Most VPN reviews start by asking whether a product is good. Mullvad asks a different question first, because its pricing model leaves no other option.
There is one Mullvad VPN entitlement. Not a free tier with a paid upgrade sitting above it, not a “Plus” or “Pro” plan with extra capability behind a paywall: one entitlement, one standard direct price, one feature set. Whatever the product includes today is already included. Whatever it doesn’t include isn’t waiting behind a higher tier for a reader willing to pay more.
That structure changes what this review has to do. With a tiered competitor, a missing feature is often a pricing question: pay more, get more. With Mullvad, a missing feature is a fit question: either what you need is already in the one plan, or it isn’t, and no amount of money changes that. So this review starts there, not with a verdict, not with a feature list, but with the boundary of what a single fixed entitlement actually contains.
Once that’s settled, a second question follows, and it’s a different kind of question entirely. Mullvad describes its own servers, its administration model, and its specialist privacy features in real technical detail, more than a one-line marketing claim would require. Some of that description has been checked by outside assessors.
Some of it hasn’t.
How much unverified detail a reader is willing to accept before trusting it is a judgment this review can inform, but not make on anyone’s behalf.
Fit first. Trust second. That’s the order the evidence supports, and it’s the order this review follows.
Quick Verdict
Mullvad VPN is a single-entitlement, WireGuard-based VPN built around a numbered account and specialist capabilities including DAITA and post-quantum key establishment.
Inside the one plan: WireGuard, current obfuscation transports (Shadowsocks, QUIC, LWO, and UDP-over-TCP where supported), multihop, an in-app kill switch, in-tunnel SOCKS5, DAITA, post-quantum key establishment, and five simultaneous devices.
Not available at any price: inbound port forwarding, a dedicated or static IP, a sixth device on the same account, and split tunneling on iOS and iPadOS. If a reader needs one of these four, there’s no higher Mullvad plan available today that changes the answer, these are this review’s four hard boundaries, and they’re covered in full below.
Genuinely unresolved: current independent streaming tests contradict each other, and no current written P2P or torrenting policy was found in the record. Neither should be read as a quiet yes or a quiet no.
The second question, for readers who clear the first: Mullvad publishes a specific, technical description of its server infrastructure, and parts of it have been checked by outside assessors, Cure53, X41, and Android MASA all found real issues and confirmed fixes. That’s a genuine assurance record. It still stops short of continuous, fleet-wide, cross-platform verification, and Mullvad’s own specialist features don’t yet have independently audited deployed implementations either. Whether that gap matters depends on how much proof a reader personally requires.
Mullvad VPN at a Glance
| Metric | Current status |
|---|---|
| Direct price | One fixed VPN entitlement at €5 / 30 days, VAT included |
| Cryptocurrency discount | 10% for accepted cryptocurrencies |
| Duration tiers | No multi-month or multi-year discount tiers |
| Renewal model | Direct purchases are prepaid and expire; iOS purchases are one-time and non-recurring; Google Play recurrence isn’t established in current evidence |
| Refund | 14 days; cash and crypto payments excluded |
| Free trial | Not offered |
| Devices | 5 simultaneous devices per account; no paid expansion |
| Servers / countries / cities | 585 servers / 50 countries / 91 cities at the current snapshot (a volatile, first-party figure) |
| Protocol | WireGuard; OpenVPN was removed on 15 January 2026 |
| Obfuscation | Shadowsocks, QUIC, LWO, UDP-over-TCP where supported; iOS LWO is current |
| Platforms | Windows, macOS, Linux, Android, iOS/iPadOS, Android/Fire TV, manual WireGuard for routers |
| Split tunneling | Windows, macOS, Linux, Android; not available on iOS/iPadOS |
| Kill switch | In-app on every platform; Android adds an OS-level lockdown control that Android TV doesn’t get |
| Multihop | Available |
| DAITA | Available, on a server-limited basis |
| Post-quantum WireGuard | Available; Mullvad’s described mechanism uses Classic McEliece and ML-KEM |
| Port forwarding | Removed in 2023; not currently offered |
| Dedicated/static IP | Not currently offered |
| Streaming | Current independent results conflict: see below |
| P2P / torrenting | Current written policy not located: see below |
| SOCKS5 | Supported in-tunnel |
| Support | Email, Sweden-based, weekday CET |
| Independent performance | Near-baseline throughput on nearby routes in multiple current tests, with noticeably lower throughput on longer routes — see Performance below |
This table is the orientation layer, not the verdict. Streaming and P2P stay unresolved here on purpose; both get the fuller treatment they need further down.
