Mullvad VPN reference. Account setup without email, WireGuard/OpenVPN configuration, multihop, post-quantum tunnels, DNS leak prevention, kill switch, RAM-only servers, and OPSEC best practices.
Mullvad is a privacy-focused VPN provider that requires zero personal information to sign up. Your account is a randomly generated 16-digit number - no email, no phone, no name.
| Property | Detail |
|---|---|
| Protocols | WireGuard (recommended), OpenVPN |
| Pricing | Flat 5 EUR/month, no multi-month discounts |
| Jurisdiction | Sweden |
| Intelligence alliance | 14 Eyes member, but no mandatory VPN data retention law |
| Server count | 700+ in 40+ countries (2026) |
| Max devices | 5 simultaneous connections |
| DNS | Own DNS resolver inside tunnel (10.64.0.1) |
| IPv6 | Full support |
| Multihop | Yes (entry + exit in different countries, WireGuard both hops) |
| Kill switch | Built-in (enabled by default) |
| Post-quantum | Yes (quantum-resistant key exchange alongside classical) |
| DAITA | Yes (AI traffic analysis defense) |
| Mullvad Browser | Hardened Firefox fork (co-developed with Tor Project) |
Pricing transparency: Mullvad charges a flat rate with no discounts for longer plans. This avoids dark patterns and subscription traps.
On April 18, 2023, six officers from Sweden's NOA (National Operations Department) arrived at Mullvad's Gothenburg office with a search warrant. The warrant was issued as part of an international investigation coordinated through Europol, involving cooperation with German authorities.
The officers intended to seize customer data, including server contents and communications.
Result: Mullvad demonstrated they had nothing to hand over. No customer data exists - no logs, no usage records, no IP mappings. The police left empty-handed.
Key facts:
This is the strongest real-world validation of a no-logs claim by any VPN provider. However, see the Zero Trust section below.
| Date | Auditor | Scope | Result | Source |
|---|---|---|---|---|
| 2018 | Cure53 + Assured | App + infra | Initial assessment | Report |
| 2020 | Cure53 | App all platforms (20 days) | 0 critical, 0 high. "Mature design." | Report |
| 2022 | Assured AB | Server infra | Confirmed RAM-only, no-logs | Blog |
| 2024 | X41 D-Sec | App all platforms (30 days) | 0 critical, 3 high (fixed). "High security level." | Blog |
| 2024 | Cure53 | Infrastructure (4th audit) | No critical findings | Blog |
| 2025 | Assured AB | Web app | 0 critical/high/medium, 1 low (fixed) | Blog |
All reports published publicly: github.com/mullvad/mullvadvpn-app/audits. The combination of independent audits, open source code, and a real-world raid with zero data makes Mullvad the most verifiable VPN provider.
Mullvad appears to be the most trustworthy commercial VPN based on available evidence: the raid, audits, open source code, and consistent no-logs practice. However, building your entire OPSEC on a single provider is a fundamental mistake.
Core principle: no VPN provider can be trusted 100%, regardless of track record.
Layer your defenses:
- Mullvad + Tor for sensitive operations (VPN -> Tor)
- Mullvad + MAC randomization on all devices
- Mullvad + compartmentalized identities (separate accounts per persona)
- Mullvad + Whonix for maximum isolation
- Mullvad + Mullvad Browser for fingerprint resistance
Payment discipline:
- Cash (mail envelope to Sweden) or Monero only
- Never pay with identity-linked methods for operational accounts
Network discipline:
- Don't connect from identifiable networks when possible
- Use public Wi-Fi or mobile hotspot with randomized MAC
- Never reuse the same account across different identities
- Rotate servers between sessions
What could go wrong even with Mullvad:
- Mullvad could be secretly compelled (NSL-equivalent in Sweden)
- Hardware-level implants on servers in hostile datacenters
- Traffic correlation by a global passive adversary (NSA-class)
- Mullvad employees could be compromised individually
- Legal framework in Sweden could change silently
Mitigation: never rely on VPN alone. Add Tor, compartmentalize,
use amnesic OS (Tails), and assume the tunnel is observed.
