Is Mullvad VPN Safe?
Mullvad’s strongest safety evidence and its biggest unresolved question come from the same place: independent scrutiny.
Over the past several years, Mullvad has opened its desktop application, its Android application, its own WireGuard implementation, its account and payment systems and its relay infrastructure to outside assessors. Several of those components have been tested more than once. That record forms the foundation of Mullvad’s safety case and of everything that follows in this investigation.
That is not, however, the hard part of the question. Encryption is not where Mullvad’s case gets shaky. WireGuard-based tunnelling, a company-built protocol implementation and a documented kill-switch architecture are all present, and on desktop and Android, parts of that architecture have been independently tested.
The harder question is what that scrutiny has not yet settled. One of Mullvad’s own infrastructure assessments produced the finding that most complicates its safety case. In 2023, an independent assessor examined two of Mullvad’s relays and found that administrators in that sampled environment could technically access the systems and potentially inspect traffic passing through them.
Mullvad has described remediation steps and subsequent verification activity. Whether the relevant privileged-access controls are now consistently enforced across the current relay fleet is not established in the reviewed public evidence.
The strength and scope of the independent evidence differ materially by platform. Desktop has the most substantial platform-specific assessment record, while Android combines a standardized black-box app assessment with a separate review of GotaTun. iOS has no equivalent current dedicated full-app assessment in the reviewed record. That does not establish that iOS is unsafe; it means there is less independent evidence available to support the same level of confidence. Even on desktop and Android, the reviewed evidence does not establish end-to-end correspondence between the app distributed to users and the source code that was assessed.
What follows works through what has actually been verified, platform by platform and layer by layer, what still rests on Mullvad’s word alone, and what that combination means depending on who is asking. Readers weighing Mullvad’s data-handling claims specifically, rather than its resistance to compromise, may also want (L)Is Mullvad VPN Private?(L), which covers that separate question.
The short answer
Mullvad VPN is safe for most ordinary users, with real caveats for anyone facing an elevated threat, and an evidence gap that keeps it from being confirmed safe for users who need protection from infrastructure-capable or state-capable adversaries.
- Ordinary users — public Wi-Fi, routine ISP visibility, everyday IP and DNS protection under normal operating conditions. This is where Mullvad’s evidence is strongest. Confidence is moderate to high on desktop and Android, with platform-specific exceptions noted below.
- Elevated-risk users — people worried about targeted account theft, hostile networks, censorship, or a compromised hosting provider. Mullvad is potentially suitable here, but only with some operational care and an awareness of where the evidence thins out. Confidence is moderate.
- High-risk users — anyone whose safety depends on verified resistance to compromised administrators, compromised hosting providers, malicious software updates, global traffic correlation, or state-level observation. Mullvad is not established as safe enough for this tier. That is a statement about the limits of the available evidence, not proof that Mullvad has failed anyone.
On accounts specifically: Mullvad’s login system avoids the usual email-and-password exposure and the risks that come with password reuse. But the account number itself becomes the secret a user has to protect. It is not a blanket defence against every kind of account attack.
