Mullvad VPN

Is Mullvad VPN safe?

Yes, and on privacy it is the strongest VPN we have scored. Mullvad, run by Mullvad VPN AB in Gothenburg, does not ask for your name or email. You get a random account number, can pay with cash in the post, and Apple's privacy label says the app collects no data at all. When Swedish police came to its office with a search warrant in April 2023, they left with nothing. We score it 91/100.

That puts it ahead of Proton VPN (88) and well ahead of Private Internet Access (83) and the other big commercial VPNs. It is not flawless: there is no paid bug bounty, and the last two years brought an Android DNS leak, a high-severity crash bug found in an audit and an issue that let websites link a user across servers. All were fixed.

What happened in the 2023 police raid?

On 18 April 2023 at least six officers from the Swedish police's National Operations Department arrived at Mullvad's office with a warrant to seize computers holding customer data. Mullvad's account of the visit is short. It showed the officers that the data they wanted did not exist and argued that seizing equipment would therefore be illegal under Swedish law. After the officers consulted the prosecutor, they left without taking anything.

Mullvad had then been operating for more than 14 years, and it said this was the first search warrant at its offices. The episode matters because it is a real test, not an audit: the police expected to find user records and did not.

How little does Mullvad know about you?

Less than any other VPN we have looked at. A Mullvad account has two properties, its number and the time left on it. If you use WireGuard, the server also stores your device's public key and tunnel address, so it can connect you.

Payments are where most VPNs learn who you are, and Mullvad documents each method in detail. For cash, it records the amount, currency and time and shreds the envelope. For cryptocurrency, it runs its own nodes and wallets and cuts the timestamp to a date after 20 days. For card, PayPal, Swish and bank wire, it keeps a transaction ID for 20 days for refunds, and says plainly that those payment companies keep their own records. All personal data stays in the EU or EEA.

The store labels match. Apple's label reads "Data Not Collected". Google Play lists an optional email for problem reports, a user ID, purchase history and optional crash logs, with nothing shared with third parties.

How secure is Mullvad?

The apps are open source under the GPL, and Mullvad has paid for an outside audit of them every two years since 2018. The 2024 audit, by four testers from X41 D-Sec over 30 person-days, found six vulnerabilities: three high, two medium and one low. The worst involved a signal handler in the desktop and Android daemon that could corrupt memory; Mullvad shipped fixes as the report arrived. Separate audits covered the server infrastructure (Assured in 2022, Radically Open Security in 2023, Cure53 in 2024), the payment and account API (X41, published January 2026) and its own WireGuard implementation, GotaTun (Assured, March 2026). The Android app has twice passed MASA, the App Defense Alliance's mobile security assessment (NCC Group in 2025, Leviathan in 2026).

Since September 2023 every VPN server boots from RAM with no disk, so a reboot wipes it. Mullvad dropped OpenVPN in January 2026 and now runs WireGuard only.

The weaknesses are real but small. In 2024 the Android app could leak DNS queries outside the tunnel after a hard failure to connect. In May 2026 Mullvad found that switching servers could let a website guess that the same user had moved from one server to another, though not who that user was. It changed how exit addresses are assigned. Mullvad also has no bug bounty: it welcomes reports but does not pay for them, unlike Proton VPN, which pays up to US$100,000.

How to use Mullvad safely

1. Write down your account number and keep it somewhere safe; it is the only key to your account and there is no email reset.
2. Pay with cash or Monero if you want no payment trail at all, and use the payment token rather than writing your account number on the envelope.
3. After switching to a server you want kept separate from the last one, log out and back in, as Mullvad advises, to get a new key and tunnel address.
4. On Android 16, a bug in the system lets any app send some traffic outside the VPN tunnel. Google's security team closed the report as infeasible to fix, according to Mullvad, so avoid installing untrusted apps.

How we scored it

Privacy (95) and regulatory record (95) are the strongest factors: no data collected by the app, a police search that came back empty and no fines in about 17 years. Security (88) is lowered by recent leaks and the lack of a bug bounty. Scams and harmful content (82) is the weakest, only because any VPN, especially one this easy to open anonymously, can bypass parental and school filters.