Create an account at mullvad.net with zero personal information. The generated 16-digit number is your only credential - treat it like a master password.
Account creation flow:
Step 1: Go to mullvad.net/account (via Tor Browser for OPSEC)
Step 2: Click "Generate account number"
Step 3: You receive: XXXX-XXXX-XXXX-XXXX
Step 4: Save this number securely (password manager or paper)
Step 5: Add time to the account via payment
OPSEC notes:
| Method | Anonymity | Notes |
|---|---|---|
| Cash (envelope) | Highest | Mail EUR/USD to Mullvad's address in Sweden |
| Monero (XMR) | Very high | Privacy coin, no blockchain tracing |
| Bitcoin (BTC) | Medium | Pseudonymous, blockchain is public |
| Voucher code | High | Buy with cash at resellers |
| Credit card | Low | Linked to your identity |
| PayPal | Low | Linked to your identity |
| Bank wire | Low | Linked to your identity |
For maximum anonymity, use cash (envelope to Mullvad HQ in Gothenburg, Sweden) or Monero. Bitcoin is acceptable if coins are from a non-KYC source.
# Sending cash: include your account number on a paper inside the envelope
# Mullvad AB, Box 53049, 40014 Gothenburg, Sweden
# Paying with Monero via CLI
# Get payment address from mullvad.net/account
# Send exact amount from your Monero wallet
monero-wallet-cli transfer <mullvad_xmr_address> <amount>
WireGuard is the recommended protocol - faster, simpler, and more modern than OpenVPN. Smaller attack surface with roughly 4,000 lines of code.
# Install WireGuard
sudo apt install wireguard resolvconf
# Option 1: Download config from mullvad.net/account/wireguard-config
# Select country/city, download .conf file, place in /etc/wireguard/
# Option 2: Generate key pair locally and register with Mullvad API
wg genkey | tee privatekey | wg pubkey > publickey
# Submit public key to Mullvad
curl -sSL https://api.mullvad.net/wg/ \
-d account=XXXXXXXXXXXXXXXX \
-d pubkey=$(cat publickey)
# Returns: your assigned tunnel IP (e.g., 10.66.X.X)
Configuration file:
# /etc/wireguard/mlvd.conf
[Interface]
PrivateKey = <your_private_key>
Address = 10.66.X.X/32
DNS = 10.64.0.1
[Peer]
PublicKey = <mullvad_server_pubkey>
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = <server_ip>:51820
Connection management:
# Connect
sudo wg-quick up mlvd
# Disconnect
sudo wg-quick down mlvd
# Check connection status
sudo wg show
# Auto-start on boot
sudo systemctl enable wg-quick@mlvd
# Switch servers: swap config and reconnect
sudo wg-quick down mlvd
sudo cp /etc/wireguard/configs/se-got.conf /etc/wireguard/mlvd.conf
sudo wg-quick up mlvd
The official Mullvad app handles WireGuard configuration automatically. Download from mullvad.net/download.
Setup steps (all platforms):
Step 1: Download and install Mullvad app
Step 2: Enter 16-digit account number
Step 3: Select server location from the map or list
Step 4: Click Connect - WireGuard is auto-configured
App features:
- Built-in kill switch (enabled by default)
- Split tunneling (exclude apps)
- Auto-connect on startup
- Multihop configuration via GUI
- DAITA toggle
- Post-quantum tunnel toggle
Verify download integrity:
# Linux .deb - verify GPG signature
# Import Mullvad signing key (sks-keyservers.net is defunct, use keys.openpgp.org)
gpg --keyserver keys.openpgp.org --recv-keys A1198702FC3E0A09A9AE5B75D5A1D4F266DE8DDF
# Verify signature
gpg --verify MullvadVPN-xxxx.x_amd64.deb.asc MullvadVPN-xxxx.x_amd64.deb
Running Mullvad on the router protects all devices on the network without per-device configuration. Useful for IoT devices and guests.
