Mullvad VPN

What Is Mullvad VPN?

The VPN industry has a trust problem. Providers spend millions on influencer sponsorships and affiliate commissions, promising "military-grade encryption" and "complete anonymity" while simultaneously requiring your email address, credit card number, and sometimes even your phone number to create an account. The very act of signing up for a privacy tool requires surrendering personal data to a company you have never met.

Mullvad VPN refuses to participate in this contradiction. Founded in 2009 in Gothenburg, Sweden, Mullvad is built on a principle that most VPN companies treat as an afterthought: if you want to protect user privacy, start by not collecting user data. There is no account creation. No email. No name. You visit the website, click "Generate account number," and receive a random 16-digit number. That number is your identity on the service. Mullvad does not know — and does not want to know — who you are.

This extends to payment. While Mullvad accepts standard methods like credit cards and PayPal, it also accepts Bitcoin, Monero, and cash sent in an envelope to their Gothenburg office. The cash option is not a gimmick. It is the logical conclusion of a design philosophy that treats user anonymity as a technical architecture problem, not a marketing talking point.

Mullvad charges EUR 5 per month. There are no annual discounts, no multi-year lock-in deals, no tier upgrades, and no upsells. Every user gets the same service at the same price. In an industry where pricing pages are designed to nudge you toward 3-year commitments, Mullvad's pricing is almost aggressively simple. The company has approximately 40 employees, takes no outside funding, runs no affiliate programme, and does not pay influencers. In a market driven by marketing spend, Mullvad is funded by the quality of its product.

Key Features

Account Number System

Mullvad's account system is its most distinctive design decision. Instead of usernames and passwords tied to email addresses, Mullvad generates a random 16-digit number. You write it down or save it somewhere secure. There is no password reset because there is no password. There is no account recovery because there is no email on file. This design eliminates an entire category of data breach risk — Mullvad cannot leak your personal information because it never collected it. The tradeoff is real: if you lose your account number, Mullvad cannot help you recover it. This is privacy by design taken to its logical endpoint.

WireGuard and OpenVPN Support

Mullvad was an early adopter and contributor to the WireGuard protocol, which is now the default for most modern VPN services. Mullvad's implementation is clean and well-maintained, offering both WireGuard and OpenVPN. The company also developed DAITA (Defence Against AI-guided Traffic Analysis), a feature that pads and shapes traffic to resist AI-based traffic fingerprinting. This is a niche but technically significant feature aimed at users facing sophisticated surveillance threats.

Open-Source Clients

Every Mullvad client application — Windows, macOS, Linux, iOS, and Android — is fully open source, published on GitHub, and has been independently audited by firms including Cure53 and Assured AB. This is not "open core" with proprietary add-ons. The full application code is available for inspection. For security-conscious users and organisations, this transparency is a concrete advantage over closed-source competitors where trust is based solely on the provider's claims.

DNS and Leak Protection

Mullvad operates its own DNS servers, preventing DNS queries from leaking to third-party resolvers. The kill switch is enabled by default and cannot be accidentally disabled through the UI — a deliberate choice that prioritises security over convenience. IPv6 leak protection, DNS leak protection, and WebRTC leak prevention are all built in. The client is configured defensively: it assumes the network is hostile and acts accordingly.

Server Infrastructure

Mullvad operates servers in approximately 40 countries. This is a fraction of NordVPN's 6,400+ server network, and users in regions with sparse coverage may experience slower connections. However, Mullvad has been transparent about its infrastructure in ways competitors are not — publishing information about server ownership (rented vs. owned), hardware specifications, and the jurisdictions in which servers operate. The company has been transitioning to owned, bare-metal servers to reduce reliance on third-party hosting providers.

Pricing

Mullvad's pricing is the simplest in the VPN industry: EUR 5 per month. No annual plan. No 2-year commitment. No introductory rate that doubles on renewal. No tiers. No upsells.

This simplicity is Mullvad's pricing strategy. It eliminates the cognitive load of comparing plans, removes the regret of choosing the wrong commitment period, and means you always pay a fair price — not an inflated monthly rate designed to make the annual plan look like a bargain.