Safety at a glance
| Area | What the evidence supports | Key limitation | Evidence strength |
|---|---|---|---|
| Encryption and protocols | WireGuard-based tunnelling; a company-built implementation (GotaTun) with its own independent review | Deployment beyond Android is not established | Independently assessed within scope |
| Desktop apps (Windows, macOS, Linux) | App, daemon, firewall, updater and DAITA-implementation paths independently reviewed by X41 D-Sec | Version- and scope-bound review; mobile excluded; binary correspondence unresolved | Independently assessed, scope-bound |
| Android | GotaTun, DAITA, multihop, post-quantum key establishment and anti-censorship settings; a standardized black-box assessment reported no required fixes | Assessment is dated relative to the current app; some DNS and connectivity exceptions are disclosed | Independently assessed, but dated |
| iOS / iPadOS | WireGuard-based service confirmed | No current dedicated full independent audit; reconnect behaviour is company-stated only | Company-stated, unverified |
| Kill switch and Lockdown | Desktop kill switch plus Lockdown mode documented; selected firewall and DNS scenarios independently tested | Comprehensive testing of crashes, updates and sleep/wake behaviour is incomplete across platforms | Partially independently tested |
| Source code and distributed binaries | Source published for multiple components; selected components independently reviewed | No independent end-to-end correspondence between distributed binaries and reviewed source is established, on any platform | Assessed in part; correspondence unestablished |
| Account security | Login by 16-digit number avoids conventional email and password exposure | No established multi-factor authentication or rotation; session and revocation handling unresolved | Company-documented; backend independently assessed |
| Server infrastructure | Three rounds of independent relay assessment between 2022 and 2024; RAM-boot design sampled | 2023 assessment found sampled administrators could access systems; current fleet-wide status unresolved | Sampled, with a historical finding still unresolved |
| DAITA and multihop | Implementation reviewed; architecturally designed to reduce traffic-analysis risk | Real-world effectiveness against sophisticated observers has not been tested | Implementation assessed, effectiveness unproven |
| High-risk use | Meaningful desktop and Android assurance exists | Privileged-access and binary-correspondence gaps remain open | An evidence-burden gap, not a demonstrated failure |
What “Mullvad has been audited” actually means
“Mullvad has been audited” sounds like a single fact. It is not. It is several separate facts, each with its own assessor, date and boundary, and treating them as one blanket stamp of approval overstates what any single one of them proves.
X41 D-Sec reviewed the desktop application, daemon, firewall, updater and the DAITA-implementation paths in a scoped, version-bound assessment completed in 2024, and it independently tested selected firewall and DNS-manipulation scenarios directly. Mobile apps, real-world DAITA performance, future releases and whether the distributed binary matches the reviewed source were all explicitly outside its scope.
NCC Group and the App Defense Alliance ran a standardized black-box assessment (MASA AL2) of the Android app, version 2024.9, and reported the result without required fixes. This was a black-box test, meaning the assessors worked from the outside rather than reviewing source code, and it reflects a version of the app that is now dated relative to what is currently shipping.
Assured Security Consultants separately reviewed GotaTun, Mullvad’s own WireGuard implementation, and that work is confirmed in Mullvad’s current Android documentation.
The account and payment backend, covering authentication, device provisioning and the distribution of WireGuard keys, was independently assessed by X41 in a separate engagement. The official summary reports three Medium and two Low findings, though some details are redacted and full retest evidence is not available in the public record.
Relay infrastructure has been independently assessed three times across three years by three different assessors: Assured in 2022, Radically Open Security in 2023, and Cure53 in 2024. Each contributed its own scope-bound findings, with varying levels of reported remediation and verification.
Audit-scope table
| Assessor | Year | Target | What it covered | What it did not establish |
|---|---|---|---|---|
| X41 D-Sec | 2024 | Desktop app, daemon, firewall, updater, DAITA-implementation paths | Scoped code review; selected firewall and DNS-manipulation scenarios tested directly | Mobile apps; real-world DAITA effectiveness; future releases; binary-to-source correspondence |
| NCC Group / App Defense Alliance | 2025 | Android app, version 2024.9 | Standardized black-box assessment, reported without required fixes | Source review; the current app version; DAITA effectiveness; binary correspondence; comprehensive kill-switch testing |
| Assured Security Consultants | 2026 | GotaTun implementation and key-establishment logic | Component-level implementation review | App-wide, platform-wide or deployed-binary assurance |
| Assured | 2022 | Three sampled WireGuard and OpenVPN relay deployments | Historical relay hardening, logging and access review | Fleet-wide generalization |
| Radically Open Security | 2023 | Two RAM-booted, production-like relays | Administrator access, monitoring-credential and command-auditing findings, with described remediation | Hardware-level security; source code; whole-fleet runtime assurance; current fleet-wide status |
| Cure53 | 2024 | Scoped WireGuard and OpenVPN relay infrastructure | White-box penetration test and source and configuration review | Every relay, data centre, hosting provider or physical-control system |
| X41 D-Sec | 2025 | Account and payment API, backend, device provisioning, key distribution | Backend assessment; three Medium and two Low findings reported | Complete retest detail; native app and relay infrastructure |
Are Mullvad’s apps safe?
