Cross-silo
Mullvad review: a privacy-first VPN with a different trade-off
Original illustration of Mullvad's numbered account and privacy-first trade-off
Original editorial illustration created for VPNVertex.
Illustration, not a VPNVertex hands-on test.
Mullvad is a privacy-first VPN built around numbered accounts and a flat monthly price. This review checks its no-logging policy, device limit and refund terms against official sources.
Mullvad’s numbered accounts and flat monthly pricing make it unusually privacy-focused. The trade-off is a smaller, less conventional product experience than many mainstream VPN buyers expect.
This page may contain affiliate links. They do not change the price you pay or our editorial assessment.
This assessment is based on Mullvad’s current documentation, published security work and independent reviews. It is not a VPNVertex hands-on test.
The short answer
Mullvad is a strong fit for someone who wants to minimize the information needed to open an account and who prefers a simple, flat price. Its privacy policy describes an account number instead of a name, password or email address, and its current pricing model is €5 per month rather than a large discount that depends on a long subscription.
That clarity comes with limits. Mullvad supports five devices, its refund rules depend on the payment method, and readers looking for the broadest streaming or bundle ecosystem may find a more conventional provider easier to live with. The right choice depends on whether account minimization matters more than convenience.
Who should choose Mullvad
Mullvad is aimed at a reader who sees the VPN as a privacy layer, not as a household entertainment bundle. The strongest fit is someone who is comfortable managing a numbered account, wants a flat subscription model and would rather compare policy language than collect promotional extras. It is also a good fit for a technical reader who values open-source references, a public help center and settings that expose the trade-offs between protection, battery use and performance.
The weaker fit is a family that wants one conventional dashboard with many simultaneous devices, password recovery by email and a wide set of bundled services. Five devices can be enough for an individual or a small setup, but it is not a generous household allowance. A buyer who needs a particular streaming catalog should also treat that as a separate compatibility question rather than as a consequence of Mullvad’s privacy design.
That audience distinction matters because a generic “best VPN” ranking can punish Mullvad for not behaving like a bundle, or reward it for privacy features that another reader will never use. The decision below is therefore intentionally conditional.
What makes Mullvad different
Most consumer VPNs begin with an email address and a password. Mullvad’s account model begins with a randomly generated account number. That reduces the amount of identifying information required at signup and makes the service feel closer to a privacy utility than to a typical subscription dashboard.
Payment is still a separate consideration. A payment record can exist outside Mullvad’s account design, depending on the channel used. Readers who care about the full payment trail should read the provider’s policy and choose a method whose privacy and refund properties they understand.
The flat-price model is similarly straightforward: Mullvad’s February 2026 pricing announcement says the service charges €5 per month regardless of the duration selected. That is easy to compare, but it can look less attractive than a two-year promotional price on another VPN when the headline cost is the only criterion.
Privacy and logging
Mullvad’s no-logging policy says it does not log traffic, DNS requests, connection timestamps, IP addresses or bandwidth. The same page explains that the service does retain limited operational information, such as aggregate system metrics, and temporary state needed to manage simultaneous connections. A no-logging claim should be read at that level of detail rather than treated as “the provider stores nothing.”
The account number is the most meaningful privacy advantage for many readers. There is no required email address to reset, but that also means there is no ordinary email-based recovery path if an account number is lost. That is a genuine trade-off, not a footnote.
For a broader explanation of what published audits can and cannot prove, see our guide to independent VPN audits. An audit is a point-in-time examination of a defined scope; it is not a permanent guarantee that every future app release or operational process remains unchanged.
Security features and app transparency
Mullvad’s Windows materials describe a modern app built around WireGuard and privacy controls such as a kill switch. The service also documents multihop routing and additional anti-tracking features in its app materials. Readers who want to inspect the implementation can review Mullvad’s public source-code and audit references rather than relying only on a marketing feature list.
The provider’s current Windows download page lists a 2026 app release and links to recent security work, including a 2026 security assessment and an earlier application audit. Those references are useful signals because they give readers something more concrete to examine than an unqualified “secure” label. They still do not replace a review of scope, date and remediation status.