At EUR 5/month, Mullvad is more expensive per month than NordVPN or Surfshark on their 2-year plans (which drop below EUR 4/month). But it is significantly cheaper than those same providers on monthly billing (EUR 12-16/month). For users who do not want to commit to years of service with a company they have not tried, Mullvad is often the cheapest month-to-month option among reputable providers.

The value proposition is clearest for users who prioritise privacy architecture over feature breadth. You are not paying for streaming server optimisation, bundled antivirus, or password managers. You are paying for a VPN that does one thing — encrypt your traffic and protect your identity — and does it without compromise.

EU Compliance & Data Privacy

Mullvad VPN AB is incorporated in Gothenburg, Sweden, an EU member state. Sweden has strong privacy protections and a legal tradition that supports civil liberties. Mullvad operates under GDPR and Swedish law, providing users with the full set of EU data protection rights.

The company's privacy posture goes beyond legal compliance. Mullvad's no-logs policy is not just a claim — it is an architectural reality. The account number system means there is no personal data to log. The company has been subject to a law enforcement search of its offices (in 2023, Swedish police visited the Gothenburg office) and confirmed that no customer data was available to seize because none was stored. This is the difference between a privacy policy and a privacy architecture.

Independent security audits by Cure53 and Assured AB have examined both the client applications and the infrastructure. Audit reports are published publicly. For organisations with strict data protection requirements, Mullvad's combination of Swedish EU jurisdiction, minimal data collection, and audited infrastructure provides a compliance posture that is difficult to match.

Who It's Best For

Privacy-focused individuals who want a VPN provider that collects no personal information, requires no email, and accepts anonymous payment methods including cash and cryptocurrency.

Security professionals and journalists operating in environments where traffic analysis, metadata collection, and identity correlation are real threats. DAITA and the open-source codebase address needs that consumer-focused VPNs do not.

Organisations with strict compliance requirements that need a VPN provider with audited infrastructure, EU jurisdiction, and an architecture that minimises data exposure by design rather than by policy.

Users who distrust the VPN industry and want a provider that does not run affiliate programmes, sponsor influencers, or use dark patterns in its pricing — and is willing to accept a smaller feature set in exchange for genuine transparency.

The Verdict

Mullvad is not the VPN for everyone. It does not optimise for streaming. Its apps are functional rather than polished. Its server network is smaller than the industry leaders. It does not offer bundled security suites, password managers, or dark web monitoring. But Mullvad is the VPN that takes its own privacy promises seriously at an architectural level, and that distinction matters. In an industry where "privacy" is primarily a marketing term, Mullvad is the rare provider that has built a service around the principle that the best way to protect user data is to never collect it. At EUR 5/month with no strings attached, it is also one of the most honestly priced products in the category.

Frequently Asked Questions

Does Mullvad VPN require an email to sign up?

No. Mullvad generates a random account number when you visit their website. You do not need to provide an email address, name, or any personal information. You use the account number to log in and manage your subscription. This is unique among VPN providers and reflects Mullvad's privacy-first design.

How much does Mullvad VPN cost?

Mullvad charges a flat EUR 5 per month. There are no annual plans, no multi-year discounts, no tiers, and no upsells. Every user gets the same features at the same price. You can pay month-to-month and cancel at any time without penalty.

Is Mullvad VPN open source?

Yes. Mullvad's client applications for all platforms are fully open source and available on GitHub. The code has been independently audited by security firms including Cure53 and Assured AB. This transparency allows anyone to verify that the software does what it claims.

Can you pay for Mullvad with cash?

Yes. Mullvad accepts cash payments sent by mail. You place your payment in an envelope with your account number and send it to their office in Gothenburg, Sweden. They also accept Bitcoin, Monero, and standard payment methods. Cash payment provides the highest level of payment anonymity.

Is Mullvad VPN good for streaming?

Mullvad is not optimised for streaming. The company does not maintain dedicated streaming servers or actively work to bypass geo-restrictions on streaming platforms. If your primary use case is accessing region-locked content, other VPN providers like NordVPN or Surfshark are better suited. Mullvad is designed for privacy, not entertainment.