Windows, macOS and Linux share a common desktop application. X41’s 2024 review covered the app, daemon, firewall, updater and the DAITA-related implementation for a defined release, and it tested selected firewall and DNS-manipulation scenarios directly.
That review is real independent assessment, but it has edges. It was tied to a specific version and scope, it excluded mobile apps and real-world DAITA performance, and the reviewed evidence does not establish that the binary a user installs matches the source code that was reviewed.
Some platform-specific questions remain open too: how the privileged helper and updater behave on macOS, who controls the signing keys for the Linux package repository, and how the app handles rollback attempts and edge cases around crashes and updates on Windows.
Manual WireGuard or OpenVPN configuration depends on third-party client software with its own signing and failure behaviour, which sits outside Mullvad’s own client pipeline. The relay-side assessments provide useful infrastructure context, but they do not establish client-side safety for these manual routes.
There is no single “the apps are safe” conclusion that can responsibly cover Windows, macOS, Linux, Android, iOS and manual clients all at once. The strength of the evidence steps down as you move from desktop, to Android, to iOS, to manual and third-party routes.
Platform comparison
| Platform | Independent assurance | Kill switch / Lockdown model | Advanced protections | Main limitation |
|---|---|---|---|---|
| Windows | X41 2024 scoped review of app, daemon, firewall and updater | Built-in kill switch plus desktop Lockdown | DAITA, multihop, post-quantum key establishment (company-documented) | Anti-rollback controls, binary match and crash/update edge cases unresolved |
| macOS | X41 2024 scoped components | Built-in kill switch plus desktop Lockdown | DAITA, multihop, post-quantum where exposed | Privileged-helper, updater and sleep/reconnect behaviour unresolved |
| Linux | X41 2024 scoped desktop assessment | Built-in kill switch plus Lockdown | DAITA, multihop, anti-censorship settings | Repository-key custody and resolver/firewall variation unresolved |
| Android | NCC Group / App Defense Alliance MASA AL2 (version 2024.9, black-box); separate GotaTun review | Built-in kill switch; Android’s own Always-on and Block-connections settings, not a Mullvad Lockdown | GotaTun, DAITA, multihop, post-quantum key establishment, anti-censorship settings, all confirmed | Known DNS and connectivity-check exceptions, OEM battery termination, split-tunnel interaction |
| iOS / iPadOS | No current dedicated full independent audit | Company-stated reconnect behaviour; no Lockdown equivalent | GotaTun, DAITA, post-quantum key establishment and full multihop parity not established | Materially weaker independent assurance than desktop or Android |
Does Mullvad fail safely if the connection drops?
Kill-switch and fail-closed behaviour has to be judged platform by platform and scenario by scenario. No platform is established as universally fail-closed.
On desktop, a standard kill switch and a separate, stricter Lockdown mode are both documented, and X41 independently tested selected firewall and DNS-manipulation scenarios within its assessment. Full behaviour during a daemon or GUI crash, traffic handling during an update, and comprehensive testing across sleep, wake and network changes all remain unresolved beyond that scoped review.
On Android, a built-in kill switch is documented separately from Android’s own operating-system controls, Always-on VPN and Block-connections-without-VPN, and there is no Lockdown-style equivalent from Mullvad itself. Aggressive OEM battery management can terminate the app in the background, and split-tunnel exclusions interact poorly with Android’s own block setting.
On iOS, Mullvad states that the app reconnects after sleep or a network change without leaking. There is no Lockdown-style parity, and this reconnect claim rests on the company’s own statement rather than independent verification.
This matters because a failure at any of these points can expose a user’s real IP address, DNS queries or other traffic. But it is worth being precise about what the gap actually is. Missing testing is not evidence that a failure occurs. It means the reviewed evidence does not cover that scenario. Documented kill-switch and Lockdown controls are real protections, but they are not the same thing as comprehensive, independently verified fail-closed behaviour in every possible adverse scenario.
Is Mullvad safe on Android?
Android is the most fully featured mobile platform Mullvad offers. Confirmed capabilities include GotaTun, DAITA, multihop, post-quantum key establishment (Mullvad documents that from version 2025.8, the “Automatic” setting behaves the same as “On”), documented anti-censorship settings, a built-in kill switch, and the MASA AL2 assessment of version 2024.9, which was reported without required fixes.
