Mullvad Review (2026): Flat €5, No Email, WireGuard Only

Mullvad is the VPN that privacy specialists recommend to one another, and the verified record supports the reputation:

• It costs a flat €5 a month, with no introductory discounts. That was about $5.63 at the exchange rate its pricing page displayed on 5 November 2026.
• Accounts are random numbers rather than email addresses.
• Mullvad accepts cash by post.
• It has fifteen published external audits since 2018.
• A police search in April 2023 found no customer data to seize.

Even so, our score for Mullvad, shown above, is lower than that of several mainstream rivals. That is not a contradiction. The first job of this review is to explain exactly which inputs cost Mullvad points, so that you can decide whether they matter to you.

Why our score trails its reputation

Our methodology scores every provider on the same published rules. Each rule feeds one part of the score, which we call a dimension. Three of them work against Mullvad by design rather than by failure.

The first is streaming. That dimension counts the services a provider documents support for, and Mullvad documents none. It does not market itself for Netflix or BBC iPlayer, and it offers no Smart DNS. So it scores nothing in a dimension where NordVPN, Surfshark and Private Internet Access pick up points for documented claims. We have not yet tested those claims either.

The second is support. Mullvad answers by email only, and the support dimension gives most of its points to live chat.

The third is price and value. That dimension rewards the lowest effective monthly price. A flat €5 cannot compete with the $2 to $3 introductory rates on plans of two years or more. The dimension also rewards a 30-day money-back guarantee, and Mullvad’s is 14 days and excludes cash and cryptocurrency.

Within that dimension, Mullvad takes full marks for renewal honesty and payment flexibility. But the headline price still counts against it.

Two further inputs matter. Sweden is a 14 Eyes country, which earns fewer jurisdiction points than Panama, the British Virgin Islands or Switzerland.

The privacy dimension gives most weight to a recent audit explicitly scoped to the logging policy. Mullvad’s most recent audit with that scope is Assured’s server audit, concluded in May 2022. It found no logging of customer data.

The eleven audits since then cover the apps, the infrastructure, the payment system and Mullvad’s own WireGuard implementation. The security and transparency dimensions credit them. But the no-logs audit is now older than our three-year threshold.

The 5-device limit, five app platforms and a single Firefox extension also hold back the apps dimension.

None of that is a reason to avoid Mullvad. Our score is a weighted general-purpose ranking. In it, streaming, support and headline price together carry a quarter of the published weights.

If you are buying a VPN for privacy rather than for Netflix, the sections below are the ones that matter. The best VPNs for privacy page re-weights the same data for that use.

Privacy and logging

Mullvad VPN AB is registered in Gothenburg. It is wholly owned by Amagicom AB, which in turn belongs to co-founders Fredrik Strömberg and Daniel Berntsson. There is no outside parent company, and the service has run since March 2009.

Sweden is a member of the 14 Eyes, a group of countries that share intelligence. It is outside the core 5 Eyes but inside the wider arrangement, and it is an EU member state. Mullvad’s answer to jurisdiction is the same as PIA’s: keep nothing worth asking for.

The no-logging policy was last updated on 10 July 2025. It says the company never stores activity logs or metadata. It keeps no record of:

• traffic
• DNS requests
• connections or timestamps
• IP addresses
• bandwidth

The one thing it checks is the number of simultaneous connections on an account, in memory only.

An account is a randomly generated number. You need no email address, name or payment detail to create one.

Mullvad keeps only payment records and support emails. Transaction IDs are deleted after 20 days. Accounting records are kept for seven years, because Swedish law requires it. Support emails are erased after 70 days.

The policy was tested in the most direct way a policy can be. On 18 April 2023, at least six officers from the Swedish Police National Operations Department arrived at the Gothenburg office with a search warrant. In Mullvad’s words, “they intended to seize computers with customer data”.

