Mullvad

The full audit

What you actually get

Mullvad is the VPN industry’s outlier by design. Built by the founder-owned Amagicom AB in Gothenburg, Sweden and launched in 2009, it has spent 17 years refusing the things that define its competitors: tiered pricing, affiliate commissions and streaming-unblock marketing. That refusal isn’t a gap in the product — it is the product, and it’s worth saying up front that Mullvad runs no affiliate program and won’t pay for reviews, so a site like PixlRun earns nothing from recommending it. This page is a pure trust play; take the recommendation exactly as seriously as the evidence behind it warrants.

The radical privacy model

Signing up requires nothing personal. You click “generate account,” receive a random account number, and that number is your entire identity — no email, no password, no recovery flow (lose the number and the account is gone). Payment can be cash mailed in an envelope, Bitcoin or Monero at a 10% discount, or card and PayPal with a 14-day refund window that, honestly, excludes the cash and crypto options. Almost no competitor offers this degree of payment and identity anonymity. The trade-off is on you: there’s no account-recovery safety net, so the burden of not losing that number is real.

Security & encryption

Since 15 January 2026 Mullvad has run WireGuard exclusively, having fully retired OpenVPN. Its standout feature is DAITA — Defense Against AI-guided Traffic Analysis — now in its second version: it pads every packet to a constant size and injects randomized dummy traffic so machine-learning fingerprinting can’t read your metadata even through an encrypted tunnel, and it’s built on the open-source, peer-reviewed Maybenot framework. Around that sit an always-on kill switch that genuinely can’t be disabled, an optional Lockdown Mode, app-level split tunneling on Windows, Android and Linux, and multihop routing. It’s a lean toolkit by modern standards, but every item in it serves the same single goal: leaving as little trace as technically possible.

The jurisdiction nuance

This is the fact reviewers most often get wrong. Sweden is a 14-Eyes member, which sounds alarming, but Sweden’s data-retention law (LEK) has been confirmed not to apply to VPN providers, so Mullvad carries no domestic obligation to retain any data. That was tested for real: in April 2023, Swedish police arrived at the Gothenburg office with a seizure warrant and left empty-handed, because the systems simply held nothing to take. The 14-Eyes label is a legitimate nuance, but the raid is the more informative data point.

In 2023 Swedish police raided the office with a warrant — and left with nothing to take.

Speed & network

The network is smaller than the giants’ — roughly 600 servers across around 50 countries — and Mullvad deliberately avoids the virtual-server sprawl that pads some competitors’ country counts. Both figures fluctuate and are best read as approximate. In practice WireGuard keeps real-world speeds competitive, and the layered privacy features cost less throughput than you might expect. On top of that sit 11 published audits from Cure53, Assured AB and X41 D-Sec between 2018 and 2026 — one of the most verified privacy postures anywhere. Fewer servers also means Mullvad can vouch for each one; there’s no sprawling rented fleet whose physical security it can’t actually attest to.

Streaming — not the point

Streaming is deliberately not part of the pitch. Netflix unblocking is inconsistent, and port forwarding was removed in 2023 in the name of anonymity, which further limits some use cases. If region-hopping streaming libraries is your goal, this simply isn’t the tool — and, refreshingly, Mullvad says as much itself rather than overpromising.

Flat-rate pricing

Pricing is the anti-NordVPN. It’s €5 a month, always — the same whether you pay for a single month or ten years — with no ladder, no seasonal sale and no teaser rate that balloons on renewal. Crypto payment shaves 10% off. Combined with the public refusal to run an affiliate program or pay influencers, the pricing is unusual enough to be newsworthy, and it’s the reason this recommendation comes with no commission attached. In a category where nearly every recommendation is quietly monetized, that absence is itself a kind of proof of intent.

Who should buy

Buy Mullvad if you’re a journalist, activist or anyone who wants to pay with cash or crypto and never hand over a real identity — on provable privacy, almost nothing beats it. Skip it if you want reliable streaming, if you have a large household straining against the five-device cap, or if you expect 24/7 live chat and a long checklist of extra features. Mullvad does a narrow thing extraordinarily well, and it’s honest about the rest.