What Mullvad VPN Actually Is
Mullvad sells one VPN entitlement. There’s no “Plus” tier above it and no cut-down free tier below it, whatever a reader gets for €5 every 30 days is the whole current product, in full.
That entitlement now runs on WireGuard. Mullvad retired OpenVPN from the service on 15 January 2026, and the current transport layer sits on top of WireGuard: Shadowsocks, QUIC, LWO, and UDP-over-TCP, each supported where the platform and server allow it, with LWO now current on iOS as well.
Two more specialized capabilities come bundled into that same single entitlement rather than gated behind an upsell: DAITA, a traffic-analysis defense that’s limited to specific servers, and post-quantum key establishment layered onto WireGuard’s handshake. Both matter to a narrower set of readers than the core VPN function does, and both get their own treatment later in this review.
Access to all of it is capped at five simultaneous devices, with no option to buy a sixth slot on the same account. Two adjacent products (Mullvad Browser and a separate Browser Extension) exist outside the VPN subscription entirely and don’t require one; they’re worth a brief mention later, but they’re not part of what you’re paying for here.
Not every platform gets the same treatment, either. Split tunneling, for instance, works on desktop and Android but not on iOS or iPadOS: a difference substantial enough that it’s one of this review’s four hard boundaries, not a footnote.
Pricing and the One-Plan Model
The direct price is €5 per 30 days, VAT included. Pay with an accepted cryptocurrency and that drops by 10%. There’s no multi-month or annual discount tier, the 30-day price is the price, whether a reader plans to stay a month or five years.
Direct purchases work as prepaid time: buy a block of days, and it counts down to zero rather than auto-renewing. iOS purchases are explicitly one-time and non-recurring. What happens with recurrence through Google Play isn’t established in the current record, so this review doesn’t guess at it either way.
Refunds are available within 14 days of a direct purchase; cash and cryptocurrency payments are excluded from that window, and purchases made through an app store or reseller are handled by the seller rather than by Mullvad directly. There’s no free trial.
Mullvad also states it runs no affiliate program and doesn’t pay reviewers or influencers for coverage or backlinks. That’s a fact about Mullvad’s own commercial conduct. It says nothing about the objectivity of any particular piece of writing about Mullvad, including this one, and it shouldn’t be read that way.
None of this pricing detail is really the point on its own. The point is structural: because there’s only one entitlement, price is never a lever a reader can pull to unlock more capability. That has a direct consequence, and it’s the next thing this review has to deal with.
Whether €5 represents good value is a separate question, covered in Is Mullvad Worth It?. This review is concerned with what the fixed entitlement includes and excludes, not whether it’s a good deal.
What Mullvad Can’t Do, and Why Paying More Won’t Change That
Because there’s no higher tier, anything missing from the single entitlement is missing for every customer, at every price they might be willing to pay. Four capabilities currently fall into that category.
Port forwarding. Mullvad disabled new port allocations in May 2023 and removed existing forwarded ports that July. Nothing has replaced it since, and no paid option restores it. Anyone whose setup depends on inbound port forwarding (certain P2P clients, some self-hosted services, some game-hosting configurations) runs into this regardless of what they’re willing to spend.
A dedicated or static IP. Mullvad doesn’t currently offer one for consumers. Readers who need a consistent, assignable address for allow-listing or remote access won’t find it here, at any price point.
More than five devices. The account ceiling is five simultaneous connections, and there’s no mechanism to add a sixth to the same account. A household or workflow that needs more either runs multiple accounts or works within the limit.
Split tunneling on iOS and iPadOS. Mullvad states this isn’t currently possible on those platforms, even though it’s available on Windows, macOS, Linux, and Android. It’s a platform-specific gap, not a company-wide one.
None of these four should be read as evidence of anything beyond what they are. They’re not proof of minimalist design philosophy, and they’re not proof of weak engineering, they’re capabilities the current product doesn’t have, and because there’s no upgrade path, “doesn’t have yet” and “doesn’t have” mean the same thing for anyone deciding today. Whether any of the four actually matters depends entirely on what a given reader needs. A reader who never touches port forwarding or split tunneling won’t feel these boundaries at all.