Mullvad’s lawyers argued that no such data existed. They said the police therefore had no reason to expect to find it, and that seizing anything would be unlawful under Swedish law. Mullvad demonstrated how the service works, and the officers consulted the prosecutor. Then they left without taking anything.

Mullvad published the account on 20 April 2023. It noted that this was the first search warrant in fourteen years of operation. Our data layer records the event as low severity, because a search that yields no customer data is documented but not penalized.

Mullvad publishes no warrant canary and no transparency report. A warrant canary is a regularly updated statement that a company has not received a secret government order. A transparency report lists the legal requests a company receives. We found neither on mullvad.net on 31 October 2026, and that costs Mullvad points in the transparency dimension.

Mullvad’s position is that there is nothing to report on. If you want a running count of legal requests, look at Windscribe or IPVanish. Both publish one.

Mullvad’s audit history is one of the longest in our data set. Every report is linked from Mullvad’s blog rather than hidden behind a login. A penetration test is an attempt to break in, carried out with the company’s permission. These are the recent audits:

• X41 D-Sec, apps. Its penetration test and source-code audit of the app on all platforms ran between 23 October and 28 November 2024, over 30 person-days. It found six issues, none critical: three high, two medium and one low. It rated the app as having a high security level. The report was published on 11 December 2024.
• Cure53, infrastructure. Its fourth infrastructure audit was tested from 3 to 14 June 2024. It covered an OpenVPN and a WireGuard staging server, plus the deployment code. It found one low and one medium issue, and nothing affecting the core product. The report was published on 27 June 2024.
• NCC Group and Leviathan Security Group, Android app. NCC Group published a MASA assessment of the Android app on 27 March 2025. MASA is a security standard for mobile apps. Leviathan Security Group published a second one on 1 June 2026.
• Assured, web app and GotaTun. Assured’s audit of the mullvad.net web app was published on 23 October 2025, and all low issues were fixed. Its audit of GotaTun, Mullvad’s Rust WireGuard implementation used in the Android app, was published on 6 March 2026.
• X41 D-Sec, payment and account API. X41 D-Sec audited the payment and account API in a white-box review, published on 21 January 2026. In a white-box review, the auditors can see the source code.

These are the earlier audits:

• Cure53 and Assured audited the app in September 2018. They found seven issues and no traffic leaks.
• Cure53 audited the app again in June 2020.
• Cure53 audited the infrastructure in January 2021 and found no PII or privacy leaks. PII means personally identifiable information.
• Assured’s server audit, concluded in May 2022, found no information leakage or logging of customer data. It was published on 22 June 2022.
• Assured audited the authoritative DNS servers in September 2022.
• Atredis Partners audited the app in October 2022.
• Assured audited the account and payment services in February 2023.
• Radically Open Security audited the infrastructure in August 2023.

That is fifteen audits in all. Only ExpressVPN has more in our records.

Payment is where Mullvad is most different. It accepts:

• cash sent by post
• Bitcoin, Bitcoin Cash and Monero, with a 10 percent discount for cryptocurrency
• bank wire, cards and PayPal
• Swish, EPS, Bancontact, iDEAL or Wero, and Przelewy24
• vouchers sold by resellers

Cash or Monero to a numbered account is as close as a commercial VPN gets to a purchase that is not tied to an identity. We do not call it anonymous, because your internet provider still sees that you are connected to Mullvad.

Security features

Since 15 January 2026, Mullvad has been a WireGuard-only service. WireGuard and OpenVPN are protocols, the methods a VPN uses to build its encrypted tunnel. OpenVPN was removed from the desktop app in version 2025.14, and the last OpenVPN servers were taken down on or before that date.

The announcement of 10 December 2025 said that “WireGuard now provides the same level of obfuscation with superior security and performance”. In practice, a router or device that can only speak OpenVPN cannot use Mullvad anymore.

WireGuard itself uses ChaCha20-Poly1305, Curve25519 and BLAKE2s. Mullvad adds an optional quantum-resistant pre-shared key, negotiated with Classic McEliece 460896 and ML-KEM-1024. Quantum-resistant encryption is designed to withstand attacks from future quantum computers. You can select it in the app’s WireGuard settings on every supported platform.

