Affiliate links present. Disclosure
Mullvad
Privacy by minimization, with the verification gaps left visible
Choose Mullvad if minimizing account identity and reducing retained data matter more to you than a long list of consumer conveniences. Skip it if reliable streaming unblocking is a primary reason you want a VPN, or you need an unlimited-device model, or you specifically require a formal fleet-wide no-logs assurance engagement.
Fact-checked and maintained by Softplorer Research
Mullvad starts from an unusually simple privacy question: what if the VPN provider learned less about the customer in the first place? That idea runs through the account system, payment options, public code, and infrastructure. The important part is not turning that philosophy into a halo — the evidence is strong in some areas and deliberately left unresolved where the sources do not support a stronger claim.
At a glance
Right fit if
- Privacy-first users who prefer an account number over handing a VPN provider an email identity
- People who value payment options that can minimize the identity trail around the subscription
- Users who want public client code and independently audited app code rather than a closed black box
Not the right fit if
- People buying a VPN mainly for consistently reliable access to major streaming platforms
- Large households that specifically want an unlimited-device subscription model
- Buyers who require a formal fleet-wide no-logs assurance engagement rather than targeted relay-infrastructure audits that also checked logging
Score breakdown
Scale reflects category fit and operational confidence — not absolute product quality.
Tap WHY to see the verdict · HOW to see the evidence
Privacy pages are easy to make pretty. The useful question is whether there is anything behind the curtain you can actually inspect.
Privacy claims are easy to make. What matters is whether there are receipts: independent checks, public reports, clear ownership, and real-world evidence where it exists. A promise on a homepage is nice; something you can verify is better. No Logs Audit is only partially confirmed, so the unresolved parts stay unresolved instead of being guessed. Jurisdiction is only partially confirmed, so the unresolved parts stay unresolved instead of being guessed.
What exists
- Assured AB (2022) and Radically Open Security (2023) were explicitly asked to verify whether Mullvad logged customer activity and reported no customer-data logging in the tested relay-server environments; scope was production-alike/test servers rather than the entire live fleet
- The Mullvad VPN app source is publicly available for the supported desktop and mobile platforms
- X41 performed a penetration test and source-code audit of the Mullvad VPN app across supported platforms in 2024
- Mullvad states that, as a VPN provider, it is not considered a communications provider under LEK and is not subject to LEK storage requirements
- Bitcoin, Bitcoin Cash, and Monero are accepted
- Cash by mail is accepted
- Account creation uses a generated account number and does not require an email address
What's missing
- Sweden is included in the 14-Eyes/SIGINT Seniors Europe grouping described by Privacy International
Unresolved
- Transparency Report — not reliably verified right now
Security features are tools in a drawer: the impressive count matters less than whether the right tool is there when something goes wrong.
Here the score counts protections that are actually confirmed, then checks the awkward gaps that only show up when something goes wrong. It is less 'how many switches are in the app?' and more 'which ones matter when the Wi-Fi drops at the worst possible moment?' Leak Protection is only partially confirmed, so the unresolved parts stay unresolved instead of being guessed.
What exists
- WireGuard is the current VPN tunnel protocol
- DAITA provides traffic-analysis resistance and is supported across Mullvad VPN apps
- Desktop apps document an advanced kill switch with firewall integration
- The built-in kill switch is enabled by default and cannot be disabled
- Mullvad routes app DNS requests to its resolver, with documented exceptions such as custom DoH/DoT behavior
- In-tunnel IPv6 support is documented, but platform-specific leakage caveats remain
- Custom IPv4/IPv6 DNS can be configured in supported Mullvad apps
- The Mullvad app documents LWO, QUIC, Shadowsocks, and UDP-over-TCP anti-censorship modes
What's missing
- OpenVPN was removed from client and server side on January 15, 2026
Streaming support is a moving target. Today's green light can turn red after a service changes its blocking, so treat this like a weather report, not a wedding vow.
For streaming, we only give credit for what can be verified now. One successful Saturday night does not become a forever promise, because streaming services change the locks whenever they feel like it. Platform Unblocking is only partially confirmed, so the unresolved parts stay unresolved instead of being guessed.
What's missing
- Independent 2026 testing describes Netflix access as inconsistent rather than reliably available
- Independent tests show mixed results across major streaming platforms rather than reliable broad access
Unresolved
- Streaming Servers — not reliably verified right now
- No direct source was used to turn the absence of a guarantee list into a negative fact — unresolved
VPN speed is not one horsepower number. Your protocol, route, server, and location all get a vote.
This score is not built from one heroic speed-test screenshot. It looks at the pieces that can affect day-to-day performance and keeps anything unverified out of the victory speech.