Does Mullvad Work for Streaming?
Current independent results disagree with each other, and this review isn’t going to force them into a single answer the evidence doesn’t support.
Security.org’s July 2026 testing describes inconsistent access to major streaming platforms. VPNVerdict, testing from a self-published Frankfurt VPS setup in April 2026, reports failures across Netflix US, BBC iPlayer, Disney+, Hulu, and Max. Cloudwards’ July 2026 review reports first-try access to Netflix US, Prime Video, Disney+, and BBC iPlayer. Three sources, three different outcomes: and the differences in server, date, region, and method mean they can’t just be averaged into a majority verdict.
What that means for a reader matters more than what it means for Mullvad in the abstract. If reliable, repeatable access to a specific streaming service is a hard requirement, the current evidence doesn’t support committing to Mullvad with confidence, the uncertainty itself is the fact worth acting on, not a hidden confirmed failure. If streaming is a nice-to-have rather than a requirement, this is a minor qualification rather than a deciding factor.
Does Mullvad Work for Torrenting and P2P?
Two separate questions live under this heading, and they get two separate answers.
Is there a current, explicit, written P2P or torrenting policy? Not one that turned up in the evidence reviewed for this piece. That’s not the same as a restrictive policy, and it’s not the same as a permissive one. Reputation, the absence of observed blocking, or past reviewer experience don’t amount to a stated entitlement, so this review isn’t converting any of that into a policy claim in either direction.
Is port forwarding available for P2P use? No, and this part is settled, not uncertain. Port forwarding was removed in 2023, as covered above, and that removal holds regardless of what the broader P2P policy eventually turns out to be.
Readers whose torrenting setup specifically depends on inbound port forwarding are facing a real, resolved limitation. Readers asking the wider question, is Mullvad P2P-friendly?, are asking something the current written record simply doesn’t answer.
Account Setup and Privacy Architecture
Signing up creates a randomly generated numbered account. No username, no password, no email address required. That’s a genuine reduction in the identifying information Mullvad collects at signup, and it’s fair to call it data minimization.
It’s not the same thing as anonymity, and this review won’t use that word for it. The payment method a reader chooses still creates a linkability trail that differs by channel, cash and certain cryptocurrency payments behave differently from card or PayPal in terms of what records exist. And the WireGuard connection itself involves Mullvad storing the account number alongside a public key and tunnel address for as long as that configuration stays active.
The account number is also the entitlement credential itself, and that creates a real trade-off. Because there’s no username, password, or email tied to the account, there’s no conventional email-and-password recovery path if that number gets lost. This isn’t a separate flaw sitting next to the minimization design, it’s the same design choice, seen from its other side. A reader who wants the reduced signup footprint is accepting the recovery trade-off that comes attached to it; a reader who wants conventional account recovery will find this model unfamiliar.
Mullvad states it doesn’t retain traffic, DNS, connection-timestamp, source-IP, or bandwidth logs tied to an account. That’s a stated policy, and its evidentiary weight is discussed alongside the infrastructure material below rather than treated as separately proven here.
Mullvad has also reported that Swedish authorities visited its Gothenburg office with a search warrant in April 2023 and left without taking customer equipment or information. That account comes from Mullvad itself; no independent government record confirming the full sequence turned up in this research, so it shouldn’t be read as independent proof of the company’s no-logs claims: it’s a company-reported event, not a verified one.
(L)Is Mullvad Private?(L) goes deeper into the account-minimization model and what it does and doesn’t establish.
Is Mullvad’s Infrastructure Actually Secure?
Mullvad describes its server infrastructure in more specific technical detail than a one-line marketing claim would require. Current first-party documentation states that its servers run entirely from RAM with no persistent storage, that the hardware is owned or dedicated-rented rather than virtualized, that each server uses unique credentials, and that remote administration runs through bastion-host controls that restrict the provider’s own access to the underlying operating system.
That description deserves to be taken seriously as a specific, falsifiable technical claim, not waved off as marketing language. It also needs to stay in its proper category: it’s Mullvad’s own current description of its own infrastructure, and no independent assessment in the current record covers that exact claim set, at fleet-wide scale, today.
