Mullvad VPN
A minimalist Swedish VPN that treats you as an account number and takes cash in the post.
TL;DR verdict
Still the closest thing the consumer VPN market has to a principled product. No email at signup, a flat monthly rate, and a client that gets out of the way. Streaming and mobile handover are the rough edges.
What we like
- Account is a 16-digit number, never an email address
- Accepts cash by post and Monero, so billing does not identify you
- Flat monthly price with no annual lock-in or promo tiers
- Independent security audits are published in full, not summarised
- DAITA traffic-shaping option adds some defence against pattern analysis
Where it falls short
- Streaming platforms block many exit nodes and Mullvad will not play cat-and-mouse
- No port forwarding since 2023, which hurts some self-hosting workflows
- Mobile app on iOS occasionally needs a manual reconnect after cell handover
- Server list is smaller than the marketing-heavy competitors
TL;DR verdict
Mullvad is the VPN to buy if the point of a VPN is to be a stranger to your provider. Flat price, no email, cash by post, published audits. It is not the fastest, it will not fight Netflix for you, and the app is quiet to the point of being boring. That is the entire pitch, and it is a good one.
What it does well
The account model is the product. Signup gives you a 16-digit number and nothing else. No email, no name, no address. Payment can be cash mailed to Gothenburg, Monero, or a card if you prefer that trade-off. Nothing about the billing side of the business identifies you to the network side.
The client is refreshingly plain. WireGuard by default, OpenVPN if you want it, a kill switch that behaves, and a DAITA mode that adds cover traffic to make timing correlation harder. Independent audits from Assured and Radically Open Security are published in full on the site.
Jurisdiction helps. Sweden has no data-retention mandate for VPN providers after the CJEU rulings that struck down the earlier regime, and the company's response to the 2023 police visit — the raid ended without seized user data, because there was reportedly none to seize — is the closest thing to a real-world stress test the industry has produced.
What it doesn't
Streaming is the honest weakness. Mullvad has explicitly said it will not run a dedicated streaming team, and Netflix, iPlayer and DAZN block many exits. Sometimes a Swiss node works and a German one does not; sometimes it flips the next day. If watching things is a primary use case, this is the wrong tool.
Port forwarding is also gone, retired in 2023 after abuse cases. Anyone who needs it for a Plex or torrent seedbox setup should look elsewhere. The iOS app is fine but occasionally needs a manual toggle after switching between cellular and wifi.
Who it's for
Journalists filing from unfriendly networks, activists who want a payment trail that does not exist, and travellers who value a quiet, cheap, flat-rate client that does not upsell them every quarter. Anyone whose priority is entertainment access is better served by Proton VPN or a specialist streaming stack.
Frequently asked
Is Mullvad better than Proton VPN for streaming?
No. Proton actively maintains streaming-friendly servers; Mullvad does not. If Netflix or iPlayer access is the goal, Proton is the more reliable pick. Mullvad is the pick when the account-anonymity story matters more than the entertainment story.
Can I really pay Mullvad in cash?
Yes. You generate an account number, print the token, and mail it inside an envelope with the cash to their Gothenburg address. It is slow and slightly absurd, and it works. Most people will use a card or Monero instead.
What happens if Swedish authorities ask Mullvad for logs?
Mullvad's public position is that there are no connection or activity logs to hand over, and a 2023 police raid on their Gothenburg office reportedly ended without any user data being seized. That is a strong signal, though not a guarantee for the future.