Mullvad VPN review: Our favorite ultra-private VPN gets even better

Credit: Mullvad

Mullvad in brief:

• P2P allowed: Yes
• Business location: Sweden
• Number of servers: 780
• Number of country locations: 35 (38 for WireGuard)
• Cost: €5 ($5.86 at this writing) billed monthly
• VPN protocol: OpenVPN
• Data encryption: AES-256-GCM
• Data authentication: TLSv1.3 (TLS_CHACHA20_POLY1305_SHA256)
• Handshake: 4096-bit RSA

For a long time Mullvad has been a solid VPN service that didn’t change a whole lot other than adding an improved app. It continues to use its improved VPN app that we saw roll out several years ago, but the company is also adding new features and dramatically expanding its network compared to what we saw last time around. 

Note: This review is part of our best VPNs roundup. Go there for details about competing products and how we tested them.

Despite the changes, Mullvad’s greatest strength is still that it prefers to know as little about you as possible, which is a huge win for anyone trying to stay as anonymous as possible online. The company doesn’t even want to retain your email address—whether a primary address or a “burner” one only for VPNs.

Instead, Mullvad issues each user an account number—current numbers are about 16-characters long. The company’s attitude seems to be that the less it knows about you, the better.

IDG

Mullvad’s app looks modern and clean, and very much like a Windows Store app. It starts with a non-interactive map in the primary section of the window to show which location you’re connected to, or your default location at the country level.

When connected, you’ll see a Switch location and Disconnect button at the bottom of the window. The top of the screen, meanwhile, shows a green banner with the Mullvad VPN logo indicating you’re connected.

Click the Disconnect button and Mullvad shows your true location, the top goes from green to red, and the buttons at the bottom are labeled as the last country you connected to and Secure my connection.

If you jump into the country listings, you can either select a country, select a specific location within the country if more than one is available, and drill down to individual servers. The app doesn’t show any specific metrics about each server such as ping times or load, but if there’s a red circle next to it that means it’s not available for use. Green, meanwhile, means it’s working.

The app is very easy to read and understand. It’s not a free moving window by default. Instead it’s a panel that’s permanently fixed to the bottom-right corner of the screen. There’s enough space that it doesn’t feel constrained sitting there. If you don’t like that, however, Mullvad allows you to undock the app and move it around like a normal window. To do so select the settings cog at the top right of the window and then go to Preferences > Unpin app from taskbar. 

Features and services

Mullvad traditionally hasn’t been big on extra features or services compared to other VPNs. It doesn’t promise to get past Netflix VPN restrictions (though sometimes it does), there aren’t any double-hop connections, or smart DNS; however, it has added a few extra features recently. Mullvad recently introduced DNS-based ad and tracker blocking inside the desktop app. These features aren’t activated by default. To turn them on you need to select Settings > Preferences > Block Ads and Preferences > Block trackers. If you’d like to read about how Mullvad implements ad blocking check out the blog post on the company’s site. The long and short of it is that the new DNS blocking doesn’t substantially change how its service is configured and therefore doesn’t affect Mullvad’s privacy promises. 

Mullvad’s also added split tunneling, which allows some apps to operate over the VPN, while others don’t. Split tunneling is a beta feature, but if you want to use it, go to Settings > Advanced > Split tunneling. 

IDG

There are a few other options you can find in the settings. Under Settings > Preferences there are options to auto-connect when Windows starts, or automatically connect when you open Mullvad. Both are off by default. Under this section you can also enable your PC’s sharing options even though you’re on a VPN. You can also opt to use a monochromatic tray icon if you have visual needs, as well as the option to start Mullvad minimized, and to sign up for Mullvad’s beta program.

Go to Settings > Advanced, and you can enable Mullvad’s IPv6 option, as well as manually choose between using OpenVPN or WireGuard. Mullvad was one of the earliest VPN services to implement WireGuard.

Another nice tool to use with the VPN is Mullvad’s connection check webpage. It lets you know if the app is working and currently connected to Mullvad. It also checks to see if you are leaking DNS requests, suffering from a WebRTC leak, or using a blacklisted IP address.

Mullvad has apps for Windows, Mac, Linux, iOS, and Android. 

Performance

Mullvad’s number of servers and country locations has increased since our last review, while its performance has remained solidly the same. That’s great news since Mullvad was already one of the standouts. The company now covers 38 different countries (35 over OpenVPN), with a staggering 780 servers. That is a massive increase considering Mullvad only had 304 last time we looked. 

Mullvad’s change is largely thanks to its decision to start renting servers (actual boxes, not virtual servers) instead of owning every single piece of equipment that runs its VPN. Mullvad explains in clear terms on its help pages what the differences are between rented and owned servers. You can see which servers are owned by Mullvad and which are rented on its Servers page.

For this round of testing we tested both OpenVPN and WireGuard performance to see if there was any difference on Windows. OpenVPN performed better than WireGuard in our testing, which takes the average performance of connections to five different countries over three days of testing with multiple runs.

Using OpenVPN, Mullvad retained close to 39 percent of the base speed. That’s not quite as strong as we saw last time, but is still good enough to put Mullvad in the top 10 for speed, though just barely. Mullvad using WireGuard was a little slower around 35 percent of the base speed. 

Speeds were particularly strong in Germany and the UK, coming incredibly close to the base speeds, often within 10-15Mb/s over OpenVPN. WireGuard had similar results, although they were less consistent than OpenVPN’s.

The bottom line is that, overall, you should be happy with the speeds from Mullvad, with the usual caveat that your experience may vary depending on your location in the world, equipment, and ISP.

Privacy, anonymity, and trust

IDG

Mullvad’s privacy policy is exactly what you’re looking for in a VPN. Though it has now been split into two different documents: the general privacy policy and the “no-logging of user activity policy.” In those two documents the company says it does not “store any activity logs or metadata.” There’s no logging of your online traffic, DNS requests, connections, timestamps, IP addresses, bandwidth, nothing. The server logs are sent to /dev/null, a nonexistent directory on Linux machines. In other words, the logs are automatically sent into the ether.

The only data Mullvad saves are the total number of current connections of all users on its network, the CPU load per core on its servers, and the total bandwidth used per server. It also logs the real-time number of connections per account as the service allows five simultaneous for each account.

The company also takes the time to explain how much privacy you should expect from Mullvad based on the VPN protocol you use, and the payment type you use.

If you mail cash, for example, Mullvad says it will take the cash, add credits to the account number included in the envelope, and then shred the envelope and the note. If you choose to use credit cards or PayPal, however, you will be identifiable through those payment services.

Mullvad accepts cash, cryptocurrencies, credit cards, bank wires, Swish (a Swedish mobile payment service), and PayPal.

As for the Mullvad website servers, all logs are stored for up to 5 minutes. Mullvad’s website cookies also expire pretty quickly. You can read about that in more detail on the company’s cookie policy page.

Mullvad is owned by Amagicom AB and based in Sweden. The company CEO is Jan Jonsson, and the co-founders are Fredrik Strömberg and Daniel Berntsson.

Conclusion

It’s good to see Mullvad adding new features that enhance privacy and security, and this expansion of its network means it’s easy to get a solid connection without too many maxed out servers. With its continuing commitment to privacy and anonymity (at least as close as you can realistically get online) as well as performance, Mullvad remains one of our top recommendations.

Editor’s note: Because online services are often iterative, gaining new features and performance improvements over time, this review is subject to change in order to accurately reflect the current state of the service. Any changes to text or our final review verdict will be noted at the top of this article.