Mullvad VPN review: what it says, and what two reviewers found

The price, and what renewing means

Mullvad’s pricing page shows one number three times: 5 euros per month under “1 month”, under “1 year” and under “1 decade”. It says the price includes VAT and lists equivalents of $5.60, 4.17 pounds and 54.87 Swedish kronor. The page says you can top up for a whole year or pay month to month for the exact same rate, and that the price is the one it launched with in 2009. It also says there are no sales, for Christmas or any other occasion, and no free plan, because “free” services nearly always cost something, whether time, data or functions.

Two other lines on that page matter to a buyer. The first is a 14-day money-back guarantee, which the page says does not apply to cash payments because of anti-money-laundering rules. The second is a discount: the page says the cryptocurrencies Mullvad accepts are discounted 10% because of lower fees and less administration, and that resellers may sell it at different prices. The CNET and PCWorld reviews we read give the flat 5 euros and do not mention the crypto discount, so a reader of only those two would not see it.

CNET, in a review updated on 20 October 2026, rounds the price to about $6 a month and about $72 a year. It says that is roughly what a year of Proton VPN, Windscribe or Surfshark costs, less than ExpressVPN or NordVPN, and that a year bought through Amazon cost $65. PCWorld, on 11 June 2026, gives about $5.82 and adds a caution of its own: because the monthly rate never drops, Mullvad is an affordable short-term plan but a more expensive long-term one, and the reviewer adds that ultra long-term plans are not usually recommended.

On renewal the two reviews describe the same thing in different words. CNET says the time does not renew automatically and that you can add one, two, three or six months or a year; its account dashboard shows time left and the app shows days remaining. PCWorld says Mullvad did away with automatic renewals, quoting the company that this was to store less data, so you re-up by hand. The pricing page lists a decade as an option, which CNET’s list of terms does not.

The numbered account, and the ways to pay

The pricing page says the first step is one click to generate an account, after which you get an account number and choose how to pay. Mullvad’s no-logging policy, updated on 17 June 2026, explains it: sign-up asks for no username, password or email address, and a random account number is the only identifier a person needs. The policy adds that anyone can create as many numbered accounts as they like and that an account can be used by several people. An account has two properties, the number and the time left on it. For each account Mullvad says it stores the account number and an expiry date, and, if WireGuard is used, a public key and a tunnel address.

CNET gives the number a length, 16 digits, and attaches a warning to it: you cannot use the service without the number, and CNET says getting a lost one back could be challenging or even impossible. It recommends keeping the number in a password manager. The pages we read do not describe a recovery route; we did not open any Mullvad account-recovery page. On devices, the pricing page says an account works on up to 5 devices. CNET reads that as five devices registered at once, so adding a sixth means removing one from the dashboard, and PCWorld reads it as five simultaneous connections.

The pricing page names twelve ways to pay: cash, Bitcoin, Bitcoin Cash, Monero, bank wire, credit card, PayPal, Swish, Eps transfer, Bancontact, iDEAL | Wero and Przelewy24. The policy lists eight of them in its payment section and also covers activation codes and in-app purchases on iOS and Google Play. CNET lists cash, voucher, credit card, PayPal, crypto and bank wire, and also names the voucher as a method, which the pricing page list does not. PCWorld repeats the pricing page’s list and says paying in cash is, to the reviewer’s knowledge, unique among VPNs.

For cash, the pricing page says to put the money and a payment token, generated at random on Mullvad’s website, in an envelope, in one of nine currencies: EUR, USD, GBP, SEK, NOK, CHF, CAD, AUD or NZD. The policy asks senders not to write a name or address on the envelope and not to write the account number, only the token. What each of these methods leaves behind is set out in the next section.

What the policy says it logs, and what it keeps

The policy’s opening statement is that Mullvad keeps no activity logs of any kind. It then lists what it says it does not log: traffic, DNS requests, connections (including when one starts, when it ends, how long it lasts, or any timestamp), IP addresses and user bandwidth. The only account activity it says it records is the total of simultaneous connections, plus the payment information the policy sets out. Those are Mullvad’s statements about itself. CNET adds that no-logging claims are impossible to verify with 100% certainty, and PCWorld summarises the policy in the same terms.

