve.

Five simultaneous connections. No browser extensions. Router guides cover Asus Merlin, DD-WRT, and pfSense for users who need to extend beyond five devices. No dedicated router firmware product. The connection limit combined with the absence of a router app makes multi-device household coverage a more involved setup than with providers offering unlimited connections or dedicated router products.

One flat rate. Every month. No introductory discount, no multi-year plan, no renewal surprise. The same amount in month one as in month 37. That consistency comes at the cost of the promotional value that makes competitors' two-year plans look cheaper — until renewal.

Mullvad charges a flat monthly rate with no variation for commitment length, no promotional pricing, and no multi-year options. No introductory/renewal gap. The monthly rate is higher than the per-month cost of a two-year promotional plan at Surfshark or PIA. 14-day money-back guarantee on card payments; cash and crypto payments excluded. No free tier. For users who want predictable billing without managing promotional cycles, the flat-rate model is genuinely unusual in a category built around introductory pricing.

The 2023 Swedish police search is the operational test that matters — court-ordered, physical office, seeking customer data. Nothing was seized. The architecture delivered what the design promised. Mullvad disclosed the event within days.

In April 2023, Swedish authorities searched Mullvad's offices under a court order seeking customer data. No data was seized — the system holds nothing retrievable. Mullvad published a description of the event within days. RAM-only deployment is complete across the entire fleet as of early 2025. No public uptime SLA. The 2023 search provides infrastructure validation that policy statements and audit reports don't achieve — real adversarial legal pressure with a documented, verifiable outcome.