Overview
Mullvad VPN stands apart in a crowded privacy market by removing the weakest link in most VPN services: the user identity tied to the account. Launched in 2009 and still priced at a flat €5 per month, this Sweden-based service generates a random account number with no email, no password, and no persistent identity link. For crypto-native privacy seekers, Mullvad represents the gold standard of no-KYC infrastructure, a tool you can fund, configure, and use without ever revealing who you are.
The service operates under parent company Amagicom AB, wholly owned by founders Fredrik Strömberg and Daniel Berntsson. Unlike venture-backed competitors chasing scale, Mullvad has resisted inflation, subscription traps, and data monetization for seventeen years. Its recent technical developments include GotaTun, a Rust-based WireGuard implementation now audited and deployed on Android, and the Mullvad Browser co-developed with Tor Project contributors.
Privacy & KYC
Mullvad achieves a KYC tier of L0, Trustless, meaning no account creation is required whatsoever. You generate a 16-digit account number on mullvad.net, pay to activate it, and connect. There is no email field, no phone verification, no social login, and no recovery flow that exposes identity.
- Logging policy: Strict no-logs with no activity or metadata retention; privacy policy explicitly states minimal data handling
- IP logging: No IP addresses stored; traffic encrypted and tunnelled through shared exit IPs
- Payments: Cash sent by post accepted since 2010; Monero, Bitcoin, and Bitcoin Cash supported with 10% crypto discount
- Jurisdiction: Sweden, 14 Eyes member, though Mullvad's no-data architecture renders this largely irrelevant
- Transparency: Regular independent audits (most recent payment-system audit by X41 D‑Sec GmbH in late 2025)
The cash-by-post option remains unique among mainstream VPNs: seal EUR, USD, GBP, or other accepted currencies with a payment token in an envelope, mail to Mullvad, and receive time credited to your account number. For the truly paranoid, this breaks the financial trail entirely.
Supported assets & payments
Mullvad accepts one of the broadest payment palettes in the VPN industry, deliberately structured to preserve anonymity at every tier. Cryptocurrency users benefit from 10% discounts due to lower processing overhead.
- Privacy-optimal: Monero (XMR), cash by post
- Crypto: Bitcoin (BTC), Bitcoin Cash (BCH)
- Traditional: Bank wire, credit card via Stripe, PayPal, Swish, EPS, Bancontact, iDEAL/Wero, Przelewy24
The flat €5 monthly rate applies universally, no annual-lock-in discounts, no lifetime deals, no predatory pricing. This sustainability-first model funds ongoing bandwidth expansion and security audits without compromising user privacy for growth metrics.
Security & custody
Mullvad is non-custodial by design: you hold your account number, and the service holds nothing identifiable about you. The VPN apps are fully open source across Windows, macOS, Linux, iOS, and Android, with the 2020 multi-platform security audit setting an early benchmark for industry transparency.
Technical features include WireGuard and post-quantum secure tunnels, with OpenVPN fully deprecated as of January 2026. Tor users can access Mullvad via onion mirrors for additional layering. The Mullvad Browser, built on Firefox Rapid Release as of 2026 and free regardless of VPN subscription, extends protection against fingerprinting and tracking beyond the tunnel.
Notable 2026 developments include forced tunneling on iOS despite persistent Apple networking stack bugs, and Android hardening against a discovered traffic-leak vulnerability in Android 16. Mullvad's security blog discloses issues promptly rather than burying them.
Who it's for, verdict
Mullvad VPN earns its 9.4/10 overall score by refusing to compromise on the fundamentals: identity separation, verifiable security, and sustainable operations. It is purpose-built for journalists in hostile environments, cryptocurrency users avoiding chain analysis, activists under surveillance, and anyone who recognizes that "anonymized" data is a marketing fiction.
The trade-offs are deliberate: no port forwarding, no affiliate program, no flashy marketing, and a support model that requires proactive outreach via email. Five-device limits and the absence of streaming-optimized servers may frustrate casual users seeking a Netflix unlocker. For the no-KYC privacy purist, these limitations are features, not bugs, evidence that Mullvad optimizes for threat-model resilience rather than mass-market appeal.
In 2026's landscape of data breaches, AI-driven traffic analysis, and regulatory overreach, Mullvad remains the VPN that privacy-conscious crypto users should default to when identity exposure is unacceptable.