What exists
- WireGuard is the active tunnel path across Mullvad's supported apps after OpenVPN retirement
- Mullvad funded WireGuard development in 2017
- All Mullvad VPN servers run from RAM with no persistent storage
- Servers are owned or rented dedicated hardware; rented servers are not shared
What's missing
- The fleet is a mix of owned and rented dedicated servers rather than fully owned infrastructure
Unresolved
- Server Fleet — not reliably verified right now
A VPN can be brilliant underneath and still make you hunt through Settings like you're looking for the fuse box in someone else's house.
For app experience, the useful question starts after installation: can you connect quickly, find the useful controls, and understand what a switch does without opening a support article in another tab? Native Apps is only partially confirmed, so the unresolved parts stay unresolved instead of being guessed.
What exists
- Native apps are published for Windows, macOS, and Linux
- Native apps are published for iOS and Android
- A Firefox desktop browser extension is available in beta and is explicitly not a VPN replacement
- official Mullvad VPN app for Linux includes a GUI and can be launched from the desktop app menu
- Split tunneling is documented on Windows, Linux, macOS, and Android
What's missing
- The feature is not available on iOS/iPadOS
Unresolved
- A dedicated TV app is not verified either way; absence is not inferred from the download menu — unresolved
- Connection Ux — not reliably verified right now
This is the boring category that becomes important the second your laptop has the feature and your phone does not.
Here we check where the important features really work, device by device. 'Supported' on the homepage is not much comfort if the exact button you need vanishes when you move from your laptop to your phone. Router Support is only partially confirmed, so the unresolved parts stay unresolved instead of being guessed.
What exists
- The Mullvad Browser Extension beta is available for Firefox desktop and Firefox-based browsers
- Mullvad publishes official WireGuard router setup guidance
What's missing
- The account has a fixed device cap rather than unlimited simultaneous connections
Unresolved
- A dedicated Mullvad router-firmware product is not verified either way from a direct source — unresolved
The number on the signup button is the first date, not the marriage. Renewal, refunds, and what disappears after the trial period matter later.
For value, look past the shiny first price. Renewal terms, refunds, free-plan or trial limits, and what you actually keep after the honeymoon period matter more than a giant discount badge.
What exists
- Pricing is public and uses one flat monthly rate across durations
- Month-to-month and longer top-ups use the same direct-site monthly rate
- Mullvad explicitly says it does not run Christmas or other seasonal/event sales
- One-month pay-as-you-go top-up is available
- A 14-day money-back guarantee exists for covered payment methods
- A 14-day refund window is documented for covered methods
What's missing
- The direct site keeps the same monthly rate for one month, one year, or longer rather than offering a duration-based annual discount
- Mullvad explicitly explains why it does not offer a free plan
- Cash, cryptocurrency, vouchers, and Apple App Store purchases are excluded or handled outside the normal guarantee path
Uptime is hard to verify from the outside, so a quiet week on the internet is not treated as proof. Documented infrastructure and real incident handling matter more.
This is the category where guessing gets you into trouble. If there is no solid uptime or incident evidence, it stays unresolved instead of getting a gold star because nobody complained loudly this week.
What exists
- Mullvad states that all VPN servers run from RAM with no persistent storage
- The RAM-only statement applies to all VPN servers
- Mullvad disclosed the April 18, 2023 search warrant on April 20, 2023
- The disclosure described the warrant, police action, Mullvad's response, and the outcome; a follow-up later published the authority response
Unresolved
- Server Fleet Stability — not reliably verified right now
Trade-offs
- The Swedish jurisdiction sits inside the 14-Eyes grouping, even though Mullvad's own legal analysis says its VPN service is not subject to the LEK traffic-retention duty.
- The refund promise has payment-method exceptions, so the way you pay changes the exit route.
- The browser extension is useful for checks and proxy routing, but Mullvad explicitly says it is not a VPN replacement.
When it breaks
- If streaming is the whole mission, access can turn into server roulette instead of a dependable feature.
- If your workflow depends on split tunneling everywhere, platform differences become a real constraint rather than a footnote.
- If the household device pile keeps growing, the fixed connection model eventually becomes something you have to manage.
Hidden trade-offs
- The Swedish jurisdiction sits inside the 14-Eyes grouping, even though Mullvad's own legal analysis says its VPN service is not subject to the LEK traffic-retention duty.
- The refund promise has payment-method exceptions, so the way you pay changes the exit route.
- The browser extension is useful for checks and proxy routing, but Mullvad explicitly says it is not a VPN replacement.
Sources
Building a complete privacy stack?
A VPN handles network-level encryption. Password managers and antivirus cover the gaps it can't.
Quick comparisons
© 2026 Softplorer