Mullvad VPN Review

Review

by the vpncomparison editorial desk · review version 4 · prose updated 2026-10-06 · facts as of 2026-10-01 · how we verify

Overview

Mullvad is a commercial VPN based in Gothenburg, Sweden, launched in March 2009 [15] and owned through its parent Amagicom AB - 100% by the two founders, Fredrik Stromberg and Daniel Berntsson, both still actively involved [15]. It is the industry's standing counter-example: one flat price of EUR 5 per month with no discounts at all [12], numbered accounts instead of email signups, and a product philosophy built on data minimization rather than promises [6]. The trade-offs are just as documented: a small fleet of 566 servers in 50 countries [13], effectively no streaming support, and no port forwarding since 2023.

Logging & privacy

Mullvad does not log user activity, and its policy survived a live test: in April 2023 Swedish police executed a search warrant at its Gothenburg offices and left with nothing to seize because no customer data existed [7]. The evidence class here is stronger than an audit: a state search with a warrant produced nothing. On top of that, the apps and infrastructure carry a long independent-audit record documented on the operator's own audit index: Cure53's fourth infrastructure audit (June 2024), Radically Open Security's third infrastructure audit, X41 D-Sec's white-box source-code audit of the payment and account API, Assured's audits of the GotaTun WireGuard implementation and the web app, plus MASA assessments via NCC Group and Leviathan Security Group [17]. Clients are open source under GPLv3 [15]. Sweden is a 14-Eyes country - jurisdiction is a real consideration, which is exactly why the architecture (numbered accounts, no email, anonymous payment) matters more than the flag [6]. There is no published warrant canary; the operator's position is that data minimization is the control. Since September 2026 the operator has also shut down its own public encrypted DNS servers and sponsors Quad9 instead - honest about why, but it moves one service outside Mullvad's own control [9].

Pricing & the renewal trap

There is no renewal trap. Every term costs EUR 5 per month including VAT: 1 month, 1 year, or 1 decade of service is priced identically, verified on the operator's pricing page [12]. Three years cost EUR 180, total, in one payment or twelve. The refund policy has honest sharp edges: a 14-day money-back guarantee covers credit card, PayPal, Google Play, Swish, and bank wire payments, but explicitly does NOT cover Apple App Store purchases (Apple handles those), cash, cryptocurrency, or vouchers [16]. Anonymous payment is real: Bitcoin since July 2010, cash by mail since September 2010, and Monero today [15]. Signup requires only a randomly generated account number - no email, no phone, no name [15].

Features & performance

The fleet is small but transparent: 566 servers in 50 countries across 91 cities on 14 hosting providers, published on a real-time status page [13]. WireGuard is the default protocol with OpenVPN as fallback, and a Bridge server type exists for censorship circumvention [13]. In November 2025 the operator added Lightweight WireGuard Obfuscation (LWO), which scrambles WireGuard packet headers to resist fingerprinting, on all desktop platforms and Android [18], complementing the existing QUIC-based obfuscation for WireGuard [19] and Shadowsocks bridges. P2P is allowed; streaming is not - the IPs are widely detected and blocked, which community threads confirm [1]. Port forwarding was removed in 2023. We have not run our own performance tests; we note the operator's claim of 10 Gbps-capable servers without verifying it.

Ownership & track record

Ownership is public and unusual: Mullvad VPN AB is 100% owned by its founders through Amagicom AB [15]. No conglomerate, no holding companies, no review-site ownership, no affiliate program to speak of [6]. The one documented controversy: in 2025 a co-owner made a private 5 million SEK donation to Orebropartiet, a populist Swedish party advocating "remigration"; the report by the weekly Flamman appeared in June 2026, Mullvad calls the donation a private matter and notes the co-owners disagree with each other, and the operator published its own statement [10]. Some customers left over it; we report the event and the company's response without imputing motives.

Censorship resistance

This is a realistic mid-tier option for censored networks: Shadowsocks bridges and UDP-over-TCP have been joined by LWO and QUIC obfuscation [18] [19], which specifically target WireGuard fingerprinting. That is materially better tooling than most commercial VPNs document. But no provider in this fleet-count class has published evidence of surviving China-class filtering; we state the tools, not a promise.

Verdict

Mullvad is the reference point for what an honest VPN looks like: flat pricing [12], anonymous payment [15], open-source clients, real audits [17], and a raid that found nothing [7]. Choose it if privacy per euro matters more than server count or streaming. Skip it if you need port forwarding or unblocking - the small fleet [13] is a real limit.

On the website

Captured by our screenshot bot from the live site (or its public archive). A capture is evidence of what the page showed at capture time - not an endorsement.

Mullvad VPN FAQ