A kill switch blocks your internet if the VPN connection drops. Mullvad’s kill switch is built into the app, enabled by default and cannot be switched off. That is stricter than any other provider we track.

Split tunneling lets you choose which apps skip the VPN. It is available on Windows, Linux, macOS and Android, but not on iOS.

For networks that block VPNs, there are three obfuscation methods. Obfuscation disguises VPN traffic so that it is harder to spot and block. The methods are:

• UDP-over-TCP
• Shadowsocks
• QUIC, on desktop from version 2025.9, with Android and iOS to follow

Multihop routes traffic through two Mullvad servers.

DAITA stands for Defense Against AI-guided Traffic Analysis, and no other provider offers it. An observer who can see your encrypted traffic can still see packet timing and sizes. With machine learning, they can use that to guess which sites you visit. DAITA works against this in three ways:

• It inserts random background traffic, so that activity is harder to spot.
• It sends fake packets in both directions during a page load, to distort the pattern.
• It pads every packet to a constant size.

On 31 October 2026, DAITA worked only on selected servers in Amsterdam, London, Los Angeles and New York. Mullvad’s page does not quantify the speed cost, and our lab has not measured it either.

The app has built-in DNS content blockers for ads, trackers, malware, adult content, gambling and social media. Mullvad’s public DNS-over-HTTPS and DNS-over-TLS service was due to be discontinued on 2 November 2026. Anyone still using it outside the app should move to another service. IPv6 can be enabled in the advanced settings.

Port forwarding lets other devices reach yours through the VPN. A dedicated IP is an address that only you use. Mullvad leaves out both on purpose: port forwarding was disabled on 29 May 2023, and there are no dedicated IPs.

On 31 October 2026, the server list showed 566 servers in 91 cities across 50 countries, with 14 hosting providers. Of those servers, 535 were online at the time. Every server runs from RAM with no persistent storage. Each one is either owned by Mullvad or a rented dedicated machine not shared with anyone else.

There are no virtual locations, which are servers that appear to be in one country but sit in another. The fleet is small next to NordVPN’s 7,229 servers in 150 countries. That matters if you need a particular country rather than a privacy principle.

Apps and usability

Mullvad has apps for Windows, macOS, Linux, iOS and Android. The latest Windows version is 2026.5. All of them have published source code at github.com/mullvad/mullvadvpn-app. The Android app has reproducible builds, so anyone can check that the published app matches the source code.

There is no Android TV, Apple TV or Fire TV app and no router app. Instead, Mullvad provides WireGuard configuration files for any device that supports them. It has guides for OpenWrt, pfSense, Asus Merlin and DD-WRT routers.

The Firefox extension is a leak-check and SOCKS5 proxy helper, not a VPN. There is nothing for Chrome or Edge, and no Smart DNS is offered.

An account covers 5 devices, the lowest limit among the providers we track, alongside IVPN’s Standard and Plus plans. NordVPN allows 10, and PIA, Surfshark, Windscribe and IPVanish allow unlimited connections.

Mullvad makes no streaming claims at all, so there is nothing to show in the streaming matrix. Speed is not yet tested in our lab. We have not published usability notes or screenshots. The feature matrix above comes from Mullvad’s official pages on 31 October 2026.

Support

Support is by email, at support@mullvadvpn.net. For those who want them, there is a PGP key and an onion service. A PGP key lets you encrypt your email, and an onion service is an address reached through the Tor network. A help center answers most configuration questions.

There is no live chat and no phone line. Mullvad publishes no response-time figure, and we have not measured one. For most users that is adequate, because the app rarely needs support. But it is the reason the support dimension scores low.