The closest independent touchpoint is a June 2024 engagement by Cure53, a white-box penetration test and source-code review of Mullvad’s WireGuard and then-current OpenVPN relay infrastructure, carried out by three senior testers over 16 days. It documented one Medium-severity finding (a bypass of an unauthorized-login check) and one Low-severity finding (a local privilege-escalation path), both fixed during the engagement itself and recorded as fixed in Cure53’s final report. No separate later retest artifact was located. This is scoped, dated evidence about specific relay systems in 2024, not a 2026 fleet-wide audit, and not evidence of any incident, breach, or current vulnerability. A finding that gets caught and fixed inside an audit is evidence the audit-and-remediation process works, not evidence the product was previously insecure in production. The OpenVPN-specific portion of this engagement is now historical, following OpenVPN’s removal from the current service.
A separate engagement by X41, carried out in late 2024, assessed Mullvad’s Android, iOS, and Desktop apps at specific named versions and found six vulnerabilities (three rated High, two Medium, one Low) spanning memory and race-condition issues, an installer sideloading issue, local-network and tunnel-IP leakage, a NAT-deanonymization side channel, and MTU-based traffic correlation. Mullvad implemented fixes, and X41 states those fixes were audited and confirmed working within the engagement. This is bounded to the app versions in scope at the time and doesn’t extend to a claim that current 2026 apps carry no comparable issues.
Android has two further, separate pieces of evidence, and they shouldn’t be merged with each other. Android MASA — an external, Android-specific assessment run in 2026, evaluated version 2026.2, identified several items (one later determined to be a false positive, one not applicable), and retested the addressed issues in version 2026.3-beta3 before the app passed. That’s a real, current, external assessment with a documented retest cycle. Separately, Mullvad has offered reproducible builds on Android from app version 2025.2 onward, a mechanism that in principle lets a third party verify a published binary matches the published source. That’s a capability, not an audit result, and no independent party’s actual reproduction of a current 2026 binary turned up in the evidence reviewed here. MASA passing doesn’t prove reproducible builds work as intended, and the reproducible-build mechanism existing doesn’t prove MASA-style review has happened on other platforms. Neither extends to iOS, Desktop, or the infrastructure layer.
Taken together, this is a real assurance record: multiple named, dated, scoped external assessments, with documented findings and documented remediation. It stops short of continuous, fleet-wide, cross-platform independent verification of Mullvad’s current infrastructure and app builds. That specific gap (detailed first-party description, paired with scoped independent checking, short of full current verification) is the throughline that also runs through the specialist features covered next.
Is Mullvad Safe? covers this assurance record in more depth.
DAITA and Post-Quantum WireGuard
Both of these are real, currently deployed capabilities included in the single entitlement, not add-ons, and not marketing concepts without a working mechanism behind them. Both also share the same evidentiary shape as the infrastructure claims above: a specific, described mechanism, with independent validation of the deployed implementation still outstanding.
DAITA is a traffic-analysis defense. Mullvad describes it as working through background cover traffic and packet shaping, intended to reduce what an observer watching encrypted traffic timing, size, and direction could infer. It has an academic and open-research basis (the Maybenot framework, developed with Karlstad University) and it’s currently deployed on a server-limited basis rather than across the entire fleet; connecting through a DAITA-capable server may route through multihop unless a reader specifically selects Direct only. Mullvad states DAITA can add traffic and reduce speed. No independent audit of DAITA’s actual deployed implementation, as distinct from its published research basis, turned up in the current evidence.
The reader-relevant question isn’t whether DAITA exists (it does) it’s who actually benefits from it. It addresses a fairly specific threat model: an adversary capable of observing encrypted traffic patterns at scale. That’s different from wanting to avoid ISP throttling, protect a connection on public Wi-Fi, or change an apparent location, which a VPN handles regardless of DAITA. For readers specifically concerned about traffic-analysis observation, DAITA is a genuine, currently available capability. For readers without that specific concern, it’s present but unlikely to be a deciding factor, and its overhead is a cost without a matching benefit for their situation.