# OpenWrt: install WireGuard packages
opkg update
opkg install wireguard-tools luci-proto-wireguard
# Create WireGuard interface in /etc/config/network
uci set network.mullvad=interface
uci set network.mullvad.proto='wireguard'
uci set network.mullvad.private_key='<your_private_key>'
uci add_list network.mullvad.addresses='10.66.X.X/32'
uci set network.mullvad.dns='10.64.0.1'
# Add peer
uci add network wireguard_mullvad
uci set network.@wireguard_mullvad[-1].public_key='<server_pubkey>'
uci set network.@wireguard_mullvad[-1].endpoint_host='<server_ip>'
uci set network.@wireguard_mullvad[-1].endpoint_port='51820'
uci set network.@wireguard_mullvad[-1].allowed_ips='0.0.0.0/0'
uci set network.@wireguard_mullvad[-1].persistent_keepalive='25'
uci commit network
/etc/init.d/network restart
GL.iNet routers (e.g., Mudi, Beryl) have a built-in WireGuard client. Paste the Mullvad .conf file into the admin panel under VPN > WireGuard Client.
OpenVPN is slower than WireGuard but useful for censorship bypass (can run over TCP 443, looks like HTTPS). Download .ovpn config files from your Mullvad account page.
# Install OpenVPN
sudo apt install openvpn
# Download configs from mullvad.net/account/openvpn-config
# Place in /etc/openvpn/
# Connect
sudo openvpn --config /etc/openvpn/mullvad_se_got.conf
# Or as systemd service
sudo cp mullvad_se_got.conf /etc/openvpn/client/mullvad.conf
sudo systemctl start openvpn-client@mullvad
sudo systemctl enable openvpn-client@mullvad
For networks that block VPN protocols (corporate firewalls, state censorship), Mullvad supports OpenVPN over Shadowsocks and bridges.
# OpenVPN over TCP port 443 (looks like HTTPS)
# Select TCP 443 configs from the account page
# Mullvad bridge mode (Shadowsocks)
# In Mullvad app: Settings > Advanced > Bridge mode > On
# Automatically routes OpenVPN through Shadowsocks proxy
# Manual Shadowsocks setup
# Install shadowsocks-libev
sudo apt install shadowsocks-libev
# Mullvad provides bridge server details on account page
# Configure ss-local to proxy OpenVPN through Shadowsocks
Routes traffic through two Mullvad servers in different countries. Both hops use WireGuard. The entry server knows your IP but not your traffic, the exit server sees your traffic but not your real IP.
You -> Entry (Country A) -> Exit (Country B) -> Internet
Example: You -> Sweden (entry) -> Romania (exit) -> Internet
Security benefits:
- Two different legal jurisdictions
- Attacker needs cooperation from BOTH countries
- Anti-correlation: timing analysis is much harder
(traffic enters in Sweden, exits in Romania)
- Exit server cannot correlate traffic to your real IP
- Compromised exit node cannot identify you
Trade-offs:
- Higher latency (double hop)
- Slightly reduced throughput
- Both servers are still Mullvad (single operator risk)
# Mullvad CLI: enable multihop
mullvad relay set tunnel wireguard --use-multihop on
# Set entry and exit separately
mullvad relay set tunnel wireguard entry location se # Entry: Sweden
mullvad relay set location ro # Exit: Romania
# Verify multihop is active
mullvad status
# Mullvad app GUI: Settings > WireGuard > Multihop > Enable
# Then select entry and exit locations separately
Manual WireGuard multihop (without the app) requires configuring two nested WireGuard tunnels. The outer tunnel connects to the entry server, and the inner tunnel routes through the outer to the exit server. Mullvad's app handles this automatically.
Mullvad was one of the first VPN providers to implement post-quantum key exchange on production tunnels (launched 2023). This protects against "harvest now, decrypt later" attacks where adversaries record encrypted traffic today to decrypt it when quantum computers become viable.
How it works:
- Classical key exchange (X25519) runs alongside
quantum-resistant key exchange (ML-KEM/Kyber)
- Both key exchanges contribute to the final session key
- If the quantum algorithm is broken: classical still protects
- If classical is broken by quantum: PQ algorithm still protects
- Hybrid approach = no single point of failure
Threat model:
- Nation-state adversaries recording VPN traffic at scale
- Future quantum computers breaking X25519/ECDH
- "Harvest now, decrypt later" is a real documented strategy
- Intelligence agencies have budget for bulk storage
Enable: Mullvad app > Settings > WireGuard > Quantum-resistant tunnel
CLI: mullvad tunnel wireguard quantum-resistant-tunnel set on
Available on all WireGuard servers.
