Mullvad VPN review

Mullvad is a Swedish-based VPN that doesn't just talk about protecting your privacy – the provider actually does something about it.

The company doesn't ask for your email address, name, or any personal details to sign up. Just click a button to generate a unique account number, and you’re done.

You can pay via cash, Bitcoin, or Bitcoin cash, ensuring the company knows almost nothing about you. If you don’t need that level of anonymity, you can also pay via conventional methods including card, PayPal, bank transfer, Monero, Swish, Giropay, Eps transfer, Bancontact, iDEAL, and Przelewy24.

Mullvad's core service is absolutely stuffed with privacy-friendly technology. It only uses OpenVPN and WireGuard protocols, for instance, and high levels of encryption are available through AES-256 GCM or 4096-bit RSA certificates with SHA512. In addition, there are also multiple layers of DNS and IPv6 leak protection, you get a variety of stealth options to bypass VPN blocking, port forwarding support is built in, and the list goes on.

• Want to try Mullvad? Check out the website here

The network is a reasonable size. Mullvad may 'only' have 650+ servers (NordVPN has a massive 5,000+), but they're P2P-friendly and well spread across 80 locations and 44 countries.

The company has its own apps for Windows, Mac, Android, iOS, and Linux, as well as a Firefox extension, and you can connect up to five devices simultaneously.

It's generally smart to be skeptical about what apps are doing in the background but you can relax a little with Mullvad as they’re more transparent than most. Not only are its apps open source, so anyone can check the code, but they've also been externally audited in 2020 and late 2022. 

What's new?

Since our last round of testing, the provider completed the upgrade to a RAM-only server infrastructure. Mullvad's quantum-resistant tunnels have left the experimental stage, too, and are now ready for full use on its Android and desktop apps. These aim to shield your traffic from decryption, even by ultra-powerful quantum computers.

The provider also launched a new security feature against AI-powered online tracking in May 2024. So-called DAITA works by distorting data packet patterns to prevent ISPs and other observers from tracing back encrypted internet activities to you. It's been released in beta on Mullvad apps for Windows 10 and 11 only, at the time of writing. 

There are also plenty of smaller app tweaks and optimizations which you can see right now. The mobile apps have new content blockers for gambling and adult content. The iOS app remembers the last account from which you log out and there's now a Search box on the desktop location list. There’s more too, including social media content blocking across all platforms.

The company has dropped support for port forwarding. A blog post explained that the feature had been frequently abused to host undesirable content and malicious services, resulting in IP blacklists and other issues.

Mullvad reports that the Swedish police served it with a search warrant in April 2023. They intended to seize computers, but Mullvad argued this would be illegal under Swedish law, which says there must be a reasonable expectation that relevant information will be found. 

The company explained, ''After demonstrating that this is indeed how our service works and the police consulting the prosecutor they left without taking anything and without any customer information.''

Even police armed with a search warrant don't think it's reasonable to think that Mullvad's VPN servers have any helpful user information. That's an impressive endorsement of Mullvad's no-logging credentials.

Pricing

Pricing is extremely simple at €5 ($5.39) a month, and, well, that’s it. No discounts for long-term contracts, no doubling of the price at the end of the first term; it’s just €5 a month. That's half the price you'll pay for monthly billing with some providers, and cheaper than many annual plans. Even better, Mullvad offers a 10% discount if you pay by cryptocurrency.

If you're happy to sign up for longer, though, there's a lot of money to be saved elsewhere. Private Internet Access is only $2.03 a month for the first term of its three-year plan, for instance, a fraction of the price.

Mullvad scores a plus for its refund procedure, though. Not only is there a 30-day money-back guarantee, but it can also refund Bitcoin payment in some situations. There are potential complications (the refund help page has more), but it's still better than the blanket 'no Bitcoin refunds' we see with most providers.

Privacy

Figuring out a VPN's logging policy is often a real challenge, but again, Mullvad is different, spelling out the fine detail in an excellent policy page.

There's no logging of connection times, IP addresses, DNS requests, traffic, or anything else that can be used to link an action back to a specific account, the company explains.

Mullvad backs up its privacy claims with a 2021 infrastructure audit, and a 2022 VPN server audit, neither of which found any sign of logging or leaks.

The company provides its own authoritative DNS servers for an extra privacy guarantee, and – you’ve guessed it – that recently passed an independent audit, too. 

