Mullvad VPN review
VPNSwedish VPN with a flat €5/month fee and fully anonymous accounts that require no email address.
- No-logs auditIndependent infrastructure audit completed in December 2020, with no findings of personally identifiable information; the app was externally audited in 2018 and 2020, and the Android app was audited by NCC Group in March 2025. On the pages reviewed, Mullvad does not publish the name of the firm that conducted the 2020 infrastructure/no-logs audit.
- JurisdictionSweden (EU); the company maintains that Swedish law protects its users' privacy, although Sweden is part of the 14 Eyes intelligence alliance.
- Money-back window14 days
€5/month is the only plan on offer: there are no tiers or annual discounts — you simply prepay for 1, 3, 6 or 12 months at the same monthly rate.
Mullvad is a Swedish VPN that has been operating since 2009, built for people who want to pay for and use the service without leaving any personal data behind. Signing up asks for no email address or name: the system generates a numbered account, and payment can be made in cash, by card, or with cryptocurrencies such as Bitcoin or Monero. This anonymous-account policy is its most distinctive trait, but it comes with a trade-off: since there is no email tied to the account, losing the account number means there is no way to recover it, and Mullvad has no way to warn about billing issues or expiry.
Pricing is a flat €5/month across all plans, with no tiers or long-term discounts, up to 5 devices per account, and a single shared IP address (no dedicated IP option). The network covers 563 servers in 50 countries. Mullvad has had its app externally audited in 2018 and 2020, and in 2020 it completed an independent audit of its infrastructure that found no personally identifiable information, though the official pages reviewed do not name the firm that carried out that specific audit; NCC Group is named as having audited its Android app in 2025. The protocol it actively promotes is WireGuard, with traffic obfuscation and Shadowsocks support to get around blocking; the current website makes no mention of OpenVPN. Refunds are guaranteed within 14 days, except for cash or crypto payments. The company is headquartered and regulated in Sweden, an EU member state and part of the Fourteen Eyes intelligence-sharing alliance, which may matter depending on a user's threat model.
Features
- Servers
- 563
- Countries
- 50
- Simultaneous devices
- 5
- No-logs audit
- Independent infrastructure audit completed in December 2020, with no findings of personally identifiable information; the app was externally audited in 2018 and 2020, and the Android app was audited by NCC Group in March 2025. On the pages reviewed, Mullvad does not publish the name of the firm that conducted the 2020 infrastructure/no-logs audit.
- Jurisdiction
- Sweden (EU); the company maintains that Swedish law protects its users' privacy, although Sweden is part of the 14 Eyes intelligence alliance.
- Protocols
- Kill switch
- Split tunnelling
- Dedicated IP
- Pays with crypto
- Money-back window
- 14 days
IP ranges it operates
This provider appears in our autonomous system directory under these names.
Mullvad VPN
On our blog
What it really means when a VPN says it is audited
"Audited" can mean three different things — the no-logs policy, the app's code, or the server infrastructure — and none of them tells you which country's law the company operates under. Nine VPNs from...
Alternatives to Mullvad VPN
All providers
CyberGhost
Romania · 2011
Budget-priced Romanian VPN whose own site doesn't disclose its Kape Technologies ownership, though its no-logs policy is audited by Deloitte.
ExpressVPN
British Virgin Islands · 2009
VPN with RAM-only TrustedServer infrastructure and its own Lightway protocol; prioritises simplicity and speed over entry price.
IVPN
Gibraltar · 2009
Gibraltar-based VPN with a deliberately small network (58 locations in 41 countries) and annual Cure53 audits since 2019.
NordVPN
Panama · 2012
Panama-based VPN with 8,000+ servers across 225 locations and a no-logs policy audited by independent firms.