Softplorer Logo

Affiliate links present. Disclosure

Mullvad

Mullvad

Privacy by minimization, with the verification gaps left visible

Choose Mullvad if minimizing account identity and reducing retained data matter more to you than a long list of consumer conveniences. Skip it if reliable streaming unblocking is a primary reason you want a VPN, or you need an unlimited-device model, or you specifically require a formal fleet-wide no-logs assurance engagement.

Fact-checked and maintained by Softplorer Research

Mullvad starts from an unusually simple privacy question: what if the VPN provider learned less about the customer in the first place? That idea runs through the account system, payment options, public code, and infrastructure. The important part is not turning that philosophy into a halo — the evidence is strong in some areas and deliberately left unresolved where the sources do not support a stronger claim.

At a glance

Best forPeople who want the VPN account itself to reveal as little identity as practical, backed by public client code and RAM-only infrastructure
Logging policyIndependent infrastructure audits explicitly checked customer-activity logging and found none in the tested relay environments, but the scope was production-alike/test servers rather than a formal fleet-wide no-logs assurance engagement. The client code is public and the app has been independently audited. The company is based in a Five/Nine/Fourteen Eyes member country, while Mullvad's published legal analysis says the VPN service is not subject to the LEK traffic-retention duty. Signup is built around a generated account number rather than an email identity. A recurring request-count transparency report is not verified strongly enough to score either way.
StreamingRecent independent testing shows a mixed picture: some services can work on some servers, but reliable broad unblocking is not something you should count on. A dedicated streaming-server or SmartDNS layer is not verified either way. Streaming support can change faster than the show you opened the VPN to watch, so this is a dated capability check rather than a forever promise.
SecurityWireGuard is the current tunnel path; OpenVPN has been retired rather than kept as a legacy fallback DAITA adds traffic-analysis resistance on top. The built-in kill switch is enabled by default. DNS leak protection is documented, and custom DNS is configurable where supported. Current anti-censorship modes include app-integrated obfuscation paths. Multihop is built into the app too.
AppsNative apps cover the main desktop and mobile platforms. There is also a Firefox-based browser extension, although it is explicitly not a replacement for the VPN app. Split tunneling is available, but not on every platform. The old quick-connect score was dropped because the source actually documented auto-connect, which is a different thing — no points for creative renaming.
GuaranteePricing is public and the direct-site monthly rate does not jump when you choose a different duration. You can pay month to month, without a discounted annual tier on the direct site. Seasonal sales are explicitly off the menu. There is no free plan. A refund window exists, but some payment methods are excluded.

Right fit if

  • Privacy-first users who prefer an account number over handing a VPN provider an email identity
  • People who value payment options that can minimize the identity trail around the subscription
  • Users who want public client code and independently audited app code rather than a closed black box

Not the right fit if

  • People buying a VPN mainly for consistently reliable access to major streaming platforms
  • Large households that specifically want an unlimited-device subscription model
  • Buyers who require a formal fleet-wide no-logs assurance engagement rather than targeted relay-infrastructure audits that also checked logging

Score breakdown

Scale reflects category fit and operational confidence — not absolute product quality.

Tap WHY to see the verdict · HOW to see the evidence

Privacy & Transparency6.7
Security Features9.0
Streaming Reliability0.0
Speed & Stability6.4
Apps & UX5.3
Device Support5.7
Long-term Value7.3
Stability & Uptime6.2

Trade-offs

  • The Swedish jurisdiction sits inside the 14-Eyes grouping, even though Mullvad's own legal analysis says its VPN service is not subject to the LEK traffic-retention duty.
  • The refund promise has payment-method exceptions, so the way you pay changes the exit route.
  • The browser extension is useful for checks and proxy routing, but Mullvad explicitly says it is not a VPN replacement.

When it breaks

  • If streaming is the whole mission, access can turn into server roulette instead of a dependable feature.
  • If your workflow depends on split tunneling everywhere, platform differences become a real constraint rather than a footnote.
  • If the household device pile keeps growing, the fixed connection model eventually becomes something you have to manage.

Hidden trade-offs

  • The Swedish jurisdiction sits inside the 14-Eyes grouping, even though Mullvad's own legal analysis says its VPN service is not subject to the LEK traffic-retention duty.
  • The refund promise has payment-method exceptions, so the way you pay changes the exit route.
  • The browser extension is useful for checks and proxy routing, but Mullvad explicitly says it is not a VPN replacement.

Sources

Building a complete privacy stack?

A VPN handles network-level encryption. Password managers and antivirus cover the gaps it can't.

Quick comparisons