Mullvad VPN

Mullvad VPN is the canonical no-KYC VPN — 16-digit randomly-generated account numbers as the only identifier, cash-by-mail accepted alongside XMR / BTC / BCH / cards, multiple independent security audits published, and a 17-year operational track record under stable Sweden-based ownership. Listed at Grade A · editor's pick because it remains the privacy-respecting baseline that every other VPN provider gets benchmarked against — and because the operator's choices (removing port-forwarding under abuse pressure, partnering with the Tor Project on a privacy-aware browser, refusing the lifetime-discount race-to-the-bottom) consistently surface privacy + integrity over growth metrics.

Background. Founded in 2009 under Sweden-based ownership; the operator entity is Amagicom AB (Swedish company, publicly named). 555,541+ numbered accounts at the time of the operator's last public count. Standard infrastructure: WireGuard as the default protocol with OpenVPN as the fallback, DAITA (Defense Against AI-guided Traffic Analysis) as an opt-in obfuscation layer for users worried about traffic-analysis attacks, multi-hop routing for users who want one server to know their entry IP and a different server to know their destination. Tor onion mirror operator-published. Open-source clients for Linux, macOS, Windows, iOS, Android (F-Droid + Play Store), plus router configs and CLI tooling.

What you trust. Account-level: no email, no password, no recovery flow — your 16-digit account number is your entire identity, generated client-side, never asked for any name or contact info. Payment-level: cash by mail (anonymous all the way), Monero (~10% crypto discount), Bitcoin, Bitcoin Cash, plus the usual fiat options (card, PayPal, bank wire, regional methods) for users who don't need anonymous payment. Operator-level: Mullvad has been audited by independent firms repeatedly, including Assured AB (2022 + earlier), Radically Open Security (2023), Cure53 (multiple engagements on Mullvad Browser), with reports published publicly on the site. Sweden-based jurisdiction is not part of any of the 14-Eyes intelligence-sharing club at the same depth as the 5-Eyes — relevant for users factoring intelligence-sharing exposure into their VPN choice. Logging policy: no activity logs, no connection logs, no DNS query logs per the published no-logging policy (last updated January 2026); the only data Mullvad sees is the account number (a 16-digit string), time remaining on the account, and payment metadata for whichever payment method you chose.

Operational specs. Pricing: €5/month flat — same rate for 1 month, 1 year, or 1 decade. No tiered discounts for longer commitments (deliberate choice — they don't want to lock users in). ~10% crypto discount applied for Monero / Bitcoin / Bitcoin Cash payments. 14-day money-back guarantee (except for cash payments — anti-money-laundering compliance). Devices: up to 5 simultaneous devices per account. Protocols: WireGuard (default) + OpenVPN (fallback). Servers: globally distributed across 40+ countries; full server list published with `physically-owned`, `rented`, and `wireguard-only` flags so users can choose based on operator-control posture. Features: split tunneling (Linux + Android), kill switch (all platforms), DNS-level ad/tracker blocking via Mullvad DNS, multi-hop, DAITA traffic analysis defence. Mullvad Browser: separate product, built in collaboration with the Tor Project, ships with Tor Browser–derived anti-fingerprint defenses but routes through Mullvad VPN (or any VPN, or no VPN) instead of through Tor.

Philosophy. Mullvad's editorial differentiator is the consistent refusal to grow at the expense of trust. Three concrete examples: (1) flat €5/mo since 2009 — no inflation hike, no "first year discounted" lock-in, no lifetime VPN sales (which are a privacy red flag because they force the operator to harvest something else to cover the long tail of bandwidth). (2) Port-forwarding removed in 2023 because abuse cases were forcing the operator to log and respond to complaints, undermining the no-log promise — a feature reduction that genuinely makes user-impacting trade-offs to preserve the privacy promise. (3) Mullvad Browser collaboration with the Tor Project — instead of building a proprietary anti-fingerprint browser, partner with the people who have spent two decades getting fingerprint defence right. Each of these is the harder commercial decision; doing all three over 17 years is the editorial signal.

Grade rationale. Grade A and editor's pick reflect: 17 years of operational continuity (since 2009); Sweden-based publicly-named operator (Amagicom AB); 16-digit account-number signup with no email/name/password; cash-by-mail accepted plus full crypto suite including XMR; multiple independent security audits with published reports; no-logging policy stated in detail with the "what we *don't* log" enumerated explicitly; WireGuard-first technical stack; Tor onion mirror; Mullvad Browser partnership with Tor Project; transparent response to 2026 technical disclosures (Android tunnel-bypass + exit IP fingerprinting issues both publicly acknowledged and patched). Last verified 2026-05-11.

Useful when. You need a VPN and you want to actually pay for the privacy property rather than rent your data to an ad-supported "free" VPN. You're working from coffee-shop / hotel / conference Wi-Fi and want to neutralise the local-network-operator data-collection vector. You're a journalist or researcher whose source-side traffic needs to not reveal a real IP. You want a VPN whose operator has been audited by people other than the operator's marketing team. You want to pay in cash. You're using Mullvad Browser + a different VPN (or no VPN) and want the browser-level fingerprint defenses. You're configuring a router-level VPN and need a provider with documented router configs.

Caveats. VPN is metadata privacy, not application-level anonymity — Mullvad obscures your IP from sites you visit but does not prevent the site from tracking you via account cookies / browser fingerprint / login info. For full anonymity you need Tor; for layered privacy you can run Mullvad → Tor (Mullvad sees your real IP, Tor sees the Mullvad exit, sites see the Tor exit). Port-forwarding removed in 2023 — if you self-host services accessed through your VPN (Plex, game server, BitTorrent seeding), Mullvad will not give you an inbound port; use a different VPN (some providers still offer this) or self-host without a VPN behind your real IP. Sweden is EU jurisdiction — Swedish authorities can compel disclosure of what Mullvad has, which is the account number + payment metadata; they cannot compel Mullvad to invent activity logs that don't exist. Mullvad Browser is not Tor Browser — it shares fingerprint defenses but does NOT route through Tor by default; if you need Tor's onion routing, use Tor Browser directly. 5-device limit — if your household has more than 5 devices wanting Mullvad simultaneously, use the router-level option to centralise the device count to 1. 2026 technical disclosures — Android tunnel-bypass + exit-IP fingerprinting were publicly disclosed and are being addressed; check the latest Mullvad blog for current patch status before relying on Android for high-threat use.