Mullvad VPN review
Mullvad suits privacy-minded developers who value account privacy, public security reports and predictable pricing. Watch the lack of port forwarding if you need inbound connections to services running behind the VPN.
How we make money: links may become affiliate links, but our scoring code never sees commissions, and most providers listed pay us nothing.
Score breakdown
One formula for every commercial vpn, explained on how we score VPNs.
Plans and the true 3-year price
| Plan | Term | Monthly | Renews at | 3-year cost | Devices |
|---|---|---|---|---|---|
| 1 month | 1 month | €5 | €5 | €180 | 5 |
| 1 year | 1 year | €5 | €5 | €180 | 5 |
| 1 decade | 10 years | €5 | €5 | €180 | 5 |
Providers change prices often, and we regularly verify prices against their own pricing pages, though small differences from current prices are possible. Prices checked 11 Oct 2026. Refund window: 14 days.
Who it's for
Pick it if
- You want account-number login without an email address.
- You value public audits with clearly defined scopes.
- You need Linux apps and WireGuard configuration export.
- You prefer flat pricing without a renewal increase.
Skip it if
- You need port forwarding or a dedicated IP.
- Your main goal is private access to your team's machines.
Audit evidence
| Date | Auditor | Type | Scope | Report |
|---|---|---|---|---|
| 1 Jun 2026 | Leviathan Security Group | App / client | Android app (2026.2, re-tested on 2026.3-beta3) assessed against the App Defense Alliance MASA mobile app profile; passed after minor fixes. | Public report |
| 6 Mar 2026 | Assured Security Consultants | App / client | Source-code review of GotaTun v0.2.0, the WireGuard implementation used in the Android app (excluding DAITA, the CLI and external dependencies); two low-severity issues. Testing 2026-01-19 to 2026-02-15. | Public report |
| 21 Jan 2026 | X41 D-Sec GmbH | Other | White-box source-code audit of the payment and account API and supporting backend (authentication, device provisioning, payments, WireGuard key distribution); three medium and two low findings. Performed late 2025. | Public report |
| 23 Oct 2025 | Assured | Other | Security assessment of the website web app; no critical, high or medium issues, one low-severity input-validation issue fixed. | Public report |
| 19 May 2025 | Assured | App / client | Protocol and source-code audit of the Mullvad VPN loader (desktop installer/downloader for Windows and macOS). | Public report |
| 27 Mar 2025 | NCC Group | App / client | Android app (2024.9) black-box MASA Assessment Level 2 under the App Defense Alliance; passed all controls with no fixes needed. | Public report |
| 11 Dec 2024 | X41 D-Sec | App / client | Penetration test and source-code audit of the VPN app on all supported platforms (30 person-days, 2024-10-23 to 2024-11-28); three high, two medium, one low finding. | Public report |
| 27 Jun 2024 | Cure53 | Infrastructure | White-box audit of one OpenVPN and one WireGuard server in the staging environment plus the Ansible deployment code, with focus on anything affecting privacy (2024-06-03 to 2024-06-14); one medium, one low finding. | Public report |
| 9 Aug 2023 | Radically Open Security | Infrastructure | Audit of two RAM-only VPN servers (one OpenVPN, one WireGuard): internal and external setup and whether customer activity is logged; no logging of user activity found. Concluded mid-June 2023. | Public report |
| 16 May 2023 | Assured | Other | Penetration test of the Leta search service web application (2023-03-27 to 2023-03-31). | Public report |
| 17 Feb 2023 | Assured | Other | Penetration test of the account and payment services API (2022-11-07 to 2022-11-29); no critical, high or medium issues. | Public report |
| 21 Oct 2022 | Atredis Partners | App / client | Penetration test and source-code audit of the VPN app on Windows, Linux, macOS, Android and iOS; some traffic-leak edge cases found and fixed. | Public report |
| 14 Sept 2022 | Assured | Other | Audit of the self-hosted authoritative DNS servers against best practice before production (concluded May 2022). | Public report |
| 22 Jun 2022 | Assured | Infrastructure | Audit of three freshly installed VPN servers (two WireGuard, one of them diskless, and one OpenVPN); no information leakage or logging of customer data found. Concluded May 2022. | Public report |
| 3 Mar 2021 | Assured | Other | Audit of the public DNS-over-HTTPS / DNS-over-TLS service servers (beta launch). audit dates not stated in the post. | Public report |
| 20 Jan 2021 | Cure53 | Infrastructure | First security-focused infrastructure audit (completed December 2020); no personally identifiable information found, six vulnerabilities from informative to high. | Public report |
| 25 Jun 2020 | Cure53 | App / client | Audit of the VPN app on all five platforms (May-June 2020, six testers over 20 days); seven security-relevant items, most severe rated medium. | Public report |
| 24 Sept 2018 | Cure53 and Assured | App / client | Audit of the VPN app version 2018.2 (eight testers, 18 days); seven issues, none remotely exploitable, no traffic leaks found. | Public report |
Ownership
- 2023 Police officers visited the company office with a search warrant to seize computers holding customer data; per the provider no such data existed and they left without taking anything.