It is also the platform with the most fully disclosed limitations: a known DNS leakage condition, operating-system connectivity checks that can bypass the VPN, the risk of an OEM’s battery management shutting the app down, and an incompatibility between split-tunnel exclusions and Android’s own system-level block setting.
The MASA assessment was black-box rather than a source review, and it reflects a version of the app that predates the current one. Current binary-to-source correspondence, whether the app installed on a phone actually matches reviewed code, remains unresolved.
Android is feature-rich and meaningfully assessed, but it is neither leak-proof nor comprehensively verified. The disclosed limitations are specific, named exceptions rather than evidence of a systemic leak, and their exact real-world frequency is not fully documented. A high-risk user relying on Android should weigh the age of the audit, its black-box method and the unresolved binary-correspondence question against their own threat model.
Is Mullvad safe on iPhone and iPad?
iOS has to be treated as a materially weaker-evidence platform. It does not automatically inherit the desktop or Android verdict just because it shares a brand.
WireGuard-based service operation is confirmed. GotaTun, DAITA, post-quantum key establishment and full multihop parity are not established on iOS, and there is no current dedicated full independent audit of the iOS app. The claim that the app reconnects without leaking after sleep or a network change comes from Mullvad itself, not from an outside test.
This is a genuine evidence gap rather than a demonstrated leak. For ordinary users, the record does not point to a specific iOS failure. But it also gives them materially less independent assurance than desktop or Android users get. For elevated-risk and high-risk users, that missing verification carries more weight.
Can Mullvad’s source code be trusted?
Publishing source code lets outsiders inspect what Mullvad says the app should do. It does not, on its own, prove that the app installed on a given device was actually built from that reviewed code.
Source visibility, code review, artifact signing, platform signing, build reproducibility and binary-to-source correspondence are five distinct kinds of evidence, and they should not be flattened into a single “open source and audited” claim. Windows and macOS installers and the Linux package repository use signed artifacts or package signatures. Android uses Google Play’s own platform signing. iOS uses Apple’s App Store signing. None of these signing systems proves, or substitutes for, independent confirmation that the signed binary a user downloads matches the source code that was reviewed.
The reviewed evidence does not establish independent end-to-end correspondence between the distributed app and the reviewed source on any native platform. Reproducible builds, a process that would let anyone rebuild the app from source and get an identical result, are also not established on any platform. That is an absence of evidence, not proof that no such process exists. Who controls the signing keys, how the build pipeline is secured, and whether the app can resist being rolled back to an older, less secure version all remain open questions across every platform.
How safe is Mullvad’s account-number system?
Mullvad does away with the usual email-and-password account, but that trades one secret for another. The 16-digit account number becomes the thing a user has to protect.
The number alone is enough to log in. Functionally, it works as both an identifier and a shared secret, and it is separate from the device’s own WireGuard private key, which is set up independently.
This reduces exposure to conventional email compromise and password-reuse attacks, since neither an email address nor a traditional password is required in the ordinary sign-up flow. Payment and recovery paths can still introduce their own dependencies outside that flow.
X41’s 2025 assessment of the account and payment backend, device provisioning and key distribution reported three Medium and two Low findings. Some details are redacted, and full retest evidence is not available in the public record.
Multi-factor authentication is not part of the current flow. Ordinary rotation of the account number is not established. How sessions, stored tokens and revocation actually work is unresolved.
It is more accurate to describe this system as reducing exposure to conventional credential attacks than as reducing account-compromise risk in general. For ordinary users, removing email and password eliminates those particular attack paths. That distinction matters most to a high-risk user who could lose control of their account number through theft, coercion or device seizure.
How safe are Mullvad’s servers and infrastructure?
This is where the investigation carries the most weight, and that weighting is deliberate.
