A VPN that lets you sign up without an email address, pay in cash, and run encryption built to resist quantum computers is not the industry norm. Mullvad VPN, developed in Sweden, has built its entire reputation on treating anonymity as a design principle rather than a marketing line. Our October 2026 retest of the service confirms it remains among the most technically capable privacy tools available, though it is not without trade-offs.
Mullvad's account system illustrates that philosophy well. Instead of an email and password, the service generates a random 16-digit number that functions as your entire identity within the system. There is no profile, no billing history tied to a person, and no customer record beyond that number. Once you've created an account, installing the apps for iOS and Android or desktop clients takes only a few minutes, and the apps themselves are clean, responsive, and consistent across platforms. That consistency matters: a VPN's security promises are only as good as the software implementing them, and Mullvad's clients have historically held up well under scrutiny.
Pricing Built Around Anonymity, Not Marketing
Mullvad charges a flat €5 (or $5.90) per month regardless of how long you commit, whether that's one month or a year. There are no introductory discounts or renewal traps common elsewhere in the industry. Payment options extend to cryptocurrency, standard cards, PayPal, and even physical cash mailed to Mullvad's Swedish address alongside a printed account number - a method that forfeits refund eligibility but maximizes anonymity for those who want it. The company recently shortened its refund window from 30 days to 14, a change worth noting for anyone testing the service before committing further funds.
Encryption, Obfuscation, and the Shift to WireGuard
Mullvad's technical architecture centers entirely on WireGuard now that OpenVPN has been retired from the app. That decision reflects a broader trend in the VPN industry: WireGuard's leaner codebase and faster handshake process make it easier to audit and harder to exploit than older protocols. Mullvad's own implementation, called GotaTun, is written in Rust and tuned for lower memory use and steadier speeds, particularly on mobile devices where battery and processing overhead matter.
Layered on top of WireGuard are several defensive measures aimed at threats that go beyond simple traffic interception. DAITA, Mullvad's defense against AI-guided traffic analysis, obscures patterns in packet size and timing that machine-learning systems might otherwise use to infer what a user is doing online, even through encrypted tunnels. Quantum-resistant key exchange adds protection against a longer-term threat: the possibility that encrypted data captured today could be decrypted once sufficiently powerful quantum computers exist. Shadowsocks obfuscation and MultiHop routing, which sends traffic through two VPN servers instead of one, further mask the fact that a VPN is being used at all - useful in restrictive network environments, though both come with measurable speed costs.
Jurisdiction and the Limits of Technical Trust
No technical feature set changes where a company is legally headquartered, and this is where Mullvad's story gets more complicated. Sweden belongs to the so-called 14 Eyes intelligence-sharing alliance, a group of countries with established surveillance and data-retention frameworks. A strict no-logs policy and RAM-only servers, which erase data on every reboot, meaningfully reduce what could ever be handed over even under legal pressure, but jurisdiction remains a structural risk that technology alone cannot erase. Users weighing Mullvad against providers based outside such alliances should treat that distinction as a genuine factor, not a formality.
Where the Experience Falls Short
Mullvad caps simultaneous connections at five, modest compared to competitors offering double that, and it has no native support for routers, streaming boxes, or game consoles. Split tunneling works only at the app level, not by domain. For users with large multi-device households or smart-TV streaming needs, these limitations are real considerations, even if the underlying privacy engineering remains among the strongest on the market.