Post-quantum WireGuard addresses a different threat model: an adversary that captures encrypted traffic today and stores it, hoping to decrypt it later once quantum computing capability exists to break current encryption, a record-now, decrypt-later scenario. Mullvad’s current description involves adding post-quantum key-establishment algorithms, Classic McEliece and ML-KEM, into WireGuard’s pre-shared-key mechanism, and the capability is currently supported across the core app lineup. No public independent cryptographic or implementation validation of Mullvad’s specific integration turned up in the current evidence.
This matters most to readers whose data carries long-horizon sensitivity, the kind of traffic still worth decrypting years from now. It’s largely beside the point for short-horizon, everyday VPN use like streaming or general browsing, since the threat it addresses is a future one. This review avoids describing the feature as quantum-proof, fully quantum-resistant, or future-proof, since none of those claims is what the current evidence supports. What’s supported is a specific, described mechanism addressing a specific threat model, without independent confirmation that the deployed implementation behaves exactly as described.
Platform-by-Platform Fit
Mullvad’s core VPN function is available across Windows, macOS, Linux, Android, iOS/iPadOS, Android/Fire TV, and manual WireGuard configuration for routers. Coverage is broad, but the specifics aren’t identical everywhere.
The clearest asymmetry, already established above as a hard boundary, is iOS and iPadOS: no split tunneling, while Windows, macOS, Linux, and Android all get it. iOS does currently support LWO obfuscation, so the platform isn’t uniformly behind: the gap is specifically split tunneling.
Android TV has its own difference: the OS-level “block connections without VPN” control available on standard Android isn’t present there, which changes the kill-switch guarantee a reader gets on a TV device compared to a phone or tablet running the same core VPN.
More broadly, specialist-feature parity (DAITA, multihop, LWO) is incomplete on TV and router platforms compared to desktop and mobile. Core VPN protection still works there; it’s the newer specialist capabilities that haven’t caught up everywhere yet.
None of this changes the four hard boundaries covered earlier, which apply regardless of platform. This section is about implementation differences within platforms that already have the core product available.
Performance: What Independent Testing Shows
No synthetic STACK benchmark was run for this review, and none should be implied. What’s available is a small set of current, independently published tests, each using its own methodology, environment, and date, and they shouldn’t be blended into a single number.
Security.org’s testing, published 28 July 2026, recorded a baseline of roughly 94.6–94.7 Mbps with about 3ms of latency, dropping to around 92.4–91.8 Mbps at 12ms on nearby routes, 84.7–80.3 Mbps at 61ms to Japan, and 71.2–65.4 Mbps at 142ms to South Africa.
VPNVerdict’s April 2026 testing, run from a Frankfurt-based Hetzner VPS using iperf3 over a 1 Gbps symmetric connection, recorded a baseline around 940/935 Mbps, roughly 910/850 Mbps at 12ms to Stockholm, dropping to about 390/340 Mbps at 98ms for New York, and around 140/110 Mbps at 188ms for Singapore.
Cloudwards’ July 2026 review, using a more limited testing framework, generally reported download speeds above 90 Mbps to US endpoints on a 100/10 Mbps connection, with one recorded dip.
Read together, the pattern is consistent even though the absolute numbers differ by methodology: near-baseline throughput on the nearby routes tested, with noticeably lower throughput on the longer routes tested. That’s a reasonable, evidence-supported summary. It isn’t enough to call Mullvad universally fast or slow, and the current evidence doesn’t support a specific DAITA overhead figure, a multihop performance figure, or a direct comparison against any other provider.
Mullvad Browser and the Browser Extension
Three distinct things share the Mullvad name here, and they shouldn’t be treated as one product.
Mullvad Browser is a separate, free browser developed by the Tor Project in collaboration with Mullvad. It doesn’t require a Mullvad VPN subscription and doesn’t include a built-in VPN tunnel: it’s a privacy-focused browser, not a VPN delivery mechanism.
Mullvad Browser Extension is a separate companion extension. It isn’t itself a VPN app, but it can interact with Mullvad’s current in-tunnel SOCKS5 proxy to route browser traffic through another Mullvad server while the underlying VPN connection is active.
A lightweight, browser-only Mullvad VPN extension (a way to get VPN protection without the full app) isn’t offered. Readers specifically looking for that kind of option won’t find it here.
These are useful context for readers curious about Mullvad’s wider privacy ecosystem, including its collaboration with the Tor Project, but they’re supporting information rather than part of the VPN product’s core capability set.