The simultaneous-connection limit is the part that needs explaining, and the policy explains it: each server asks a central service whether the account is valid, has time left and has reached its limit, and the policy says all of this is done in temporary memory and never written to disk. As a result, it says, Mullvad cannot tell you how many connections your account had five minutes ago. For monitoring, the servers send aggregated data such as the total number of connections, and system measures such as processor load per core and total bandwidth. The web servers keep access logs for up to five minutes, without IP addresses.

Payments are where the policy admits records. For cash, it says the envelope is opened, time is added and the envelope is destroyed with a shredder. For Bitcoin, Bitcoin Cash and Monero, it says Mullvad runs its own full node for each currency and hosts its own wallets, with no third party, and that the timestamp is cut to the date after 20 days; for Monero the transaction hash stays, to prevent double-crediting. Card, PayPal, Swish and bank wire go through Stripe, PayPal and the bank SEB, and the policy says that for those methods payment actions are not anonymous. With a bank wire the account number appears in the message field. Some accounting data must be kept by law, and the policy gives the Swedish Accounting Act and seven years from the end of the fiscal year for some information, as an example.

The policy also describes a token created for every payment method except cryptocurrencies. It expires after 20 days, and unmatched cash tokens are kept for 120 days in case the post is slow. Support emails are erased after 70 days, and the app sends its version and the operating system version to count which versions are in use. For comparison, our page on what Proton VPN says it logs sets out a competitor’s version.

Jurisdiction comes up in both reviews. CNET puts Mullvad in Gothenburg, Sweden, and says it is independently owned by Mullvad VPN AB; PCWorld says it is owned and operated by Amagicom AB, and the pages we read do not explain the two names. Both say Sweden is in the 14 Eyes alliance. CNET writes that Sweden does not impose laws that could compel a VPN company to log activity. It lists the lack of a transparency report among its cons, and says Mullvad explains how it handles government requests. PCWorld says the no-logs design should leave little data to hand over, and that all servers moved to RAM-only, diskless machines in 2023, both owned and rented. CNET also lists RAM-only servers.

The audits we read, and the ones we only heard about

We opened two audit write-ups, both Mullvad’s own blog posts about reports by Cure53. The first, from 25 June 2020, covers the apps. Six testers worked for 20 days on the desktop, Android and iOS versions. They found seven items: two Medium, two Low and three Info, and nothing the auditors classed as dangerous or critical. Mullvad says it fixed five before the final report was finished, and that the other two are not serious and are out of its control. The post quotes the report that Mullvad does a great job protecting users from common leaks of personal data. Mullvad’s page warns that the post is six years old.

The second, from 20 January 2021, covers the infrastructure, audited in December 2020. Cure53 found no personally identifiable information attached to users, six vulnerabilities rated from informative to high, and six miscellaneous issues. The post picks several. A High finding said attackers could disconnect other OpenVPN users on the same entry server; Mullvad says the script involved had not been updated for some time, that it has never seen the flaw exploited, and that it fixed the input handling. A Medium finding said OpenVPN authentication could be bypassed so that someone could use the service without paying; Mullvad calls this a trade-off about uptime when its API is down. Among the miscellaneous issues, an insecure Docker configuration was rated High, and Mullvad answers that Docker is used there to handle software dependencies, not to separate security zones. The post ends with an intention to audit the infrastructure every year.

The policy cites that same Medium finding, MUL-03-002, as the reason for a change meant to keep the service reliable even if Mullvad’s API fails. PCWorld, for its part, says Mullvad has phased out OpenVPN and now offers only WireGuard in all its apps; our page on WireGuard against OpenVPN goes into the two protocols. We did not check which of the 2020 findings still apply to the current software.