Mullvad’s published server list includes hostnames, locations, hosting providers, Owned or Rented labels, server type, DAITA support and live status. These are company-published operational labels. They are not independent proof of legal ownership, physical control, the absence of virtualization, the absence of provider access, or runtime integrity. There is no reliable way to state an ownership ratio here, since there is no preserved, reproducible snapshot and counting method available in the record. Readers who want more on what Mullvad’s corporate and operational structure implies for these labels may find Who Owns Mullvad VPN? useful as further reading.
RAM-boot architecture, sampled on two production-like relays in the 2023 assessment, can reduce how much data persists after a server is powered down. On its own, it does not prevent inspection of live memory, administrator access, hosting-provider access, or compromise while the system is actually running.
Multiple relay assessments exist, but each is sampled and scope-bound: two RAM-booted relays for the 2023 assessment, three deployments for the 2022 assessment, and a defined set of relays for the 2024 white-box review. None of them establishes that the whole fleet contains compromise the same way.
Hardware access, physical security and management-controller exposure (the kind of low-level remote access that lets someone control a server even when its operating system is unresponsive) were excluded from, or not comprehensively covered by, the available reports.
Owned servers are not automatically safer than rented ones, and rented servers are not automatically less secure. The published labels alone do not support either generalization.
What the 2023 infrastructure audit revealed
This is the decisive hinge for the overall verdict, so it deserves a careful, direct account rather than a passing mention.
In 2023, Radically Open Security assessed two RAM-booted, production-like relays. The assessment found that administrators in that sampled environment could technically access the systems and potentially inspect traffic passing through them. It also documented issues with monitoring credentials and command auditing, including shared credentials that were reportedly replaced afterward.
Mullvad has described remediation steps and subsequent verification activity. What the public record does not establish is the current, fleet-wide state of that privileged-access model: whether administrator access today is tightly scoped, centrally audited and technically constrained across every relay, not just the two that were sampled back in 2023. Hardware-level security, a full review of the source code, and whole-fleet runtime assurance were outside the assessment’s scope from the start.
This is a historical finding with described, but fleet-wide unverified, remediation. It is not a live claim about what administrators can see today. It should be read that way: neither “Mullvad’s administrators can currently inspect your traffic” nor “this was fully resolved” is a statement the evidence supports.
If current, fleet-wide evidence confirmed that access has been tightly closed, the verdict could reasonably move toward a stronger safety judgment, with the remaining caveat narrowing mainly to binary correspondence. If evidence instead showed the 2023 conditions persisting across the fleet, the verdict would move materially the other way for elevated-risk and high-risk users specifically. Neither has been established. Whether the relevant privileged-access controls are now consistently enforced across the current relay fleet is not established in the reviewed public evidence, and that gap is why the verdict stays conditional.
Do DAITA, multihop and post-quantum protection make Mullvad safer?
These are genuine architectural investments. None of them should be allowed to carry the overall verdict on its own.
DAITA. Parts of its implementation, including selected desktop paths, were within X41’s 2024 assessment. Real-world effectiveness against traffic analysis was explicitly excluded from that assessment. DAITA is documented on desktop and Android; its status on iOS is unresolved. It should not be described as defeating website fingerprinting, AI-guided traffic analysis or state-level observation, because no evidence of that kind exists in the record.
Multihop. Designed to separate the visibility of the entry relay from the exit relay. The evidence does not fully establish how it holds up under a compromised-relay scenario, and it does not establish resistance to coordinated or global observation. Given the unresolved fleet-wide privileged-access picture above, it is not clear how much protective value multihop retains against an adversary already capable of reaching Mullvad’s own infrastructure. Multihop does not resolve the decisive hinge.
Post-quantum key establishment. Mullvad adds post-quantum material to the process of setting up a tunnel’s keys on supported clients. That is a scope-limited enhancement, not a claim about the conventional symmetric encryption that still carries the actual data. It is confirmed on Android, company-documented on desktop where the app exposes it, and unresolved on iOS. This is mainly a safeguard against a long-horizon risk, sometimes called “harvest now, decrypt later,” where an adversary records encrypted traffic today hoping to decrypt it once quantum computers are capable enough. It cannot substitute for current endpoint, update-chain and infrastructure assurance.
Has Mullvad had security vulnerabilities or incidents?