Who Owns Mullvad
The operating entity is Mullvad VPN AB, based in Sweden. Mullvad states that Mullvad VPN AB is wholly owned by Amagicom AB, which functions as the accounting parent, and that founders Daniel Berntsson and Fredrik Strömberg each hold 50% of Amagicom AB. Both of those specifics are provider-stated; the exact current economic split, any distinct share classes, and voting rights weren’t independently verified in the evidence reviewed here.
This review doesn’t draw any inference about privacy or security behavior from who owns the company: ownership structure and product trustworthiness are separate questions, and the evidence connecting them isn’t in the record. Ownership is included here as background context rather than as part of the fit or trust arguments made elsewhere.
Who Owns Mullvad? covers the ownership structure in more depth.
Who Mullvad VPN Is For
Two questions decide fit here, in order.
Does the reader need something Mullvad doesn’t offer? Readers who need inbound port forwarding, a dedicated or static IP, a sixth simultaneous device on one account, or iOS/iPadOS split tunneling have their answer already, none of those can be added by paying more, so this decision is effectively made regardless of anything else in this review. Readers whose needs sit comfortably inside the current entitlement move on to the second question.
Does the available evidence meet the reader’s own trust threshold? A reader satisfied by a real pattern of scoped, dated external assessments with documented remediation (Cure53, X41, Android MASA) combined with a specific, detailed first-party infrastructure description, will likely find the current record sufficient. A reader who requires continuous, fleet-wide, cross-platform, deployed-implementation-level independent verification before trusting infrastructure and specialist-feature claims will find the current record real as far as it goes, but still short of that bar.
Layered on top of both: readers who specifically require predictable, repeatable named-service streaming access should treat the current contradictory test evidence as a genuine source of uncertainty, not something they can assume will work out. Readers whose primary interest is protection against traffic-analysis observation, or long-horizon data sensitivity, will find DAITA and post-quantum WireGuard genuinely relevant; readers without those specific concerns will find both present but not decision-relevant.
Conclusion
Mullvad VPN comes down to one question before any other: does what you need fit inside a single, fixed entitlement?
If it does, there’s no higher-plan decision left to make. WireGuard, current obfuscation transports, multihop, an in-app kill switch, in-tunnel SOCKS5, and both of Mullvad’s specialist features (DAITA and post-quantum key establishment) are all included at the one price, across up to five devices, with nothing held back for a tier that doesn’t exist. Availability still varies by platform in specific ways: split tunneling and specialist-feature parity in particular aren’t identical across every device a reader might connect.
For four specific capabilities, the answer is no, and paying more doesn’t change it: inbound port forwarding, a dedicated or static IP, a sixth simultaneous device on the same account, and split tunneling on iOS or iPadOS. Because there’s no higher Mullvad plan to move into, a reader who needs any one of these isn’t choosing not to upgrade: there’s nothing to upgrade to. That makes this the first and most decisive question in the review. A reader who runs into one of these four boundaries has their answer already, independent of everything else covered here.
For readers whose requirements clear that bar, a second and separate question follows: how much independent confirmation do you need before trusting what Mullvad says about its own infrastructure and specialist features? Mullvad describes its server architecture (RAM-only operation, no persistent storage, unique per-server credentials, restricted administrative access) in real technical detail, and parts of that broader picture have been checked by outside assessors: Cure53 on relay infrastructure, X41 across its apps, Android MASA on the Android build. Those engagements also provide different kinds of remediation evidence: Cure53 documented fixes made during its assessment, X41 says the implemented fixes were audited and working, and the 2026 Android MASA process explicitly retested addressed issues before the app passed. None of them, individually or together, amounts to continuous, fleet-wide, cross-platform verification of every current claim, and the same gap applies to DAITA and post-quantum WireGuard specifically, both are real, deployed capabilities with a described mechanism, and neither has an independently audited deployed implementation yet. A reader satisfied by scoped, documented, repeated external checking will likely find the current record sufficient. A reader who requires ongoing, comprehensive independent verification before extending trust will find it, honestly, still short of that.
DAITA and post-quantum WireGuard are worth weighing only against what a reader actually needs them for. DAITA addresses traffic-analysis observation specifically; post-quantum key establishment addresses long-horizon, record-now-decrypt-later exposure specifically. Neither changes the experience of a reader without those particular concerns, and neither should be treated as a general upgrade to privacy or security on its own.