Since November 2022, Mullvad has been migrating all servers to RAM-only (diskless) operation. As of 2024, all servers run entirely in RAM.
How it works:
- Servers boot from a read-only image via PXE/iPXE
- Operating system and all software run entirely in RAM
- No hard drives, no SSDs, no persistent storage of any kind
- On reboot, power loss, or physical seizure: all data is gone
- Even if an attacker gains root access, there are no logs to find
Why this matters:
- Logs cannot exist even theoretically (nowhere to write them)
- Physical server seizure yields zero usable data
- Confirmed in practice: 2023 police raid found nothing
- Eliminates entire classes of forensic recovery attacks
- Rogue datacenter employees cannot extract stored data
Verification:
- Mullvad server list page shows RAM-only status per server
- Independent audits have verified the diskless infrastructure
- mullvad.net/en/servers shows ownership and hardware details
Prevents any traffic from leaking outside the VPN tunnel if the connection drops. The Mullvad app enables this by default.
# Manual kill switch with iptables (Linux)
# Block ALL traffic except through WireGuard interface
# Flush existing rules
iptables -F OUTPUT
# Default policy: drop everything
iptables -P OUTPUT DROP
# Allow traffic through VPN tunnel
iptables -A OUTPUT -o mlvd -j ACCEPT
# Allow loopback (local connections)
iptables -A OUTPUT -o lo -j ACCEPT
# Allow WireGuard handshake to server IP only (replace with actual IP)
iptables -A OUTPUT -d <mullvad_server_ip> -p udp --dport 51820 -j ACCEPT
# Allow LAN traffic (optional, remove for stricter isolation)
iptables -A OUTPUT -d 192.168.0.0/16 -j ACCEPT
iptables -A OUTPUT -d 10.0.0.0/8 -j ACCEPT
# Block IPv6 leaks (if not using IPv6 tunnel)
ip6tables -P OUTPUT DROP
ip6tables -A OUTPUT -o mlvd -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT
Save rules to persist across reboots:
# Save
sudo iptables-save > /etc/iptables/rules.v4
sudo ip6tables-save > /etc/iptables/rules.v6
# Restore on boot (install iptables-persistent)
sudo apt install iptables-persistent
Important: the manual iptables kill switch rule for WireGuard handshake should target the specific Mullvad server IP, not a blanket port 51820 allowance. This prevents leaks to arbitrary endpoints on that port.
DNS leaks reveal the domains you visit to your ISP or local resolver, even when VPN is active. Mullvad runs its own DNS inside the tunnel.
# Mullvad DNS server (inside tunnel)
# 10.64.0.1 - automatically set when using Mullvad app
# Manual DNS configuration (/etc/resolv.conf)
nameserver 10.64.0.1
# Prevent resolv.conf from being overwritten by DHCP
sudo chattr +i /etc/resolv.conf
# Block DNS outside the VPN tunnel with iptables
iptables -A OUTPUT -p udp --dport 53 ! -o mlvd -j DROP
iptables -A OUTPUT -p tcp --dport 53 ! -o mlvd -j DROP
# Also block DNS-over-TLS (port 853)
iptables -A OUTPUT -p tcp --dport 853 ! -o mlvd -j DROP
# Note: blocking DoH on port 443 would break all HTTPS
# Instead, use the kill switch rules which block all non-tunnel traffic
Mullvad also offers public encrypted DNS (usable without VPN):
DNS over HTTPS (DoH):
https://dns.mullvad.net/dns-query
https://adblock.dns.mullvad.net/dns-query (with ad blocking)
https://base.dns.mullvad.net/dns-query (with tracker blocking)
DNS over TLS (DoT):
dns.mullvad.net (port 853)
adblock.dns.mullvad.net (port 853)
Test for leaks:
# Mullvad connection check
curl -s https://am.i.mullvad.net/json | jq '{ip, country, mullvad_exit_ip}'
# DNS leak test
curl -s https://am.i.mullvad.net/dnsleak
# Alternative: dnsleaktest.com via browser
# Should show only Mullvad DNS servers
DAITA is Mullvad's defense against machine-learning-based traffic analysis. Developed with Karlstad University Computer Science department, built on the open-source Maybenot framework.
