Mullvad VPN review

The short answer

Mullvad is a Swedish VPN that has run since 2009. It asks for no email address, charges one flat price and publishes a long list of outside security audits. In April 2023 its no-data claim met a real test: police arrived with a search warrant and left empty-handed. The trade-offs are practical. You get five devices, one protocol, no port forwarding and a short refund window.

Nobody at Tunnelcheck has tested Mullvad. This review draws on Mullvad's own pages, the published audit summaries and its account of the police visit, all listed under Sources. Our methodology page explains our approach.

Who owns Mullvad and where is it based?

Mullvad is run by Mullvad VPN AB in Gothenburg, Sweden. Its about page says Mullvad VPN AB and its parent, Amagicom AB, are 100% owned by the founders, Fredrik Strömberg and Daniel Berntsson. There are no outside investors on record. The service launched in March 2009.

Sweden is an EU member, so EU data-protection law applies. Swedish police can and do serve warrants on companies there, as the 2023 visit shows. Mullvad's defense is to not hold the data in the first place.

In July 2026, Mullvad commented on a private donation that co-owner Daniel Berntsson made to a Swedish political party. Mullvad said the company and its sister companies did not take part, and that the donation was most likely a bad idea. It doesn't change how the service handles data, but readers who weigh who profits from their subscription may want to know.

Does Mullvad keep logs? What the audits say

Mullvad's FAQ says it does not store activity logs of any kind. Its sign-up model backs this up. You get a random account number instead of a username and email, and you can pay with cash, cryptocurrency, card, PayPal, bank wire or several local payment methods.

Mullvad has hired a long list of named firms to test its apps and servers. A penetration test is a paid attempt to break into a system. An infrastructure audit examines how the servers are configured. The table lists the audits we could confirm on Mullvad's own pages.

These audits test security. None is a formal no-logs assurance report of the kind some rivals buy from accounting firms. The 2020 Cure53 infrastructure audit came closest: it reported no personally identifiable information or privacy leaks. The X41 D-Sec app audit in 2024 found three high, two medium and one low-severity issue. Mullvad says it fixed the ones it could in the app, and that two traffic-analysis risks are reduced by its DAITA and multihop features. Our audit tracker puts these in context.

Security features and protocols

Mullvad now runs on WireGuard only. It began removing OpenVPN in November 2024 and set January 15, 2026 as the final date. If you rely on OpenVPN for a router or old device, check before you buy. See WireGuard vs OpenVPN for background.

• Kill switch built into the app, on by default and impossible to turn off. More in our kill switch guide.
• DAITA, a Mullvad feature meant to protect against traffic analysis, where an observer guesses what you do from the size and timing of packets.
• Multihop, which routes traffic through two servers.
• Mullvad's server list showed 570 servers in 50 countries and 91 cities on 2026-11-13. The list labels each server as owned or rented.

Mullvad's track record: the 2023 police visit

On April 18, 2023, at least six officers from the National Operations Department of the Swedish Police came to Mullvad's Gothenburg office with a search warrant. They planned to seize computers holding customer data. Mullvad says it showed them how the service works, that such data did not exist, and that a seizure would be unlawful. After the prosecutor was consulted, the officers left with nothing. Mullvad says it was the first search warrant at its offices in more than 14 years.

This is one of the few public cases where a VPN's no-data claim was tested by police on site. It doesn't prove what happens every day, but it is stronger evidence than a policy page.

Streaming and torrenting with Mullvad

Mullvad makes no streaming promises. That's a sensible default: watching another country's catalog usually breaks the service's terms, and providers block VPN addresses. Read why streaming services block VPNs.

Mullvad's terms of service don't mention P2P at all. Its one stated limit is that you can't use it to resell a similar service. Port forwarding, which lets a torrent client accept incoming connections, is gone. Mullvad stopped new port forwards on May 29, 2023 and deleted the rest on July 1, 2023. It said port forwarding had led to abuse, law-enforcement contacts, blocklisted addresses and hosting providers cancelling service.

A VPN hides torrent traffic from your internet provider. It does not make copyright infringement legal. See is torrenting illegal? and legal torrent sources.

Apps and devices

Mullvad's app is open source under the GPL-3.0 license, and the code is on GitHub. One account works on up to 5 devices, and the FAQ says you can't add more. If you need more, our router guide explains how one router connection can cover a whole home.

Price and refund

On 2026-11-13, Mullvad's pricing page showed €5 a month, VAT included. The rate is the same whether you pay for one month, one year or longer, so there's no introductory deal and no renewal jump. Mullvad gives a 10% discount for cryptocurrency payments. It shows approximate conversions, such as about $5.53, but bills in euros. Check the official pricing page for current terms.

Mullvad offers a 14-day money-back guarantee. Its terms say cash and crypto payments are not refunded. The pricing page cites anti-money-laundering rules for cash. Our VPN prices page compares checked prices.

Who Mullvad suits, and who should look elsewhere

• Suits: people who want to give a VPN as little personal data as possible, down to paying in cash.
• Suits: anyone who hates renewal price jumps.
• Look elsewhere: if you need more than five devices, OpenVPN support or port forwarding. Proton VPN and IVPN are the closest privacy-focused alternatives.
• Look elsewhere: if streaming abroad is your main reason for a VPN.

See the side-by-side in Proton VPN vs Mullvad.