Mullvad VPN
Mullvad VPN is a privacy-focused VPN service based in Sweden offering anonymous account creation (no email required), flat-rate pricing, and open-source clients. The service uses WireGuard exclusively, runs all servers on RAM with no persistent storage, and has passed multiple independent security audits confirming its no-logs policy.
Score generated by AI agents based on publicly cited evidence and reviewed by the project maintainer. Not independently validated.
Score History
Timeline events are AI-curated from public reporting. Score trajectory is derived from documented events.
Mullvad launches as an idealistic OpenVPN service in Gothenburg with anonymous account numbers, flat EUR 5/month pricing, cash and Bitcoin payments. The founders build the service from political conviction rather than commercial ambition, but it remains unproven and unaudited, with no mobile apps and limited infrastructure.
Mullvad becomes an early WireGuard adopter and donor, signaling technical leadership. The service remains steadily operated with its unchanging EUR 5 price and founder-owned structure. However, it still lacks mobile apps, independent security audits, and transparent server infrastructure, keeping the score flat despite growing reputation in privacy circles.
Mullvad achieves cross-platform coverage with Android and iOS apps, passes its first independent Cure53 security audit, ports coreboot to server hardware, and partners with Mozilla for Mozilla VPN. These milestones move Mullvad from a niche Linux-focused service to a verified, multi-platform privacy tool, reducing D1 and D5 slightly.
Mullvad deepens its transparency with multiple independent audits (Cure53 infrastructure, Assured relay servers), the founders' public no-sale commitment, and the launch of diskless RAM-only infrastructure. Monero payments and DNS blocking features expand user protections. The VPN industry consolidates around marketing-heavy conglomerates while Mullvad remains independently owned with no affiliates.
The Swedish police raid on April 18 provides real-world validation of Mullvad's no-logs policy when officers leave empty-handed. Mullvad Browser launches with the Tor Project, RAM-only migration completes, and quantum-resistant tunnels reach stable status. Port forwarding removal is the only user-facing loss, justified by the no-logs architecture making abuse uncontrollable.
Mullvad reaches its most technically advanced state with DAITA v2, quantum-resistant tunnels as default, QUIC obfuscation, GotaTun Rust-based WireGuard, and active anti-surveillance advocacy including the 'And Then?' documentary. The OpenVPN removal and Leta shutdown are minor feature losses offset by substantial security and privacy gains. The company actively opposes EU Chat Control while maintaining its EUR 5/month price unchanged since 2009.
Alternatives
Another privacy-first VPN with anonymous account creation, no-logs policy, and open-source apps. Similar philosophy and pricing to Mullvad. Not scored internally but a strong alternative for privacy-focused users. Easy switch -- just sign up and connect.
Part of the Proton privacy ecosystem with a generous free tier, open-source apps, and independent audits. Scored 14 here (Healthy). More feature-rich than Mullvad with streaming support and ad-blocking, but requires an email account. Easy switch -- just sign up and connect.
Dimensional Breakdown
Summaries below were written by AI agents based on the cited evidence. They are editorial interpretations, not independent research findings.
Dimension History
Timeline (53 events)
Mullvad VPN Launches with OpenVPN Protocol
Amagicom AB founders Fredrik Stromberg and Daniel Berntsson launch Mullvad VPN in Gothenburg, Sweden, with OpenVPN protocol support, anonymous account numbers (no email required), and a flat EUR 5/month price. The name 'Mullvad' means 'mole' in Swedish, reflecting the privacy-first mission.
Mullvad Begins Accepting Bitcoin Payments
Mullvad becomes one of the earliest commercial services to accept Bitcoin, allowing users to pay for VPN service without revealing personal financial information. This predates most mainstream Bitcoin adoption by years.
Mullvad Introduces Cash-by-Mail Payments
Mullvad begins accepting cash payments sent by regular mail, allowing fully anonymous subscription without any digital payment trail. Users put cash and a payment token in an envelope, and Mullvad shreds the non-money contents after crediting the account.
Mullvad Becomes Early WireGuard Adopter
Mullvad launches its first public WireGuard test server after co-founder Fredrik Stromberg discovered the protocol in summer 2016 and studied its technical whitepaper. This makes Mullvad one of the first commercial VPN providers to support WireGuard.
Mullvad Donates to WireGuard Development
Mullvad announces a generous donation to support WireGuard development from July through December 2017, funding the open-source VPN protocol rather than building proprietary alternatives. The company views this as improving not only its own products but the broader internet.
