Signing up, for instance, is as simple as clicking a button to generate an account number. The website creates a unique account number for you, and you're done. Mullvad doesn't need your email address, your name, country, phone number or any personal details at all - the account ID is enough.
The company goes on to recommend that you pay via cash, Bitcoin or Bitcoin cash, which ensures it would know almost nothing about you. (If that's a step too far, you can pay as usual via card, PayPal, bank transfer or Swish.)
- Want to try Mullvad? Check out the website here
Mullvad's core service is powerful, up-to-date, and absolutely stuffed with high-end technologies. It only uses OpenVPN and Wireguard protocols, for instance. There's industrial strength encryption (AES-256 GCM, 4096-bit RSA certificates with SHA512, perfect forward secrecy.) There are multiple layers of DNS and IPv6 leak protection, you get multiple stealth options to bypass VPN blocking, port forwarding support is built in, and the list goes on.
The company has its own client for desktops (Windows, Linux, Mac). Unusually, this is open source, so developers who are suspicious about Mullvad's motives, or just curious about the quality of the code, can check it out for themselves.
Mullvad doesn't have any mobile clients, but there are tutorials on the support pages explaining how you can set it up on Android, iOS and other devices.
The network is a reasonable size, with multiple locations across 36 countries (Mullvad has servers in 30 cities in the US alone), and there's support for connecting up to five devices simultaneously.
Pricing is a little unusual, as although there are multiple subscription lengths (1, 2, 3, 4, 6 and 12 months) they're all identically priced at 5 Euros ($5.65, £4.44) a month. But once we'd got over our mild disappointment at the lack of any discounts, this didn't seem so bad.
If you sign up for monthly billing, the 5 Euro cost is competitive with many annual VPN plans. And the fact that Mullvad isn't trying to tie users into long-term contracts seems like a positive indicator overall. If the company knows that many of its customers can leave at any time, you can be sure they'll make real efforts to keep them happy.
Figuring out a VPN's logging policy is often a real challenge, but again, Mullvad is different, spelling out the fine detail in an excellent policy page.
The key point is that nothing is logged that can be connected to a specific account. No traffic, DNS requests, IP addresses, not even connection times, dates or bandwidth used.
Mullvad explains that it monitors the current number of connections to each account, to ensure no-one can use more than the five allowed. But this isn't saved, so there's no way to tell how many you were using five months, weeks, or even minutes ago.
The end result of all this is you don't have to worry about how Mullvad handles court requests to access your usage data, because, well, there isn't any.
But, when a company gives us this level of detail on its procedures, and provides very real privacy advantages elsewhere (no need to hand over your email address, open-source desktop client), these are very positive signs. Audit, or no audit, we think Mullvad looks far more trustworthy than most of the competition.
Getting started with Mullvad is as easy as generating an account number and buying some time (cards, PayPal, Bitcoin and others are supported). The website presents this clearly, and gives you far more control than we usually see. You're not signed up to a PayPal subscription without realizing, for instance - there are separate options to make a one-off payment, subscribe, or end an existing subscription.
A comprehensive Download page prompted us to download the Windows client, but also included links to the Mac and various Linux clients, along with setup guides and Android, iOS and more.
We grabbed and installed the Windows client in a few seconds. We activated it by entering our account number (Mullvad doesn't require usernames or passwords) and it was ready to go.
The Windows client has a basic interface, just a fixed panel that appears when you click its system tray icon and disappears if you click anywhere else. That's a minor issue for us, as it means you can't leave the window open on your desktop as a reminder of your VPN location or connection state. (The system tray icon is always visible and shows green when you're protected, red when you're not, but doesn't give you any details on your location.)
The panel includes a map displaying your location, the name of your preferred VPN location, and a Connect button. This works, but it's not very well presented. The map is just a static image, with no options to zoom or pan around. And depending on your map position, various place and country names can overlap with the transparent Connect button and connection status, occasionally leaving a jumbled mess of text.
(These hassles won't happen on every platform or every device, and they're not directly Mullvad's fault. The company has built its client as an Electron app, essentially a repackaged and customized version of the open-source Chromium browser. The advantage is that it can easily be made to run on multiple platforms. The downside is that because the interface is just a web page, it's not as easy to control as if the client was a native app.)
We tapped Connect, and the client did better, with the map smoothly panning to our new location, quickly connecting, then displaying its connection details (country, server name, incoming and outgoing IP address.)
Switching servers was easy, too. There's no need to close the current connection, first-- just choose a new location, while you're still connected, and the client will switch within seconds. What's really interesting here isn't just that Mullvad is trying to save you a couple of clicks; it's what happens underneath.
With most VPN apps, if you choose a new server while you're connected to another, the app simply closes the existing connection and opens a new one. Sounds obvious, right? But it means that in the time between disconnecting from server #1 and connecting to server #2, you're exposing your real IP address. That's only for a few seconds, but we suspect many users wouldn't realize that, so it remains a problem.
When we switched servers with Mullvad, that didn't happen. We saw no sign of any IP leaks when switching from one location to another. That's very good news, as it suggests Mullvad understands and is addressing common VPN app issues that many providers don't even realize exist.
The client has a scattering of settings, including basic protocol choices (OpenVPN UDP or TCP), the ability to launch with Windows, and switches to enable or disable IPv6 protection and a kill switch. That's not a lot of configurability, but it's probably enough for the average user.
The client has one other unusual extra in a very flexible command line interface, which enables building scripts to tweak settings, connect to your chosen locations, view status or disconnect automatically. That'll be way too much hassle for most people, but if you want to do something advanced, perhaps create a script which automatically connects to Mullvad before launching a specific app, it could be very helpful.
Our testing began with a close look at Mullvad's kill switch. We forcibly closed our OpenVPN connection in various ways, but the client handled each situation perfectly: it immediately displayed a 'Reconnecting' message alerting us to the problem, blocked our internet connection to prevent any IP leaks, and followed up with a 'Secured' notification, seconds later, when the connection was re-established.
Mullvad is more focused on privacy and security than unblocking every website in the world, so we weren't surprised to find that it didn't get us into US Netflix. We were able to get into US YouTube and BBC iPlayer, though, which is better than some of the competition.
The service scored full marks in our privacy tests, with the Windows client successfully blocking DNS and WebRTC leaks.
The positive note continued to the end, with our performance tests showing excellent download speeds of 66-68Mbps in the UK and 50-60Mbps in the US. Many VPNs make little bandwidth available outside of the US and Europe, but that doesn't seem to be the case with Mullvad, so for example we averaged more than 45Mbps from Brazil and 30Mbps from India.
Mullvad's desktop clients have a basic interface and you must set up mobile devices yourself, but otherwise there's a lot to like here: you can open an account without handing over any personal data, speeds are excellent, and a top-quality VPN engine protects your privacy at all times.
- We've also highlighted the best VPN of 2019