The problem: Even with VPN encryption, an adversary observing your tunnel can identify which websites you visit by analyzing packet sizes, timing patterns, and traffic volume. ML models achieve high accuracy at this. Encryption hides content but NOT metadata patterns.
DAITA v2 (March 2025) applies three countermeasures:
| Component | What it does | Why it works |
|---|---|---|
| Constant packet sizes | All packets padded to uniform fixed size | Small packets are the most revealing (DNS, ACKs). Padding removes size-based fingerprinting. |
| Random background traffic | Dummy packets injected unpredictably between client and server | Masks real traffic patterns in noise. Adversary cannot distinguish real from dummy. |
| Data pattern distortion | Cover traffic sent in both directions, dynamic configs that vary between connections | Breaks timing correlation. Each session looks different. |
v2 improvements over v1: Large reduction in overhead traffic + dynamic configurations (tunnel characteristics change between connections, defeating attacks against DAITA itself).
Platform support (2026):
| Platform | Status | Notes |
|---|---|---|
| Windows | Available | Full DAITA v2 |
| Linux | Available | Full DAITA v2 |
| macOS | Available | Full DAITA v2 |
| Android | Available | Via GotaTun (Mullvad's Rust WireGuard implementation) |
| iOS | Available | Via GotaTun rollout 2026 |
Server availability: DAITA-enabled servers in select locations (Amsterdam, London, Los Angeles, New York + expanding). Check the app for current DAITA-enabled servers.
Enable: Settings > VPN settings > WireGuard settings > DAITA > ON
# CLI
mullvad obfuscation set mode auto
# DAITA requires WireGuard (not OpenVPN)
# Slight bandwidth overhead (~10-20%) due to padding and dummy traffic
# Worth it if your threat model includes network-level adversaries
Exclude specific applications from the VPN tunnel. Useful when certain apps must use your real IP (work tools, banking) while operational traffic routes through Mullvad.
Mullvad app: Settings > Split tunneling
Add applications to exclude from VPN
Use cases:
- Exclude corporate VPN client (avoid double-VPN conflicts)
- Exclude video streaming (save bandwidth)
- Route only OPSEC tools (browser, terminal) through VPN
- Keep work communication on real IP for plausible deniability
# Linux manual split tunneling with routing tables
# Mark packets from specific user/process
# Route marked packets outside VPN
# Create separate routing table
echo "200 novpn" >> /etc/iproute2/rt_tables
# Add default route for novpn table (via real gateway)
ip route add default via 192.168.1.1 table novpn
# Mark packets from specific UID (e.g., UID 1001)
iptables -t mangle -A OUTPUT -m owner --uid-owner 1001 -j MARK --set-mark 0x1
ip rule add fwmark 0x1 table novpn
Choose exit servers based on your threat model and operational requirements. Server location affects legal jurisdiction, latency, and how realistic your traffic appears.
| Threat model | Server strategy | Additional OPSEC |
|---|---|---|
| Journalist / whistleblower | Exit in press-freedom countries: Sweden, Iceland, Switzerland, Norway | Combine with Tor for source protection |
| Red team engagement | Exit near target's country for realistic traffic patterns. Avoid exotic locations that flag anomaly detection. | Combine with residential proxy (Bright Data, Oxylabs, or SOCKS5) to avoid VPN IP detection. Many corporate firewalls and WAFs flag known VPN/datacenter IP ranges. Residential proxy after VPN = traffic appears as normal ISP user. |
| General privacy | Avoid 5 Eyes: US, UK, Canada, Australia, New Zealand. Avoid 9 Eyes: + Denmark, France, Netherlands, Norway. Avoid 14 Eyes: + Germany, Belgium, Italy, Spain, Sweden. | Rotate servers between sessions |
| High-security / APT | Multihop: entry in country A, exit in country B (different jurisdictions). Prefer Mullvad-owned servers (not rented). | Connect from anonymous network (not home/work). Pay cash. Use DAITA. |
VPN detection problem: Many services detect and block VPN/datacenter IPs (Netflix, banks, target SOC teams). Solutions:
mullvad obfuscation set mode auto): wraps WireGuard in a form that bypasses DPI.All Mullvad servers are RAM-only since 2024 - no data survives a reboot. Mullvad publishes which servers are owned vs rented on their server list page.