Independent coverage adds needed balance. Current search results for Mullvad reviews include PCWorld, PCMag, CNET and RTINGS alongside affiliate review sites. That mix suggests a mature review intent: readers are comparing privacy, usability and real-world fit, not merely asking whether Mullvad exists.
Devices, refunds and everyday fit
Mullvad allows five simultaneous connections. That is enough for a laptop, phone, tablet and a couple of household devices, but it is below the ten-device allowance commonly advertised by larger competitors. A household with many TVs, consoles and browsers should count the devices before subscribing.
The current refund page describes a 14-day money-back guarantee for several payment methods, including cards and selected online payment channels. Cash, cryptocurrency and some voucher-style payments are excluded. The safest assumption is that a refund depends on both the payment method and the applicable terms at purchase.
Streaming should also be treated as a changing compatibility question. A provider can work with a service one month and be challenged the next. Mullvad’s privacy-first positioning is more durable than any single streaming result, so readers who need a specific catalog should verify that requirement separately.
Questions to answer before subscribing
First, decide whether five simultaneous connections cover the devices that matter. Mullvad’s device count is easy to understand, but it is also easy to underestimate. A phone, work laptop, personal laptop, tablet, smart TV and console already exceed the allowance unless some devices are left outside the tunnel.
Second, decide whether a numbered account is a benefit or a responsibility. It minimizes signup data, yet losing the account number can be more consequential than forgetting an email password. Store it in a secure password manager or another recovery method you trust.
Third, match the payment method to the threat model. Mullvad’s refund exclusions mean that the most private-feeling payment route may not have the same refund flexibility as a card. That is not a reason to avoid the service; it is a reason to choose deliberately and keep the policy page available when paying.
Finally, separate privacy from anonymity. A VPN can reduce exposure to an internet service provider and protect traffic on an untrusted network, but it cannot make an account, browser fingerprint, payment record or logged-in website anonymous. Mullvad’s minimal account design helps with one part of that picture; it does not erase the others.
Mullvad compared with mainstream alternatives
Mullvad is easiest to understand when compared on priorities rather than on a single score. A buyer who wants a broad security suite may prefer to start with our NordVPN review. Someone who values a free tier and a different privacy ecosystem can read the Proton VPN review. Readers focused on conventional family-device coverage can use the Surfshark review as a counterpoint.
| Priority | Mullvad’s position | What to check |
|---|---|---|
| Minimal signup data | Numbered account with no required email | Account recovery and payment trail |
| Price clarity | Flat €5/month model at the check date | Currency, tax and current terms |
| Household coverage | Five simultaneous connections | Every device you intend to protect |
| Refund flexibility | 14 days for eligible methods | Exclusions for the chosen payment route |
Plans, price and renewal logic
Mullvad’s official February 3, 2026 announcement says the service continues to use a fair-price model of €5 per month regardless of how long a customer pays for. This is a dated source-backed value proposition, not a price guarantee for every currency, tax situation or future checkout. The provider also says its pricing page contains current conversion information for currencies including USD, GBP, SEK, AUD and CAD.
The model is easier to audit than a discounted two-year card: there is no first-year teaser in the article’s decision. It can nevertheless cost more than a long promotional subscription if the buyer is comparing only the advertised monthly equivalent. The fair comparison is the actual amount charged in the billing currency, the number of months credited and the refund route attached to the payment method.
Renewal is not the only volatility to watch. Payment processors, app stores and vouchers can change the recovery path. Mullvad’s refund page was last updated August 26, 2026 and says the 14-day guarantee covers credit card, PayPal, Google Play, Swish and bank wire, while Apple App Store purchases, cash, cryptocurrency and vouchers are not covered by Mullvad’s own refund process. Apple and reseller terms may control instead.
Privacy evidence, not privacy shorthand
Mullvad’s policy is unusually specific about what it says it does not log: traffic, DNS requests, connection events, IP addresses and user bandwidth. It also explains the operational exception needed to limit each account to five simultaneous devices: connection state is handled in temporary memory and is not permanently stored. That explanation is more useful than a large no-logs badge because it exposes the boundary between a live service control and retained activity.