The later audits come only through the reviewers. CNET counts 19 since 2017, second only to ExpressVPN’s 23 since 2018, with four since its 2025 review and two in 2026. PCWorld counts 18 independent audits, the latest in early 2026 by Assured Security Consultants, and says Mullvad also completed a full audit of its account and payment systems. The two counts differ by one, and the pages we read do not say which is right or how each was reached. CNET adds a caution of its own: an audit is a snapshot in time. We opened the two blog posts but not the Cure53 reports themselves, nor any write-up after January 2021.

Speed, features and streaming

The two reviews measured speed differently, and the pages do not put them on one scale. CNET ran more than 200 tests over Wi-Fi and Ethernet on Mac and Windows, using WireGuard through six server locations, and reports a 26.5% average speed loss. Its figures for others are 27.2% for NordVPN, 33.5% for Surfshark and 20.8% for ExpressVPN. By connection, CNET reports a loss of 30.9% on Mac and 36.1% on Windows over Ethernet, and 14.5% and 24.7% over Wi-Fi. PCWorld measured servers in different countries over several days and found downloads at 53% of its base speed and uploads at 49%, which it calls comfortably fast for gaming, streaming and calls. CNET counts 566 servers in 91 cities across 50 countries; PCWorld counts 579 servers and 90 countries.

On features, CNET lists DAITA, split tunneling on Mac, Windows, Linux and Android, multihop with a free choice of entry and exit, five obfuscation methods and DNS filtering that blocks ads, trackers, malware, gambling, adult content and social media for every user. CNET says no other VPN offers DAITA, which it describes as mixing dummy packets into the tunnel and making packets the same size, against traffic analysis by AI; it warns DAITA will likely cost speed and mobile data. PCWorld calls DAITA among the most advanced such tools and names two newer obfuscation modes, LWO and QUIC. It also describes GotaTun, a WireGuard implementation written in Rust, already running on Android with desktop and iOS support promised for later this year.

PCWorld says the kill switch is on by default, that a Lockdown mode allows the device online only through a Mullvad server, and that DNS leak protection is always on and cannot be switched off. Its DNS leak tests on Windows and Android found no leaks, and it says the kill switch held during disconnects, reconnections and restarts. CNET’s summary also lists no leaks detected. Our page on what a VPN kill switch blocks covers how such a feature works. PCWorld also says WireGuard-based connections have had quantum-resistant encryption by default since 2024. For people who torrent, two small facts: PCWorld’s summary box lists P2P as allowed, and Mullvad’s pricing page answers “No” to the question about port forwarding.

Streaming is the weak point in both. CNET could open Netflix libraries, but Disney Plus, Hulu and Amazon Prime Video detected the VPN and refused, and it called Mullvad a poor choice for streaming. It says the Android app can be sideloaded on a Fire TV Stick, and lists no native Apple TV app; it also names Fire TV among the supported platforms and, in its list of drawbacks, no native Fire TV app. PCWorld found Netflix, Hulu and HBO Max hit or miss: some servers worked and others were blocked. For streaming, CNET recommends ExpressVPN, or Surfshark or Proton VPN on a budget; our page on whether Surfshark is a good VPN reads one of them.

Who the reviewers say it fits, and what we did not do

CNET scores Mullvad 8.2 out of 10: value 8, speed 9, features 8, usability 6 and privacy 10. Its cons are streaming, no transparency report, five connections and no native Apple TV or Fire TV app. It calls Mullvad the VPN it recommends most to people with critical privacy needs, and says casual users who want streaming may do better elsewhere. Windscribe is the only service CNET says comes close on privacy and plain pricing, with wider device support and better streaming for a little more. PCWorld lists exceptional privacy, strong security features, fast speeds and trustworthy practices as pros, and weak streaming, a small server network and few extras as cons, and calls it one of the top VPN services for the privacy-conscious.

Both reviews say they may earn a commission if you buy through their links, so a reader should weigh that. Mullvad’s own pages, by contrast, are the seller describing itself. We tested nothing: no speed test, no leak test, no payment. We did not open the Cure53 reports, any audit from 2022 onward, any other review site, any forum thread or Mullvad’s account recovery page. Our VPN pages say nothing is ranked until we have paid for the accounts and used them ourselves, and this page ranks nothing.