Verify your VPN connection is active and not leaking before starting any operation. Use these terminal commands (not the browser widget above, which may fail due to CORS).
# Full connection info via Mullvad API
curl -s https://am.i.mullvad.net/json | jq '{
ip: .ip,
country: .country,
city: .city,
mullvad_exit: .mullvad_exit_ip,
mullvad_exit_ip_hostname: .mullvad_exit_ip_hostname,
blacklisted: .blacklisted
}'
# Quick IP check
curl -s https://am.i.mullvad.net/ip
# DNS leak test
curl -s https://am.i.mullvad.net/dnsleak
# Connection control
mullvad status
mullvad connect
mullvad disconnect
# Server selection
mullvad relay list
mullvad relay set location se # Sweden
mullvad relay set location se got # Gothenburg
mullvad relay set hostname se-got-wg-001 # Specific server
# Enable multihop WireGuard
mullvad relay set tunnel wireguard --use-multihop on
# Entry in Germany, exit in Sweden (two jurisdictions)
mullvad relay set tunnel wireguard entry location de
mullvad relay set location se
# Enable/disable kill switch (called "lockdown mode" in CLI)
mullvad lockdown-mode set on
mullvad lockdown-mode set off
# Auto-connect on boot
mullvad auto-connect set on
# Enable quantum-resistant tunnel
mullvad tunnel wireguard quantum-resistant-tunnel set on
# Enable DAITA
mullvad tunnel wireguard daita set on
# Set DNS server
mullvad dns set default
mullvad dns set custom 10.64.0.1
# Check all settings
mullvad status -v
# DAITA + obfuscation
mullvad obfuscation set mode auto
# Split tunneling (add/remove apps)
mullvad split-tunnel add <pid_or_path>
mullvad split-tunnel delete <pid_or_path>
mullvad split-tunnel list
# View Mullvad daemon logs
sudo journalctl -u mullvad-daemon -f
# Test connectivity
curl -s https://am.i.mullvad.net/json | jq .
# Force WireGuard protocol
mullvad relay set tunnel-protocol wireguard
# Filter servers by country
mullvad relay list | grep "^se"
# Check server ownership (owned vs rented)
# Visit: https://mullvad.net/en/servers
Mullvad is a tool, not a guarantee. Proper OPSEC requires consistent behavior and layered defenses.