The same policy explains that payment data can involve third parties. Cards, PayPal, Swish and bank wire payments may create records with the processor or bank, even when the VPN account itself is represented by a token. Cash and cryptocurrency have different records and refund characteristics. The right conclusion is not “Mullvad has no data”; it is “Mullvad minimizes the account identifier and states a narrow activity-logging policy, while payment and support channels still have their own records.”
Published security work is another evidence layer. Mullvad’s Windows page listed a February 2026 security assessment by Leviathan and a November 2024 app audit by X41 D-Sec when checked on September 16, 2026. Those are useful dates and scopes to preserve. An audit is not a permanent claim about every future build, and this article does not convert the existence of an audit into a VPNVertex security certification.
Original diagram created for VPNVertex.
Applications and important functions
The official desktop guide, updated August 26, 2026, covers Windows, macOS and Linux and links to mobile guides. It documents an always-on kill switch, WireGuard settings, multihop, DAITA, split tunneling, custom DNS and anti-censorship controls. The Windows download page listed version 2026.5 on the check date and linked the source code, the latest security assessment and the earlier app audit.
These features are meaningful because the provider describes what they do and also names their costs. Mullvad warns that DAITA can increase network traffic and battery use. It notes that multihop can affect speed and latency. The kill switch blocks internet traffic while a connection is being established or re-established. Those are operational details a reader can use to choose a setting; they are not results from a hands-on VPNVertex test.
The app guide also documents a lost-account recovery tool when a recent payment exists, which softens the risk of losing a numbered account, but does not remove it. The most privacy-minimal signup model and the most convenient recovery model are not the same thing.
Support, limits and day-to-day friction
Mullvad documents in-app support requests and a public help center. Its policy says support email can contain personal data if the customer includes it, and the provider recommends caution with plain-text email. This is consistent with the broader model: the service tries to minimize routine account data, but a support conversation can create a separate record because a human issue needs context.
The five-device cap is the practical limit that appears most often in a household decision. There is also a usability cost to the account number: no email is required, but a lost number is harder to recover than a forgotten password. A card payment may be easier to refund than cash or cryptocurrency. A specific streaming need may require a different provider. Those are not hidden defects; they are the price of a coherent privacy posture.
Streaming and performance are deliberately not scored here. Compatibility changes, and the available third-party reviews use different dates, devices and test methods. If one catalog matters, use the current provider terms and the eligible refund window to verify that use case yourself.
Comparison by need
| Need | Mullvad fit | What the reader should verify |
|---|---|---|
| Minimum signup information | Strong | Account-number storage and recovery |
| Flat price without a teaser tier | Strong | Currency conversion, tax and current checkout |
| Many household devices | Limited | Five-device ceiling |
| Specific streaming service | Uncertain | Current service compatibility |
| Privacy evidence | Documented | Audit date and scope |
For a provider with a more conventional account and broader comparison set, read our NordVPN review. For an ecosystem with a free tier, the Proton VPN review gives useful contrast. The independent VPN audits guide is the right next read if the decision depends on how much weight to assign to policies and audits.
Methodology and what we did not test
This review was built from Mullvad’s official no-logging policy and current app and refund documentation, checked September 16, 2026, plus independent reviews from established technology publications listed in Sources.
What we did not test
We did not run VPNVertex speed tests, DNS-leak tests, kill-switch tests, streaming tests, device-count tests or payment/refund transactions. We did not inspect a customer account, create a Mullvad account, submit a support request or claim that any third-party review represents our own measurement. The article uses dated source claims and makes no promise that a current feature or streaming result will persist.
Original diagram created for VPNVertex.
Final verdict
Choose Mullvad if your first question is “how little account information do I need to provide?” Its flat pricing, numbered accounts and clearly stated logging policy are unusually coherent. Choose another provider if you need more than five simultaneous devices, conventional account recovery, a broad bundle or a specific streaming guarantee. For a mainstream alternative, compare current NordVPN plans and our PureVPN review.
Before paying, read the current refund terms, select a payment method that matches your privacy needs and compare the provider’s audit scope with the wider evidence in our VPN audit guide.
Sources
- Mullvad no-logging policy
- Mullvad Windows app and security references
- Mullvad pricing announcement
- Mullvad refund policy
- PCWorld review, RTINGS review and additional independent results retained in the dated editorial research record
