Mullvad

Account numbers instead of email, a flat €5 a month, and a 2023 police search that found no customer data.

Facts checked November 2026. Sources are listed at the end.

Company
Mullvad VPN AB
Based in
Sweden
Latest audit of note
Cure53 infrastructure audit, 2024 (newer app and backend audits through 2026)
Free plan
No
Money-back window
14 days
Visit Mullvad(opens in a new tab)

Who it suits

People who want to give away as little as possible: no email or username at sign-up (you get a random account number), the option to pay in cash, and one flat price with no sales.

Less suited to: Anyone who wants a free plan, port forwarding, OpenVPN, or a refund on a cash or crypto payment.

Jurisdiction

Mullvad VPN AB is a Swedish company based in Gothenburg, Sweden.[1]

Audits

  • Cure53 · June 2024

    Mullvad's fourth infrastructure audit and its second by Cure53. It covered one OpenVPN and one WireGuard staging server, configured like production, plus the deployment code. It found one medium and one low issue, both fixed, and no way to compromise users' anonymity. This is a security audit of the servers rather than a report titled as a no-logs verification.[4]

  • X41 D-Sec · January 2026

    White-box source-code audit of the account and payment backend, carried out in late 2025. Two low and three medium findings; Mullvad says none exposed user data.[6]

  • Assured Security Consultants · August 2025 (published October 2025)

    Penetration test of Mullvad's web app: no critical, high or medium issues, and one low-severity issue, since fixed.[7]

Notable incidents and changes

  • April 2023

    Swedish police arrived at Mullvad's Gothenburg office with a search warrant to seize computers holding customer data. Mullvad says no such data existed and the officers left without taking anything.[8]

  • May 2023

    Mullvad removed port forwarding, citing abuse. Existing forwarded ports stopped working on July 1, 2023.[9]

  • November 2024 to January 2026

    Mullvad announced in November 2024 that it would drop OpenVPN, removed it from its apps in late 2025, and set January 15, 2026 as the date its last OpenVPN servers would be taken down, leaving WireGuard as its only protocol.[11]

Protocols

WireGuard only. Mullvad removed OpenVPN from its apps in late 2025 and said its last OpenVPN servers would be taken down on or before January 15, 2026. Obfuscation options include Shadowsocks, UDP-over-TCP, QUIC and Lightweight WireGuard Obfuscation.[11]

Free plan, refunds and price

No free tier. You can create an account for free, but VPN access requires payment.[3]

14-day money-back guarantee from the payment date. No refunds for cash or crypto payments; app-store purchases are refunded by the store.[1]

€5 a month on the provider's site as of November 2026, the same rate whether you pay for a month or a year, including VAT.[3]

Read the terms on Mullvad's own site before you buy.

Visit Mullvad(opens in a new tab)

Compare with

Sources (checked November 2026)

  1. Mullvad: Terms of service
  2. Mullvad: No-logging of user activity policy
  3. Mullvad: Pricing
  4. Mullvad: Fourth infrastructure audit completed by Cure53 (June 2024)
  5. Cure53: Mullvad infrastructure pentest report (2024, PDF)
  6. Mullvad: New security audit of account and payment services (January 2026)
  7. Assured: Mullvad web app penetration test (2025, PDF)
  8. Mullvad: Mullvad VPN was subject to a search warrant. Customer data not compromised (April 2023)
  9. Mullvad: Removing the support for forwarded ports (May 2023)
  10. Mullvad: Removing OpenVPN on 15th January 2026
  11. Mullvad: Removing OpenVPN from the Mullvad VPN app (December 2025)
  12. Mullvad: Introducing Lightweight WireGuard Obfuscation (November 2025)