Account hygiene:
- Create account via Tor Browser (never from real IP)
- Pay with Monero or cash (no financial trail)
- Never share account number over unencrypted channels
- Rotate accounts periodically for compartmentalization
Operational discipline:
- Never log into personal accounts while on operational VPN
- Different server locations for different activities
- Enable kill switch ALWAYS
- Test for DNS leaks before every session
- Don't mix personal and operational traffic on same connection
- Use separate browser profiles (or VMs) per identity
Layered anonymity:
- Mullvad + Tor (VPN -> Tor): ISP sees VPN, Tor entry sees Mullvad IP
- Mullvad + Whonix: run Whonix inside VPN for defense in depth
- Rotate exit servers between sessions
- Use DAITA on supported servers for traffic analysis resistance
- Enable post-quantum tunnels to defeat harvest-now-decrypt-later
| Config | How it works | Who sees what | Risk |
|---|---|---|---|
| VPN -> Tor (recommended) | Connect Mullvad first, then open Tor | ISP sees VPN traffic only. Tor entry node sees Mullvad IP (not yours). Tor exit sees destination. | Mullvad sees your real IP + that you connect to a Tor guard node (metadata only). Mullvad does NOT see content, DNS queries, or destinations - everything is triple-encrypted by Tor before entering the WireGuard tunnel. Risk: timing/volume correlation if adversary controls both Mullvad and a Tor exit node (DAITA mitigates this). |
| Tor -> VPN (not recommended) | Connect Tor first, then Mullvad | ISP sees Tor. Mullvad sees Tor exit IP (not yours). BUT Mullvad sees your traffic in cleartext after decryption. | Mullvad sees EVERYTHING you do (sites, content). Worse than VPN->Tor. |
| Mullvad + Whonix | Whonix Gateway routes through Mullvad then Tor | Defense in depth. Even if Tor is compromised, VPN layer remains. | Best combo but complex setup. |
Critical OPSEC note: In VPN -> Tor mode, Mullvad has your real IP address (or the IP of the network you connect from). Even though they claim no logs and proved it during the 2023 raid, you should never rely on this 100%. Mitigations:
Common mistakes that break anonymity:
- Logging into Gmail/social media through operational VPN
- Using same server for personal and operational tasks
- Forgetting kill switch, leaking real IP on reconnect
- DNS leaks from misconfigured resolv.conf
- WebRTC leaks in browser (disable in Firefox: media.peerconnection.enabled = false)
- Browser fingerprinting (use Mullvad Browser or Tor Browser)
- Paying with credit card for an operational account
- Creating account from your real IP without Tor
| Feature | Mullvad | ProtonVPN | IVPN |
|---|---|---|---|
| Anonymous signup | Yes (account number, no email) | Email required | Yes (account ID, no email) |
| Cash payment | Yes (SEK/EUR to Gothenburg) | Yes (USD/EUR/CHF to Geneva HQ) | Yes (envelope of bills) |
| Monero (XMR) payment | Yes | No (BTC only among crypto) | Yes |
| Bitcoin payment | Yes (+ Lightning) | Yes | Yes |
| WireGuard | Yes (native kernel) | Yes (native) | Yes (native) |
| Multihop | Yes | Yes (Plus plan only) | Yes |
| RAM-only servers | Yes (fleet-wide, System Transparency) | Partial (Secure Core only) | Yes (fleet-wide since 2020) |
| Open source client | Yes (GPL) | Yes (GPL) | Yes (GPL) |
| Post-quantum tunnels | Yes (default desktop, release 2025.2) | Research only | Evaluating |
| Jurisdiction | Sweden (14 Eyes, no VPN retention) | Switzerland (not in Eyes, VÜPF near-miss 2024) | Gibraltar (not in Eyes) |
| Price | EUR 5/mo flat (no discounts) | 0-10 EUR/mo (aggressive multi-year discount) | USD 6-10/mo |
| No-logs audit | Cure53 infra audits (no logs to audit) | Securitum 4 consecutive years (2022-2025) | Cure53 2019, 2022 |
| Court-tested | Yes (Swedish NOA raid April 2023, no data) | No (ProtonMail 2021 was separate service) | Untested (no demands yet) |
| DAITA (traffic shaping) | Yes | No | No |
| Own browser | Yes (Mullvad Browser with Tor Project) | No | No |
Mullvad Browser (developed with Tor Project) is a hardened Firefox fork designed to reduce fingerprinting. Combined with Mullvad VPN, it provides strong browsing privacy without Tor's speed penalty.
Most "VPN review" sites are paid affiliate marketing. Their recommendations are based on commission rates, not security analysis.
The Kape Technologies monopoly: Kape Technologies (London-registered, wholly owned by Israeli billionaire Teddy Sagi through Unikmind Holdings) controls a massive share of the VPN industry:
Always ask: Who owns the VPN? Who owns the site reviewing it? If it's the same company, the review is an advertisement.
A focused side-by-side comparison between Mullvad and six representative alternatives across 14 Mullvad-specific criteria (anonymous account, cash payment, post-quantum tunnel, police-raid-tested, infrastructure ownership, etc.). Mullvad is highlighted.
For the full 22-provider comparison with filters, sorting, privacy scoring, and the complete Ownership Consolidation Map, see the dedicated VPN Comparison cheatsheet.