Mullvad Adds Bitcoin Cash Payment Support
Mullvad adds Bitcoin Cash (BCH) as the second cryptocurrency payment option alongside Bitcoin, further expanding anonymous payment methods for privacy-conscious users.
First Independent Security Audit by Cure53
Cure53 and Assured complete an 18-day security audit of Mullvad's VPN app across macOS, Windows, and Linux. Only seven issues are found, none remotely exploitable. Auditors find no traffic leaks and no ways for network-based attackers to force leaks. Mullvad publishes the full report.
Mullvad Ports Coreboot to Off-the-Shelf Server
Mullvad successfully ports coreboot open-source firmware to the Supermicro X11SSH-TF server platform, the first time a modern off-the-shelf server gains coreboot support. This is a key component of the System Transparency project, which aims to let users verify what VPN servers actually do with traffic.
Mullvad Launches First Android Beta App
Mullvad releases its first native Android beta app alongside an updated desktop version, extending privacy-focused VPN access to mobile users. Previously, Android users had to use third-party OpenVPN apps with manual configuration.
Mozilla Partners with Mullvad for Mozilla VPN
Mozilla partners with Mullvad to use its global network of WireGuard servers for Mozilla VPN (initially Firefox Private Network). This partnership validates Mullvad's infrastructure quality and extends its reach to Mozilla's user base without compromising Mullvad's privacy standards.
Native iOS and Android Apps Launch with WireGuard
Mullvad releases stable native VPN clients for iOS and Android using the WireGuard protocol exclusively for mobile platforms, completing cross-platform coverage. The iOS app had been in beta for over a year.
Malwarebytes Partners with Mullvad for Privacy VPN
Malwarebytes partners with Mullvad to use its WireGuard server network for Malwarebytes Privacy VPN, the second major partnership validating Mullvad's infrastructure. Malwarebytes handles billing and apps while Mullvad provides the underlying VPN network.
First Infrastructure Audit Finds No Privacy Leaks
Cure53 completes the first-ever independent security audit of Mullvad's VPN server infrastructure. Auditors find no Personally Identifiable Information or privacy-compromising information. Six vulnerabilities ranging from informational to high are identified and resolved. Mullvad publishes the full report.
Mullvad Launches Free Encrypted DNS Service
Mullvad releases a public DNS service in beta supporting DNS over HTTPS (DoH) and DNS over TLS (DoT) with QNAME minimization and ad blocking. The service is free for everyone, not just Mullvad VPN subscribers, and is hosted on Mullvad-owned infrastructure audited by Assured AB.
DNS-Based Ad and Tracker Blocking Launched
Mullvad adds DNS-based ad and tracker blocking to its VPN app on desktop and Android, using curated blocklists to prevent ad and tracking domains from resolving. The feature blocks ads, trackers, and malware domains system-wide while connected to Mullvad.
Founders Publicly Commit to Never Selling Mullvad
Founders Fredrik Stromberg and Daniel Berntsson publish a blog post explicitly stating they will never sell Mullvad or raise outside investment. They describe starting the company in 2008 for idealistic reasons and confirm Mullvad has grown organically without outside investors. Both Mullvad VPN AB and parent Amagicom AB are 100% founder-owned.
Diskless Infrastructure Enters Beta
Mullvad launches its first pair of VPN servers booted with the stboot bootloader, running entirely from RAM with no disks. Located in Sweden, these servers represent the beginning of the System Transparency project's deployment phase. If powered off or confiscated, no data can be retrieved.
Multihop Feature Available in Desktop GUI
Mullvad makes WireGuard multihop available in the desktop app's graphical interface starting with version 2022.1. Previously available only via command line since version 2021.4, multihop routes traffic through two servers in separate jurisdictions for enhanced privacy.
Malware DNS Blocking Added to VPN Servers
Mullvad adds malware URL blocking using URLHaus' RPZ list to its DNS resolvers running on all OpenVPN and WireGuard servers, expanding content blocking beyond ads and trackers to include malware protection at no additional cost.
Silver-Tier Donation to WireGuard Renewed
Mullvad renews its financial support for WireGuard development with a silver-tier donation, continuing the pattern of funding established in 2017. The company views WireGuard development as improving internet privacy infrastructure broadly, not just its own service.
Mullvad Begins Accepting Monero Payments
After years of user requests, Mullvad adds Monero (XMR) as a payment option, running its own wallet and node without third-party processors. Monero's built-in privacy features make it the most anonymous electronic payment method Mullvad supports. All cryptocurrency payments receive a 10% discount.