We could mention the comprehensive 2020 Cure53 audit of its (already open source) desktop and mobile apps, but, well, you get the picture. Mullvad isn’t asking you to take what it says entirely on trust; there’s detailed and independently gathered evidence freely available for anyone to check out. 

Setup

Getting started with Mullvad is as easy as generating an account number and buying some time (cards, PayPal, Bitcoin and other payment methods are supported, as mentioned).

A comprehensive Download page pointed us to the Windows client, but also included links to the Mac, Linux, iOS and Android apps, the latest beta release, the Firefox extension and Mullvad's WireGuard and OpenVPN configuration files.

We grabbed and installed the Windows client in a few seconds. We activated it by entering our account number (Mullvad doesn't require usernames or passwords) and it was ready to go.

Interface

While some VPN apps look and feel very different across all platforms, Mullvad takes a more unified approach. Whether you're using Windows, Android, Apple devices, or Linux, each app is almost identical, with little more than a few settings varying between versions.

The apps look clean, with a colorful panel, a map highlighting your current location, and a Secure My Connection button.

Tapping the location name lets you choose a location from a list of countries and cities. Although Mullvad has recently added a search box on some platforms, this is surprisingly basic, with no ping times, server load indicators, sort options, or Favorites to simplify accessing commonly-used locations.

The apps don’t have a 'Fastest' option to automatically select your nearest server, either. You must select it yourself.

What you do get is an unusual option to filter the list to show only Mullvad-owned servers. This reduces your choice to Denmark, Finland, France, Germany, Netherlands, Norway, Sweden, Switzerland, and the UK. Although there are only nine countries available, it may improve your security as only Mullvad has full access to those servers.

Whatever location you choose, Mullvad doesn't waste time getting you connected. WireGuard took maybe a couple of seconds to connect. Even OpenVPN was ready to go in around six to eight seconds. That’s less than half the time we see with some apps.

Features and settings

Mullvad’s apps may look small and simple, but there’s a surprising amount of functionality lurking underneath.

Mullvad doesn't just have a single ad-blocking feature, for instance. The desktop and iOS apps allow you to separately block ads, trackers or malware, and (new to the desktop since our last review) can filter out adult or gambling-related content, too.

Other VPNs claim similar technology, but rarely tell you anything about what it is, or how it works. As usual, Mullvad is way more transparent. The company’s Github site lists all the blocklists it uses, and you can even view them, see which sites it blocks, and which it doesn’t.

Desktop and Android support for Split Tunneling enables specifying apps which won't use the VPN. That’s good news for not-so-sensitive apps which don't work properly when the VPN is active (streaming services for your own country, for instance).

Multi-hop VPN is another desktop and Android feature which sees your connections routed to one Mullvad server first, exiting the VPN from another server. This function works well, but it's difficult to find. You won't even know it exists unless you browse the OpenVPN Settings and enable Bridge Mode (and, no, we wouldn't think to do that, either).

Most app settings are more straightforward, though. You can opt to launch the app and/or connect when your device starts; enable or disable notifications; turn on a kill switch to block internet traffic if the VPN drops; and use a custom DNS server.

It's a more configurable setup than many apps, although there are a few features missing. In particular, we'd like the ability to automatically connect when accessing particular networks or network types. But even here, Mullvad has a decent argument why you're better off without this – the company suggests the feature is a security risk because hackers could set up a network with the same name and your device might connect automatically.

The desktop apps have one other unusual expert-level extra in a very flexible command line interface, which enables building scripts to tweak settings, connect to your chosen locations, view status or disconnect automatically. That'll be way too much hassle for most people, but if you want to do something advanced – perhaps create a script which automatically connects to Mullvad before launching a specific app – it could be very helpful.

Support

If you're finding gremlins in the Mullvad apps or can’t figure something out, you can check out Mullvad's Help Center. There's a decent amount of content, most of it providing genuinely useful information, but it doesn't begin to match the likes of ExpressVPN or NordVPN.

Unfortunately, the articles aren't well organized. The Help Center doesn't display the articles you're most likely to need first. Common articles that you might need to read are not on the opening screen and can't be found when you run a search. You might have to hunt for the information you need, and even if you find it, articles often assume a high level of technical knowledge.