The record reviewed here identifies CVE-2023-50446, a patched Windows vulnerability that allowed local privilege escalation and affected versions before 2023.6-beta1.
Independent audits, X41 on desktop in 2024 and on the account and backend systems in 2025, Radically Open Security on infrastructure in 2023, Assured on relays in 2022 and on the web app in 2025, and Cure53 on relays in 2024, each produced their own scoped findings, most with reported remediation. Audit findings are not the same thing as confirmed real-world exploitation, and no operational exploitation of these findings appears in the record reviewed.
One specific CVE is identified here, but the chronology is incomplete. It does not support a conclusion that Mullvad has an unusually clean or low-vulnerability history. The absence of a located catastrophic incident reflects the limits of the record that was reviewed, not a verified absence of undisclosed incidents.
Is Mullvad safe for high-risk users?
Ordinary users. Safe, with real caveats. The strongest evidence sits with desktop and Android. Platform-specific limitations are still real: Android’s disclosed DNS and connectivity exceptions, iOS’s weaker independent verification, and adverse-state behaviour that remains largely untested rather than proven safe. These gaps are unlikely to dominate an ordinary threat model, but they are not theoretical. They are unresolved limits on how much assurance actually exists.
Elevated-risk users. Potentially suitable, with operational and platform caveats. The account model’s lack of multi-factor authentication, and the unresolved questions around rotation and session handling, call for treating the account number with real care as a shared secret. Censorship-bypass features exist but have not been tested for effectiveness on hostile networks, so guaranteed bypass should not be assumed. iOS users in this tier should weigh the platform’s weaker evidence base more heavily than desktop or Android users need to. And because the fleet-wide privileged-access picture remains unresolved, anyone specifically worried about a compromised or coerced hosting provider cannot be given an unqualified reassurance.
High-risk users. Mullvad is not established as safe enough for users whose safety depends on verified resistance to compromised administrators, compromised hosting providers, malicious software updates, global traffic correlation, or state-level observation. This is a judgment about the limits of available evidence, not proof that Mullvad is unsafe. The record simply does not contain enough to confirm resistance to these specific threats. Journalists, activists, dissidents and other high-risk groups do not share a single threat model with each other, and that distinction matters here too. Each should weigh the same unresolved evidence against their own specific situation, rather than treating this as one uniform verdict.
General conclusion
Mullvad’s safety case rests on a genuinely substantial record: independent review of its desktop application, its Android application, its own WireGuard implementation, its account and payment backend, and three successive rounds of relay-infrastructure testing. For the threats that ordinary users actually face, hostile Wi-Fi, routine ISP observation, everyday IP and DNS protection under normal conditions, that record, combined with documented kill-switch and Lockdown controls and an account model that limits conventional credential exposure, supports a verdict of safe with material caveats.
That verdict is not unqualified, because the single most consequential finding in the record, a 2023 assessment that found administrators could technically access sampled relays and potentially inspect traffic, has not been superseded by current, fleet-wide evidence that the issue is closed. That is the decisive hinge running through this whole investigation: whether current fleet-wide privileged-access, hosting-provider-access and runtime-integrity controls have actually closed the exposure documented in 2023. Layered on top of that is a second, verdict-critical gap. The reviewed evidence does not establish independent end-to-end correspondence between the distributed app and the reviewed source on any native platform, so the software a user actually runs is not independently confirmed to match the code that was reviewed.
iOS carries weaker evidence than desktop or Android across nearly every dimension. DAITA, multihop and post-quantum key establishment are real architectural investments, but their real-world effectiveness against sophisticated adversaries remains unproven rather than disproven. Adverse-state failure behaviour, while genuinely relevant to safety, is not established as a demonstrated failure mode in the current record.
Mullvad’s safety case is strongest for ordinary users, conditional for elevated-risk users, and, on the specific evidence gaps described above, not established as sufficient for users whose safety depends on verified resistance to compromised administrators, hosting providers, malicious updates, global traffic correlation or state-level observation.
The STACK View
Mullvad has done more than make promises. It has repeatedly put pieces of its own system in front of outside assessors, its apps, its own protocol implementation, its account systems, its servers, and let them report what they found. That pattern deserves weight because it exposes meaningful parts of Mullvad’s safety case to outside examination.