Server Audit Confirms No Customer Logging
Assured AB completes an audit of Mullvad's VPN relay servers, examining two WireGuard servers and one OpenVPN server. Auditors find zero critical or high-severity issues and confirm system services have customer logging disabled entirely. The full report is published.
Experimental Post-Quantum VPN Tunnels Released
Mullvad releases experimental support for quantum computer-resistant VPN tunnel encryption in its desktop apps, using Classic McEliece. This protects against future quantum computers decrypting currently recorded traffic. Mullvad is among the first VPN providers to implement post-quantum cryptography.
Diskless Infrastructure Expands to More Locations
Mullvad expands its diskless RAM-only server infrastructure to additional locations worldwide using the stboot bootloader, moving toward its goal of running all servers without persistent storage.
VPN App Security Audit Finds No Critical Issues
Mullvad publishes results of an extensive security audit of its VPN app across all five supported platforms. Out of five findings, two are medium level, two are low level, and one is informational. No critical or high-severity vulnerabilities are found.
V2ray Obfuscation Added to Bridge Servers
Mullvad adds v2ray obfuscation alongside Shadowsocks on its stbooted bridge servers, helping users in restrictive networks bypass firewalls. All bridge servers running from RAM support v2ray connections.
Post-Quantum Tunnels Expanded to All WireGuard Servers
Mullvad expands its experimental quantum-resistant tunnel support from a few servers to all WireGuard servers globally, making post-quantum encryption available to all users who enable it.
Account and Payment Services Audited by Assured
Assured AB completes a security assessment of Mullvad's account and payment services. No critical, high, or medium-rated issues are identified, and the overall security of the API is deemed good.
Mullvad Becomes Highest-Level Tor Project Member
Mullvad achieves Shallot membership, the highest tier of the Tor Project's membership program. Mullvad was a founding member of the program and had been a Vidalia Onion member since 2021, reflecting years of collaboration with the Tor community.
Mullvad Browser Released with Tor Project
Mullvad and the Tor Project release the Mullvad Browser, a free and open-source privacy-focused browser built on Tor Browser technology but designed for use with a VPN instead of the Tor Network. It minimizes tracking and fingerprinting using the Tor Project's anti-fingerprinting protections.
Quantum-Resistant Tunnels Become Stable Feature
Post-quantum safe VPN tunnels move from experimental to stable status in Mullvad's desktop app version 2023.3. The implementation uses Classic McEliece and Kyber algorithms to protect against future quantum computer decryption of recorded traffic.
Swedish Police Raid Proves No-Logs Policy
Six officers from Sweden's National Operations Department visit Mullvad's Gothenburg office with a search warrant (issued February 17 at Germany's request for a blackmail investigation). After Mullvad demonstrates that no customer data exists in accordance with their policies, the officers consult the prosecutor and leave without seizing anything.
Port Forwarding Removed Due to Abuse
Mullvad announces removal of port forwarding support effective July 1, 2023. CEO Jan Jonsson explains that the feature was being used to host malicious services, causing IP blacklisting and hosting provider cancellations. Because Mullvad cannot identify bad users due to its no-logs architecture, removal was the only option.
Anti-Surveillance Banners During Sweden's EU Presidency
Mullvad puts up anti-surveillance banners in Stockholm and Gothenburg during Sweden's EU Council presidency, advocating against the Chat Control proposal. The campaign raises public awareness about the European Commission's plan for mandatory message scanning.
Infrastructure Audit by Radically Open Security
Radically Open Security completes Mullvad's third infrastructure audit, examining RAM-only servers. Auditors find no logging of user activity data and describe a 'mature architecture.' One high-severity issue involving shared database credentials is identified and fixed with PKI-based authentication.
Tailscale Partners with Mullvad for Exit Nodes
Tailscale announces a partnership allowing its customers to use Mullvad's WireGuard VPN servers as exit nodes, combining Tailscale's mesh networking with Mullvad's privacy infrastructure. Licenses cost $5/month per 5 devices.
Migration to RAM-Only Infrastructure Complete
Mullvad announces completion of its migration to diskless VPN infrastructure, with all servers now running entirely from RAM using the stboot bootloader. If any server is powered off, moved, or confiscated, no data can be retrieved. The migration began in January 2022.
Support Email Moved to Self-Hosted RAM Servers
Mullvad migrates its support email to self-hosted, Mullvad-owned hardware running from RAM with encrypted disk for the PostgreSQL database. The system was audited pre-production by Assured AB, removing third-party email provider dependency for customer support communications.
