Mullvad is a Swedish-based VPN which doesn't just talk about protecting your privacy – the provider actually does something about it.
The company doesn’t ask for your email address, name or any personal details to sign up, for instance. Just click a button to generate a unique account number, and you’re done.
You can pay via cash, Bitcoin or Bitcoin cash, ensuring the company knows almost nothing about you. (Although if it’s more convenient, you can pay as usual via card, PayPal, bank transfer or Swish.)
Mullvad's core service is absolutely stuffed with privacy-friendly technologies. It only uses OpenVPN and WireGuard protocols, for instance. There's industrial strength encryption (AES-256 GCM, 4096-bit RSA certificates with SHA512, perfect forward secrecy). There are multiple layers of DNS and IPv6 leak protection, you get a variety of stealth options to bypass VPN blocking, port forwarding support is built in, and the list goes on.
- Want to try Mullvad? Check out the website here (opens in new tab)
The network is a reasonable size. Mullvad may 'only' have 800 servers (NordVPN has a massive 5,400+), but they're P2P-friendly and well spread across 67 locations and 38 countries.
The company has its own apps for Windows, Mac, Android, iOS and Linux, as well as a Firefox extension, and you can connect up to five devices simultaneously.
Not sure if you can trust what these apps are doing? It's generally smart to be skeptical, but Mullvad is more transparent than most. Not only are its apps open source, so anyone can check the code, but they're also externally audited.
Pricing is extremely simple at €5 ($5) a month (opens in new tab), and, well, that’s it. No discounts for long-term contracts, no doubling of the price at the end of the first term; it’s just €5 a month. That's half the price you'll pay for monthly billing with some providers, and cheaper than many annual plans. Even better, Mullvad offers a 10% discount if you pay by cryptocurrency.
If you're happy to sign up for longer, though, there's a lot of money to be saved elsewhere. Private Internet Access is only $2.03 a month for the first term of its three-year plan, for instance, a fraction of the price.
Mullvad scores a plus for its refund procedure, though. Not only is there a 30-day money-back guarantee, but it can also refund Bitcoin payment in some situations. There are potential complications (the refund help page (opens in new tab) has more), but it's still better than the blanket 'no Bitcoin refunds' we see with most providers.
Privacy
Figuring out a VPN's logging policy is often a real challenge, but again, Mullvad is different, spelling out the fine detail in an excellent policy page.
There’s no logging of connection times, IP addresses, DNS requests, traffic, or anything else that can be used to link an action back to a specific account, the company explains.
Mullvad backs up its privacy claims with a 2021 infrastructure audit (opens in new tab), and a 2022 VPN server audit (opens in new tab), neither of which found any sign of logging or leaks.
The company provides its own authoritative DNS servers for an extra privacy guarantee, and – you’ve guessed it – that recently passed an independent audit (opens in new tab), too.
We could mention the comprehensive 2020 Cure53 audit (opens in new tab) of its (already open source) desktop and mobile apps, but, well, you get the picture. Mullvad isn’t asking you to take what it says entirely on trust: there’s detailed and independent evidence freely available for anyone to check out.
Setup
Getting started with Mullvad is as easy as generating an account number and buying some time (cards, PayPal, Bitcoin and other payment methods are supported, as mentioned).
A comprehensive Download page (opens in new tab) pointed us to the Windows client, but also included links to the Mac, Linux, iOS and Android apps, the latest beta release, the Firefox extension and Mullvad's WireGuard and OpenVPN configuration files.
We grabbed and installed the Windows client in a few seconds. We activated it by entering our account number (Mullvad doesn't require usernames or passwords) and it was ready to go.
Interface
While some VPN’s apps look and feel very different across all platforms, Mullvad takes a more unified approach. Whether you're using Windows or Android, Mac or iOS, or indeed Linux, each app is almost identical, with little more than a few settings varying between versions.
The apps look good, with a colorful panel, a map highlighting your current location, and a 'Secure my connection' button.
Tapping the location name lets you choose another from a list of countries and cities. This is surprisingly basic, with no ping times, server load indicators, search box or Favorites system to help group commonly-used locations.
What you do get, oddly, is the ability to filter by server providers. Are Mullvad customers really more interested in viewing only M247 or Leaseweb servers than, say, listing all the locations in Asia, or saving Favorites of their own? Really?
The apps don’t have a ‘Fastest’ option to automatically select your nearest server, either – you must select it yourself.
Whatever location you choose, Mullvad doesn't waste time getting you connected. WireGuard took maybe a couple of seconds, and even OpenVPN was ready to go in around 6-8 seconds, less than half the time we see with some apps.
Features and settings
Mullvad’s apps may look small and simple, but there’s a surprising amount of functionality lurking underneath.
Mullvad doesn’t just have a single ad-blocking feature, for instance. The desktop and iOS apps allow you to separately block ads, trackers or malware, and (new to the desktop since our last review) can filter out adult or gambling-related content, too.