Security and features
- WireGuardYes
- RAM-only serversYes
- Full-disk encryptionUnknown
- Post-quantum optionYes
- Open-source appsYes
- Kill switchYes
- Split tunnellingYes
- Multi-hopYes
- Port forwardingNo
- IPv6Yes
- WireGuard config exportYes
- SOCKS5 proxyYes
- Custom DNSYes
- Linux app (GUI)Yes
- Linux CLIYes
- Dedicated IPNo
Network Provider-reported
- Servers566
- Countries50
Account and payment privacy
- Sign up without emailYes
- Account-number loginYes
- CashYes
- MoneroYes
- BitcoinYes
Our take
Mullvad's privacy case rests on inspectable evidence. Radically Open Security examined RAM-only VPN servers and found no logging of user activity within that scope; its public report was announced on 9 Aug 2023. More recently, Leviathan Security Group assessed the Android app against the App Defense Alliance MASA mobile app profile, which it passed after minor fixes. That public report was announced on 1 Jun 2026. The distinction matters: an app assessment tests client security, while a server audit can examine activity logging. Read the reports for their boundaries, rather than treating the audit list as a blanket privacy guarantee.
Mullvad VPN AB is owned by Amagicom AB, with no larger ownership group identified. That gives you a straightforward ownership chain to assess, although independence alone cannot establish how a service handles data. Account-number login without email and payment by cash or Monero give you practical ways to limit the personal details attached to an account. The office search in 2023 adds relevant evidence: according to Mullvad, officers seeking computers holding customer data left without taking anything because that data did not exist. This remains the provider's account of the event, rather than an independent audit conclusion.
The 1 month option starts at €5 a month and renews at €5 a month. The 1 year and 10 years options carry the same monthly rate, so a longer commitment brings no rate reduction. Across our comparison window, their respective costs are €180, €180 and €180. Those totals should not be confused with the upfront payment for a longer term. We would start with the shorter commitment unless prepaying serves a specific need. The refund window is 14 days, and support is by email.
Against alternatives such as IVPN and Proton VPN, Mullvad earns a place on your shortlist when account privacy and configurable clients matter most. Open-source apps, a Linux GUI and CLI, WireGuard configuration export, custom DNS and multi-hop give developers useful control over their connections. The practical boundary is inbound access: there is no port forwarding or dedicated IP. If your small team's main task is reaching its own machines, a commercial VPN subscription does not establish that access on its own. Our private access comparison helps separate that requirement from choosing a provider for outbound VPN traffic.
FAQ
Can I use Mullvad without an email address?
Yes. You sign in with an account number, and cash or Monero payments let you avoid attaching card details to the purchase.
What evidence supports Mullvad's logging claims?
Radically Open Security examined RAM-only VPN servers and found no logging of user activity within the audited scope; the public report was announced on 9 Aug 2023. That supports a bounded conclusion about the systems examined, rather than a guarantee covering every system indefinitely.
Is Mullvad useful on Linux?
Mullvad offers both a Linux GUI and CLI, alongside WireGuard configuration export. That makes it a practical candidate whether you prefer an app or want to configure a compatible client yourself.
Can I use Mullvad to reach my home server?
Mullvad does not offer port forwarding or a dedicated IP, so it is a poor fit if you need inbound access through the provider. For private access to your own machines, assess a tool designed for that purpose separately.
Does Mullvad get cheaper if I pay for longer?
The listed 1 month, 1 year and 10 years options have the same monthly rate. The shorter option starts at €5 a month and renews at €5 a month, so committing for longer offers no rate saving.