Plans, prices and refunds

There is one price: €5 a month including VAT. One month costs €5, one year €60 and a decade €600. On 5 November 2026, the pricing page displayed “€5 is equivalent to $5.63”. At that rate, the three terms cost $5.63, $67.56 and $675.60. The dollar figure moves with the exchange rate, and your card issuer’s rate will differ slightly.

Nothing renews at a higher price, because nothing was discounted in the first place. Mullvad states that it never holds sales or holiday discounts. So any page that promises a Mullvad coupon is wrong.

Cryptocurrency payments get 10 percent off. There is no free tier and no trial. Our Mullvad pricing page keeps the price history, which so far is a straight line.

The 14-day money-back guarantee applies to card, PayPal, Google Play, Swish and bank wire payments. It excludes cryptocurrency and cash. In Mullvad’s words: “We can’t make refunds for cash payments due to anti-money laundering regulations”.

Apple refunds App Store purchases, and voucher refunds go through the reseller. To claim a refund, email support with your account number and the payment reference. Bank-wire refunds are possible only for SEPA payments within Europe.

Mullvad runs no affiliate program. An affiliate program pays a site when its readers buy through its links. We earn nothing when you buy Mullvad, and any button on this page sends you to mullvad.net without a tracking link.

That has no effect on its score, which we compute from the same data fields as every other provider. The how we make money page explains the rule.

Who it is for and who should skip it

Mullvad is for people who want the VPN to know as little as possible about them. That includes:

• journalists and their sources
• people in sensitive professions
• Linux users
• Monero and cash payers
• anyone who has read the audit reports and wants a long, public audit record

It is also the right choice if you dislike introductory pricing and renewal surprises, because Mullvad has none.

Skip it if:

• you want a VPN for streaming on a smart television. Mullvad has no streaming claims, no Smart DNS and no TV apps.
• you need more than 5 devices
• you want live chat
• your router or device only supports OpenVPN
• you need port forwarding or a dedicated IP
• a 14-day refund that excludes cash and cryptocurrency is too short for you

Our ranked reviews page shows where that leaves Mullvad in the general ranking today.

Alternatives

Proton VPN is the closest match for a privacy-first buyer who also wants streaming claims, 10 devices and a free tier. It has Swiss jurisdiction, open-source apps and yearly Securitum no-logs audits. It costs $3.49 a month on its 24-month Plus plan, or $83.76, renewing at $83.88 a year. Our Mullvad vs Proton VPN comparison sets the two side by side.

NordVPN is the mainstream alternative. It has Panama jurisdiction, six no-logs engagements, 7,229 servers, streaming claims for the main US services and 24/7 live chat. It costs $3.49 a month on a 27-month plan that renews at $139.08 a year. See Mullvad vs NordVPN.

IVPN is the other provider in our data with no affiliate program, open-source apps, cash and Monero payment and no streaming claims. It is based in Gibraltar and costs $5 a month on its yearly Standard plan, or $60, with a 30-day refund.

Private Internet Access keeps port forwarding, which Mullvad dropped in 2023. It runs open-source apps on unlimited devices, under US law and Kape ownership. It costs $2.03 a month for 40 months, or $81.20, renewing at $81.20 every three years.

Windscribe offers a free tier, post-quantum WireGuard and a flat $69 a year. The free tier gives 10 GB a month if you confirm your email and stay subscribed to its promo emails. Windscribe is based in Canada, has no no-logs audit and gives a 7-day refund.

How we verified this review

We read every price, plan, refund term, server count, protocol and feature on this page from Mullvad’s official pages on 31 October 2026. These were the pricing, servers, VPN features, download and help pages. We checked the prices again on 5 November 2026.

Each of the fifteen audits is dated by the publication date of Mullvad’s own announcement. The April 2023 police search is sourced to Mullvad’s statement of 20 April 2023. The OpenVPN removal date comes from Mullvad’s announcement of 10 December 2025, and the DAITA description from its DAITA page.

We have not run speed or streaming tests. So speed is left out of the score, and no streaming support is recorded. The data record behind this page is public.