Other VPNs claim similar technology, but rarely tell you anything about what it is, or how it works. As usual, Mullvad is way more transparent. The company’s Github site (opens in new tab) lists all the blocklists it uses, and you can even view them, see which sites it blocks, and which it doesn’t.
Desktop and Android support for Split Tunneling enables specifying apps which won't use the VPN. That’s good news for not-so-sensitive apps which don’t work properly when the VPN is active (streaming services for your own country, for instance).
Multi-hop VPN is another desktop and Android feature which sees your connections routed to one Mullvad server first, exiting the VPN from another server. This function works well, but it's difficult to find. You won't even know it exists unless you browse the OpenVPN Settings and enable Bridge Mode (and, no, we wouldn't think to do that, either).
Most app settings are more straightforward, though. You can opt to launch the app and/or connect when your device starts; enable or disable notifications; turn on a kill switch to block internet traffic if the VPN drops; and use a custom DNS server.
It's a more configurable setup than many apps, although there are a few features missing. In particular, we'd like the ability to automatically connect when accessing particular networks or network types. But even here, Mullvad has a decent argument why you’re better off without this – the company suggests the feature is a security risk because hackers could set up a network with the same name and your device might connect automatically.
The desktop apps have one other unusual expert-level extra in a very flexible command line interface (opens in new tab), which enables building scripts to tweak settings, connect to your chosen locations, view status or disconnect automatically. That'll be way too much hassle for most people, but if you want to do something advanced – perhaps create a script which automatically connects to Mullvad before launching a specific app – it could be very helpful.
Support
If Mullvad isn't delivering the service you need, its web Help Center (opens in new tab) aims to get you up and running again. There's a decent amount of content here, most of it providing genuinely useful information, but it doesn't begin to match the likes of ExpressVPN or NordVPN.
The articles aren't well organized, for instance. The Help Center doesn't display the articles you're most likely to need first, either in its opening screen or when you run a search. You might have to hunt for the information you need, and even if you find it, articles often assume a high level of technical knowledge.
There's no live chat support, either, but Mullvad does allow users to contact support from within its apps or via email. We asked a question and got a friendly and helpful reply (far better than the website) within 90 minutes. That can't compete with the two or three minute wait we typically see with live chat from the top providers, but it's also far better than the 12+ hours we'll often be left waiting elsewhere, and overall Mullvad offers an acceptable level of support.
Testing
Our performance testing began with a close look at Mullvad's kill switch. We forcibly closed both OpenVPN and WireGuard connections in various ways, but the app handled each situation perfectly: it immediately displayed a 'Reconnecting' message alerting us to the problem, blocked our internet connection to prevent any IP leaks, and followed up with a 'Secured' notification, seconds later, when the connection was re-established.
Mullvad’s website doesn’t make any big claims about unblocking Netflix or anything else, and our tests very clearly showed why. Not only did the service fail to get us into Netflix in the US, UK, Australia, Canada and Japan, it couldn't unblock BBC iPlayer, Amazon Prime Video or Disney Plus, either.
We had better luck with some regional services – Mullvad unblocked the UK’s ITV and Australia’s 9Now, though it also failed with Channel 4 and 10 play – so there’s a chance it’ll have some value for you. But most providers deliver far better unblocking results.
It’s a very different story with privacy. We checked Mullvad’s desktop and mobile apps for DNS leaks using DNSLeakTest.com, DNSLeak.com and other testing sites, for example, but they proved leak-free in every situation.
Mullvad claims built-in ad, tracker and malware blocking, but how effective is it? We found the service blocked an impressive 116 out of 150 common trackers (most VPNs manage 80-110). It kept us away from 1,544 out of 1,650 malicious websites, too, an excellent result.
The Blacklight tool scans websites for integrated trackers from Google, social media and other sites. Most VPN provider sites have 1-5 of these, but Mullvad has none, zero, nothing at all.
Android app scanning site εxodus (opens in new tab) delivered an even more impressive verdict. It found many VPN apps had 1-5 tracking libraries and required 10-20 permissions; Mullvad had no trackers again, and a minimal four permissions. (Only Astrill did better, with three permissions.)
The news only got better in our speed tests, with Mullvad UK connections hitting an amazing 590-600Mbps for OpenVPN, more than three times what we see with some competitors.
Switching to WireGuard saw Mullvad accelerate further to 770Mbps. That can't quite match Surfshark’s and TorGuard's recent 950Mbps, but it's well above-average, and should be enough for even the most demanding of users.
Mullvad review: Final verdict
Mullvad's app does not have many features, it unblocked barely anything for us, and support is basic, but otherwise there's a lot to like here. You can open an account without handing over any personal data, speeds are excellent, monthly plans are half the price of some competitors, and a top-quality VPN engine protects your privacy at all times. If you're more interested in anonymity than unblocking, Mullvad could be a very smart choice.