Put together: Mullvad VPN fits readers whose needs live inside its one entitlement, and who are comfortable with the current mix of detailed first-party description and scoped, real, but incomplete independent verification. It’s a harder fit for readers who need any of the four boundary capabilities, or who require a fuller independent verification record than currently exists, regardless of how well the rest of the product performs.
The STACK View
When there’s no upgrade tier, a missing capability stops being a pricing decision and becomes a product-fit decision.
Mullvad makes that especially visible because there is nowhere else inside the product line to go. If you need port forwarding, a dedicated IP, more than five simultaneous connections, or iOS split tunneling, paying more doesn’t change the answer. The boundary belongs to the product itself, not to the price you chose.
There is a similar distinction in the evidence. Technical transparency and independent verification are useful for different reasons. Mullvad can describe RAM-only servers, administration controls, DAITA, and post-quantum key establishment in substantial technical detail. Independent assessments tell us something different: exactly what an outside party inspected, when it inspected it, and what happened to the findings.
Neither substitutes for the other. Knowing what has been described is not the same as knowing what has been independently tested, and keeping those two questions separate is a better way to judge any product that asks for technical trust.
FAQs
Is Mullvad VPN safe to use? Mullvad describes its infrastructure in specific technical detail (RAM-only servers, no persistent storage, unique per-server credentials) and parts of its apps and infrastructure have been independently assessed by Cure53, X41, and Android MASA, each finding and fixing real issues within scoped, dated engagements. None of that amounts to continuous, fleet-wide independent verification of every current claim.
Is Mullvad VPN private? Mullvad uses a numbered-account model that doesn’t require a username, password, or email address, which reduces the identifying information collected at signup. That’s data minimization, not anonymity, payment method still affects linkability, and account-number retention is required for recovery.
Does Mullvad VPN keep logs? Mullvad states it doesn’t retain traffic, DNS, connection-timestamp, source-IP, or bandwidth logs tied to an account. This is a stated policy; independent fleet-wide verification of that exact claim wasn’t located in the current evidence.
Is Mullvad VPN good for streaming? Current independent test results are inconsistent, different testers report different outcomes for the same major streaming platforms. Readers who need reliable, repeatable access to a specific service should treat this as an open uncertainty rather than a confirmed yes or no.
Can you torrent with Mullvad VPN? A current, explicit, written P2P policy wasn’t located in the evidence reviewed here, so this remains unresolved rather than confirmed either way. Separately, Mullvad’s port-forwarding capability was removed in 2023 and isn’t currently offered, which affects some torrenting setups regardless of the broader P2P question.
Does Mullvad support port forwarding? No. New port allocations were disabled in May 2023 and existing forwarded ports were removed in July 2023. There’s no current replacement, and there’s no higher Mullvad plan available today that restores it.
How much does Mullvad cost? The standard direct price is €5 per 30 days, VAT included, with a 10% discount for accepted cryptocurrency payments. There are no direct multi-month or multi-year discount tiers.
Does Mullvad auto-renew? Direct purchases are prepaid and expire rather than auto-renewing. iOS purchases are explicitly one-time and non-recurring. Recurrence behavior through Google Play wasn’t resolved in the current evidence.
How many devices does Mullvad support? Five simultaneous devices per account, with no option to add more on the same account.
What is DAITA? DAITA is Mullvad’s traffic-analysis defense, using background cover traffic and packet shaping to reduce what an observer could infer from encrypted traffic patterns. It’s currently deployed on a server-limited basis and can add traffic or reduce speed; its deployed implementation hasn’t been independently audited.
Does Mullvad support post-quantum encryption? Mullvad adds post-quantum key establishment to WireGuard to address a record-now, decrypt-later threat model, the risk that an adversary captures encrypted traffic today and attempts to decrypt it later using future quantum computing capability. No independent implementation validation was located in the current evidence.
Who owns Mullvad? Mullvad VPN AB is the operating entity. Mullvad states it’s wholly owned by Amagicom AB, and that founders Daniel Berntsson and Fredrik Strömberg each hold 50% of Amagicom AB. The exact current economic and voting split wasn’t independently verified.