But scrutiny and resolution are not the same thing. The most consequential finding to come out of any of that testing was not a flaw in an app. It was a 2023 discovery that administrators on sampled relays could technically reach systems carrying user traffic. Mullvad has described remediation, but the reviewed evidence does not establish the current result across the full fleet.
That is the trade the evidence actually asks a reader to make. For everyday threats such as hostile Wi-Fi, routine ISP observation and ordinary connection failures, Mullvad’s tested apps and documented controls do real work, and the safety case for that tier is solid.
For anyone whose safety depends on Mullvad’s infrastructure resisting a capable, motivated adversary, the honest answer is that the reviewed public evidence does not yet establish that resistance. Not because Mullvad has been caught failing. Because the public evidence does not yet complete that fleet-wide verification.
Mullvad has earned a meaningful baseline of trust by repeatedly allowing outside assessors to examine important parts of its system. What it has not yet earned, on the public record, is the specific and narrower kind of trust that a state-targeted user or a journalist facing real surveillance would need: proof, not description, that the access gap found in 2023 has been closed consistently, across the current fleet, everywhere it could matter.
FAQs
Is Mullvad VPN safe to use? For most ordinary users, yes, with real caveats. Mullvad has a substantial independent-assessment record covering its apps, its protocol implementation, its account backend and its relay infrastructure. But an unresolved 2023 infrastructure finding, and the absence of independent binary-to-source correspondence, keep the verdict conditional rather than unqualified.
Has Mullvad VPN been audited? Several separate components have been independently assessed by different assessors on different dates: the desktop app by X41 in 2024, the Android app by NCC Group and the App Defense Alliance in 2025, GotaTun by Assured Security Consultants in 2026, the account and payment backend by X41 in 2025, and relay infrastructure by Assured in 2022, Radically Open Security in 2023 and Cure53 in 2024. No single audit covers the whole product.
Does Mullvad VPN have a kill switch? Yes, on desktop and Android, documented separately from each other. Desktop also has a stricter Lockdown mode. iOS relies on company-stated reconnect behaviour rather than an independently verified Lockdown equivalent.
Is Mullvad safe on Android? Android has the richest documented feature set of any Mullvad platform, along with a standardized independent assessment. It also carries the most fully disclosed limitations, including a known DNS leakage condition and operating-system connectivity-check exceptions. It is feature-rich and meaningfully assessed, not leak-proof or fully verified.
Is Mullvad safe on iPhone? iOS has materially weaker independent assurance than desktop or Android. There is no demonstrated specific failure, but there is also no current dedicated full independent audit, and several advanced features are not established on the platform.
Has Mullvad ever been hacked? There is no confirmed operational compromise identified in the record reviewed here. The record does include one patched vulnerability and several independent audit findings with reported remediation, but audit findings are not the same as exploitation, and the incident history is incomplete rather than proven clean.
Is Mullvad’s account-number system secure? The 16-digit account number avoids conventional email and password exposure, but it functions as a shared secret. Possession alone permits login. Multi-factor authentication and ordinary rotation are not established, so protecting the number itself matters.
Does Mullvad use RAM-only servers? The reviewed evidence does not establish that Mullvad’s entire server fleet is RAM-only. A 2023 assessment independently examined two RAM-booted production-like relays. RAM booting can reduce how much data persists after shutdown, but it does not prevent inspection of live memory and does not eliminate administrator or hosting-provider access. The finding is sample-bound, not fleet-wide.
Is Mullvad post-quantum secure? Mullvad adds post-quantum material to key establishment on supported clients. That is a specific, scope-limited protection, not a claim that the whole tunnel is quantum-secure.
Is Mullvad safe for journalists or activists? Mullvad’s evidence case is not established as sufficient for users whose safety depends on verified resistance to compromised administrators, hosting providers, malicious updates, global correlation or state-level observation. That is a judgment about the limits of the evidence, not proof that Mullvad is unsafe. Journalists, activists and similar users face different risk profiles from one another and should weigh the unresolved infrastructure and binary-correspondence gaps against their own specific situation.
Continue your research: