Mullvad VPN Review

Mullvad is the anti-VPN VPN. Where most providers court casual users with streaming bundles, annual discounts, and influencer promo codes, Mullvad does the opposite: no email required to sign up, one flat price for everyone, no refund policy, and zero interest in whether you can watch Netflix. For people who believe privacy is binary — you either have it or you don’t — Mullvad is the answer to a question the rest of the industry isn’t even asking.

That principled stance earns it an 86/100 in our testing. Among the 22 providers we evaluated, only a handful matched its security architecture and none matched its anonymity model. But that score also reflects a real weakness: a 4/10 streaming rating that no amount of privacy excellence can offset for users whose primary goal is a different Netflix library.

This review is honest about both sides.

Category	Score
Trust & Value	26/30
VPN Performance	60/70
Overall	86/100
Star Rating	4.3 / 5

---

History & Philosophy

Mullvad launched in 2009 out of Gothenburg, Sweden — years before “VPN” was a mainstream term. The company, operated by Amagicom AB, was built on a single conviction: privacy is a fundamental right, not a feature to be packaged and sold.

That ideology shapes every product decision in ways competitors don’t match. When Mullvad decided not to require email addresses during signup, it wasn’t a marketing gimmick. It was a structural commitment: if the company never collected your email, it literally cannot hand it over to anyone who asks. Your account is a randomly generated number. You write it down. You lose it, you lose the account. Mullvad has no recovery mechanism because recovery mechanisms require identity.

The company published its transparency report documenting every legal demand it received. In 2023, Swedish police raided Mullvad’s offices. Officers left with nothing, because there was nothing to take — no logs, no session data, no user identities. That’s not a policy claim. It happened and was independently documented.

Mullvad is also one of the few VPN providers to open-source its desktop and mobile apps, submit to independent audits, and publish the results publicly regardless of what the auditors find. The 2022 Cure53 audit found minor issues. Mullvad patched them and published the report. The 2023 infrastructure audit by Assured found no critical vulnerabilities. Both reports are on their website.

Sweden sits within the Fourteen Eyes intelligence alliance, which some users cite as a concern. But jurisdiction matters less than architecture: if a provider keeps no logs and collects no identifying data, surveillance cooperation produces nothing useful. Mullvad’s no-log design has survived a live test. That’s worth more than incorporation in a “safe” country that has never been pressure-tested.

---

Security & Privacy

Mullvad’s security stack is among the most technically advanced of any commercial VPN.

Protocols supported:

• WireGuard (default, recommended)
• OpenVPN
• Shadowsocks (obfuscated, for censored networks)
• SOCKS5 proxy

WireGuard is Mullvad’s default and the right choice for most users. It is faster, leaner, and more auditable than OpenVPN. Mullvad was one of the earliest commercial adopters, implementing it before WireGuard hit version 1.0.

DAITA (Defence Against AI-based Traffic Analysis) is Mullvad’s answer to a threat most VPN providers don’t acknowledge exists. Traffic analysis can identify VPN users even when the content is encrypted — by analyzing packet sizes, timing, and volume patterns. DAITA adds random padding and artificial traffic to defeat pattern recognition. No other major VPN provider has shipped this capability.

Post-quantum cryptography is available on WireGuard connections. Mullvad implemented Kyber-1024 key encapsulation to protect against “harvest now, decrypt later” attacks — where adversaries collect encrypted traffic today, planning to decrypt it once quantum computing matures. For users with long-horizon threat models (journalists, dissidents, researchers handling sensitive data), this is meaningful protection.

Kill switch is on by default and applies at the system level, not just within the app. If the VPN drops, traffic stops. No silent fallback to the clearnet.

DNS leak protection is active on all connections. Independent tests at dnsleaktest.com confirm no leaks on both WireGuard and OpenVPN configurations.

Multi-hop (double VPN) routes traffic through two servers in different jurisdictions. This adds latency but eliminates the ability of a single server operator to correlate entry and exit traffic.

Independent audits completed:

• Cure53 — desktop app security audit (2022)
• Assured — infrastructure audit (2023)
• Cure53 — Android and iOS app audit (2024)

All reports published publicly, including findings.

Mullvad’s privacy architecture has been tested by law enforcement and held. For most providers, “no logs” is a policy. For Mullvad, it’s a verified fact.

---

Speed & Performance

Mullvad ranked #7 of 22 providers in our speed lab — strong, but not the outright fastest option available.

Metric	Mullvad	Category Leader	Our Average
Download Speed	650 Mbps	920 Mbps	430 Mbps
Latency	20ms	18ms	42ms
Packet Loss	0.1%	0.1%	0.8%
Speed Lab Rank	#7 / 22	#1 / 22	—

The 650 Mbps headline is more than adequate for any real-world use case including 4K streaming (when Mullvad can access the platform at all), large file transfers, and video calls. For most residential internet connections, Mullvad’s speed ceiling is above what the ISP can deliver.

The latency story is better than the headline speed. At 20ms average latency, Mullvad ties for the lowest reading in our dataset. Packet loss of 0.1% is also a category best. These figures matter more than raw throughput for interactive applications: gaming, video calls, remote work, SSH sessions. Mullvad behaves like a provider running modern, well-maintained infrastructure rather than an oversold network.

The limitation is server count. 800+ servers across 50+ countries is workable but modest. NordVPN runs 6,000+ servers. ExpressVPN covers more locations. When a specific Mullvad server is under load, you have fewer fallback options. In practice, Mullvad’s infrastructure is stable enough that congestion is rare — but the ceiling exists.

WireGuard is the correct protocol choice on Mullvad. In our lab, WireGuard connections averaged 22% faster than OpenVPN equivalents on the same servers.

---

Streaming

Streaming score: 4/10. This is Mullvad’s weakest category and the review has to say so clearly.

Mullvad does not optimize its infrastructure for streaming platform access. Netflix frequently blocks Mullvad exit nodes. Disney+, BBC iPlayer, and most regional streaming libraries are unreliable. This is not a configuration problem you can solve — it reflects a deliberate infrastructure priority. Mullvad’s servers are optimized for privacy, not for defeating streaming platform geo-blocks.

Streaming platform compatibility (tested):

• Netflix: Blocked on most servers (occasional access, not reliable)
• Disney+: Inconsistent, frequently blocked
• BBC iPlayer: Unreliable
• Amazon Prime Video: Partial access on select servers
• Hulu: Blocked on most servers
• YouTube: Works (not geo-restricted content)

If streaming is your primary use case, Mullvad is the wrong tool. NordVPN or ExpressVPN consistently unlock Netflix, Disney+, and BBC iPlayer with reliable infrastructure dedicated to that purpose. The honest recommendation: use a different provider for streaming.

Mullvad’s 86/100 overall score holds because streaming is one dimension among many, and its privacy performance is exceptional. But if that 4/10 streaming score is a dealbreaker for your use case, take it seriously.

---

Pricing

Mullvad charges a flat €5 per month (~$5.40 at current rates) for every user, on every plan, with no exceptions.

There is no annual discount. No two-year plan. No “get 83% off today only.” No family bundle. No referral code. One price.

Provider	Monthly Rate	Annual Rate	Savings
Mullvad	€5.00	€60.00	No discount
NordVPN	$12.99/mo	$3.99/mo	69% off
ExpressVPN	$12.95/mo	$6.67/mo	49% off
Private Internet Access	$11.99/mo	$3.33/mo	72% off
Surfshark	$15.45/mo	$2.29/mo	85% off

On a month-to-month basis, €5 is among the cheapest VPNs available. On an annual basis, it sits in the middle — cheaper than paying ExpressVPN month-to-month, more expensive than multi-year plans from budget providers.

The psychological framing matters. Providers who advertise “85% off” are anchoring against an inflated list price no one actually pays. Mullvad’s flat pricing is honest pricing. There is no dark pattern, no countdown timer, no “this offer expires in 17 minutes” pressure.

Payment methods accepted:

• Credit/debit card
• PayPal
• Cash (mailed to their office)
• Bitcoin, Monero, and other cryptocurrencies
• Bank transfer
• Swish (Sweden)

Cash and Monero payments are the most anonymous options. If you pay in cash, Mullvad has no financial record linking you to your account number. This is not hypothetical anonymity — it is operational anonymity.

No refund policy. Mullvad offers no money-back guarantee. The substitute is an unused-days credit: if you cancel partway through a month, unused days carry forward to your next subscription. You don’t lose money, but you can’t demand a cash refund on used service. Compared to the 30-day guarantees at NordVPN and ExpressVPN, this is a limitation — though one that fits Mullvad’s philosophy of not collecting the payment data a refund process would require.

---

Who Should Use Mullvad

Mullvad is purpose-built for a specific kind of user. That user is not the majority of VPN buyers.

Mullvad is the right choice for:

• Privacy purists who want zero identifying data collected, full stop
• Journalists and researchers handling sensitive sources or data where operational security is non-negotiable
• Whistleblowers and activists in environments where VPN usage itself must be concealed (Shadowsocks obfuscation helps here)
• Open-source advocates who want to audit the code they trust with their traffic
• Post-quantum threat model users who are protecting data against future decryption capability
• Cash-pays and crypto-native users who want verifiable financial anonymity
• Technical users who understand what DAITA is and why it matters
• Multi-hop users who want two jurisdictions between them and any single observer

Mullvad is probably not the right choice for:

• Users whose primary goal is streaming Netflix from a different country
• Bargain hunters looking for the cheapest annual rate
• Non-technical users who want a simple “just works” setup with customer support chat
• Users who need more than 5 simultaneous connections
• Mobile-first users — the apps are functional but not as polished as NordVPN or ExpressVPN

The honest test: if you’re choosing a VPN primarily because you want to watch a different country’s Netflix catalog, Mullvad will disappoint you. If you’re choosing a VPN because you genuinely want your traffic to be private from ISPs, governments, advertisers, and anyone else who might ask — Mullvad is one of the few providers that has structurally demonstrated it can deliver that.

---

Limitations

No provider review is complete without its limitations stated plainly.

5 simultaneous connections. Mullvad allows five devices per account. This matches the historical industry standard but falls behind providers like Surfshark (unlimited) and NordVPN (10). For a single user, five is usually enough. For a household with multiple people and multiple devices each, it may not be.

Small server network. 800+ servers in 50+ countries is workable but not impressive at scale. When a specific city server is under load, Mullvad has fewer failover options than NordVPN or ExpressVPN. In practice, performance holds well — but the lower ceiling is real.

No streaming optimization. As covered above, this is a hard limitation, not a configuration gap.

No live chat support. Mullvad offers email support only. Response times are reasonable — typically under 24 hours — but users accustomed to instant live chat will find this a step down. The absence of live chat is partly philosophical: live chat sessions require more data retention and present more surveillance surface area.

No long-term discount. For users who know they want a VPN for two years, Mullvad costs more than competitors who offer steep multi-year discounts. €120 for two years versus $80 or less from budget providers.

App polish on mobile. The iOS and Android apps are functional and audited, but the UX is more utilitarian than polished. NordVPN and ExpressVPN invest more in consumer-friendly mobile interfaces.

---

Frequently Asked Questions

Is Mullvad truly anonymous? As close as a commercial VPN can get. No email, no name, account number only. Cash and Monero payment eliminates financial linkage. Mullvad’s servers have been searched by law enforcement and produced nothing because no identifying data exists. Anonymity is structural, not just claimed.

Does Mullvad work for Netflix? Rarely and unreliably. Most Mullvad exit nodes are blocked by Netflix. If streaming is your primary use case, choose NordVPN or ExpressVPN instead. Mullvad’s 4/10 streaming score reflects this consistently across our test period.

Why is there no annual plan or discount? Mullvad’s position is that flat pricing removes dark patterns and makes the true cost transparent. They’ve stated they’re not interested in locking users in with discounts that make cancellation feel like a financial loss. Whether that’s principle or strategy, the effect is honest pricing.

What is DAITA and do I need it? DAITA (Defence Against AI-based Traffic Analysis) protects against adversaries who analyze traffic patterns rather than content. It matters if your threat model includes a well-resourced observer who knows you’re using a VPN and wants to correlate your sessions. For most users, standard WireGuard without DAITA is sufficient. For journalists, researchers, and high-risk activists, DAITA adds meaningful protection.

How does Mullvad handle the Sweden / Fourteen Eyes jurisdiction concern? Sweden is within the Fourteen Eyes alliance, which can concern users who view jurisdiction as the primary privacy metric. Mullvad’s counter-argument — supported by the 2023 police raid — is that no-log architecture matters more than geography. If there is nothing to hand over, jurisdiction is irrelevant. The raid produced nothing because nothing existed to produce.

---

The Bottom Line

86/100. Exceptional for privacy, limited for streaming.

Mullvad is not trying to be the best VPN for everyone. It is explicitly trying to be the best VPN for people who take privacy seriously as a technical and philosophical matter. By that measure, it succeeds: no email signup, no logs, audited open-source apps, DAITA, post-quantum cryptography, and a live law-enforcement test that confirmed the architecture works.

The tradeoffs are real. Streaming is genuinely weak (4/10), the server network is modest, and the flat pricing offers no long-term discount. Users who want unlimited connections, live chat support, or reliable Netflix access will be better served elsewhere.

But for privacy-first users — journalists, researchers, activists, open-source advocates, and anyone who has thought carefully about their threat model — Mullvad is one of the few providers that has earned its reputation through architecture and verified behavior, not marketing copy.

The 86/100 reflects that: a provider that excels where it chooses to compete, and is honest about where it doesn’t.

Best for: Privacy purists, journalists, whistleblowers, technical users, cash/crypto payers Not ideal for: Streamers, bargain hunters, users needing 6+ simultaneous connections