There's no live chat support, either, but Mullvad does allow users to contact support from within its apps or via email. We asked a question and got a friendly and helpful reply (far better than the website) within 90 minutes. That can't compete with the two or three-minute wait we typically see with live chat from the top providers, but it's also far better than the 12+ hours we'll often be left waiting elsewhere. So, in our opinion, Mullvad offers an acceptable level of support.

Testing

Our performance testing began with a close look at Mullvad's kill switch. We forcibly closed both OpenVPN and WireGuard connections in various ways, but the app handled each situation perfectly. It immediately displayed a 'Reconnecting' message alerting us to the problem, blocked our internet connection to prevent any IP leaks, and followed up with a 'Secured' notification when the connection was re-established seconds later.

In most cases, the kill switch only protects you if the connection drops during a session, but there's an even more secure option available. Turn on 'Lockdown mode' and you can't access the internet at all until you've connected to Mullvad VPN. That's not always convenient, but it does ensure you're always protected. It could be worth enabling when you're on holiday, say, and only ever connecting via unknown and untrusted Wi-Fi.

Mullvad only supports two protocols, but when they're the versatile OpenVPN and super-speedy WireGuard, that's probably enough. We took a look at Mullvad's OpenVPN implementation to confirm its security capabilities, and the news was good. It uses the latest TLS 1.3 on the control channel (many providers still use 1.2), and rock-solid AES-256-GCM for the data channel.

Mullvad gets bonus points for using a recent version of OpenVPN that’s just four months old at review time. We've seen many apps using versions that are more than a year old, which means they're missing out on a lot of patches and updates.

Mullvad’s website doesn't make any big claims about unblocking streaming services, and our tests showed why. Not only did Mullvad fail to get us into, UK, Australia, Canada, and Japan Netflix, it couldn't unblock BBC iPlayer, Amazon Prime Video, or Disney Plus, either. 

We had better luck with some regional services. Mullvad unblocked the UK's ITV and Channel 4, along with Australia's 9Now, though it did fail with 10 play. So, there’s a chance it’ll have some value for you but most providers deliver far better unblocking results. ExpressVPN, NordVPN, Private Internet Access, ProtonVPN, PureVPN, and Surfshark each scored full unblocking marks in their last reviews.

It’s a very different story with privacy. We checked Mullvad's desktop and mobile apps for DNS leaks using DNSLeakTest.com, DNSLeak.com, and other testing sites. They proved leak-free in every situation.

There was more good news in our server location tests. Some providers make heavy use of virtual locations. These servers return IPs for one country but could be hosted in a different place much further away. This can give you speeds much slower than you would expect. We checked a sample of eight Mullvad locations and they were all in or very close to their claimed countries.

Mullvad claims built-in ad, tracker, and malware blocking but how effective is it? We found the service blocked a reasonable 74% of 156 common trackers (most VPNs manage 70-90%.) It also kept us away from 99% of 379 malicious URLs in our tests, an excellent result. It managed to score 90% for ad blocking while others average 40-90%. You should still run a decent antivirus for real safety, but Mullvad's threat-blocking is a handy second layer of protection.

We used the Blacklight privacy inspector to scan websites for integrated trackers from Google, social media, and other sites. Most VPN provider sites have one to five of these but Mullvad has none, zero, nothing at all.

Android app scanning site εxodus delivered an even more impressive verdict. It also found that Mullvad had no trackers and only required four permissions. Competitors often require one to five tracking libraries and require ten to twenty permissions.

The news only got better in our speed tests, with Mullvad UK connections hitting an amazing 300-530Mbps for OpenVPN. That’s two to three times faster than what we see with some competitors.

Switching to WireGuard saw Mullvad accelerate further to 660-900Mbps. That can't quite match IPVanish, NordVPN, or Windscribe, who all beat 950Mbps in recent testing, but it's blisteringly fast and should be enough for even the most demanding of users.

Mullvad review: Final verdict

Even though Mullvad's app does not have many features, its unblocking power is limited, and has only basic support, there's a lot to like here. Mullvad is one of the best VPNs around for privacy: open, transparent, doesn’t take your personal details, has audits, open-source apps, no trackers, is well-engineered, high-quality code, and has useful content filters. No one else gets close. Speeds are excellent, too, and monthly plans are half the price of some competitors. If you're more interested in anonymity than unblocking, Mullvad could be a very smart choice.

• Looking for alternatives? We've rounded up all the best VPNs here