DAITA v1 Launches Against AI Traffic Analysis
Mullvad introduces Defense Against AI-guided Traffic Analysis (DAITA), using constant packet sizes, random background traffic, and data pattern distortion to combat machine-learning-based traffic fingerprinting. Developed with Karlstad University, DAITA uses the open-source Maybenot framework funded partly by Mullvad.
Fourth Infrastructure Audit by Cure53
Cure53 completes Mullvad's fourth infrastructure audit, finding only two issues (one low, one medium) with no vulnerabilities affecting the core product. Cure53 praises the 'multitude of hardening features' and states the infrastructure team is 'highly knowledgeable about sound security practices.'
Quantum-Resistant Tunnels Released as Stable on Desktop
Mullvad releases quantum-resistant WireGuard tunnels as a stable feature on desktop platforms, using post-quantum key encapsulation mechanisms for pre-shared key exchange. The feature is set to become default in future releases.
X41 D-Sec Completes 30-Day App Security Audit
X41 D-Sec performs penetration tests and source code audits across all Mullvad VPN apps over 30 days, finding only non-critical issues. The audit represents the most comprehensive third-party app review in Mullvad's history.
Quantum-Resistant Tunnels Enabled by Default on All Desktop
Mullvad's 2025.2 desktop release enables quantum-resistant WireGuard tunnels by default on Windows, completing default enablement across all desktop platforms (macOS and Linux were enabled earlier). All apps now protect against future quantum computer decryption.
Obscura VPN Partnership for Two-Party Multihop
Mullvad partners with Obscura VPN to provide WireGuard exit servers for a two-party VPN architecture. Unlike traditional multihop where one provider sees everything, Obscura sees the user's IP but not their traffic, while Mullvad sees the traffic but not the user's identity.
DAITA v2 Reduces Overhead with Smarter Padding
Mullvad releases DAITA v2 on all platforms, introducing more precise dummy packet insertion logic that halves bandwidth overhead compared to v1 while maintaining resistance to machine-learning traffic fingerprinting. Dynamic configurations adapt padding strategies based on traffic patterns.
QUIC Obfuscation Launched for Censorship Resistance
Mullvad introduces QUIC obfuscation for WireGuard on desktop apps, tunneling VPN traffic through QUIC streams that appear as normal HTTPS traffic to firewalls. Built on the MASQUE protocol (RFC 9298), this defeats deep-packet inspection targeting VPN signatures.
Web App Audit by Assured Finds No Major Issues
Assured AB completes a penetration test of Mullvad's web applications, finding no critical, high, or medium-severity issues. Only a low-severity input validation weakness is identified and fixed. Auditors conclude that 'good security practice is followed in all parts.'
QUIC Obfuscation Extends to Mobile Platforms
Mullvad rolls out QUIC obfuscation to Android and iOS apps in version 2025.8, bringing the total obfuscation methods to four added in 2025. Mobile users can now bypass firewalls that block WireGuard traffic by disguising VPN connections as standard HTTPS.
Leta Search Engine Shut Down
Mullvad announces the shutdown of its experimental Leta search proxy, effective November 27, 2025. Tightening anti-bot measures, CAPTCHAs, and behavioral signals from search engines made the privacy proxy unsustainable. Users are directed to DuckDuckGo as an alternative.
'And Then?' Anti-Surveillance Documentary Released
Mullvad releases 'And Then?', a short film directed by Jonas Akerlund portraying a dystopian scenario of government surveillance spiraling into corruption. The film criticizes the EU's Chat Control proposal and is broadcast in EU countries. Mullvad's spokesperson states the company might exit the EU market if Chat Control passes.
GotaTun Rust-Based WireGuard Implementation Launched
Mullvad releases GotaTun, a user-space WireGuard implementation written in Rust, replacing the Go-based wireguard-go. Named after the Gotatunneln in Gothenburg, GotaTun reduces the Android crash rate from 0.40% to 0.01% and improves speeds and battery life. Over 85% of previous Android crash reports originated from wireguard-go.
UK Bans Mullvad's Anti-Surveillance TV Advertisement
UK's Clearcast advertising clearance body blocks Mullvad's 'And Then?' TV ad, citing concerns about references to violent criminals. Transport for London also refuses to display the QR code campaign in the Underground. Mullvad responds by running the simple message 'And Then?' on London Underground posters instead.
OpenVPN Support Completely Removed
Mullvad removes all OpenVPN server and client support, completing the transition to WireGuard exclusively. The company announced the change in July 2025, giving users six months to migrate. Fewer than 7% of users were still on OpenVPN. The removal allows Mullvad to focus engineering resources on a single, more secure protocol.