The Registration-Free Model Explained
When you sign up for Mullvad, the website generates a random 16-digit account number and displays it on screen. That is the entire registration process. No email address. No username. No password. The account number is your only credential — write it down or save it, because Mullvad has no way to recover it if lost. This design choice means Mullvad cannot link your account to your identity even if compelled to do so, because the link simply does not exist.
Payment methods reflect the same philosophy. Credit cards and PayPal are accepted (linked to your account number, not your personal details), but Mullvad also accepts Bitcoin, Monero, bank wire, and physical cash sent by post. Users have mailed envelopes containing €20 in banknotes to Mullvad’s Gothenburg office; the company credits the account number written on the enclosed note. The result is a subscription service where, in the most privacy-conscious payment scenario, no financial institution has any record of the transaction.
The 2023 Police Raid: Real-World Privacy Validation
In April 2023, Swedish police arrived at Mullvad’s offices with a court order to seize servers as part of a criminal investigation. Mullvad staff cooperated with the search. The police left without any data, because the servers they examined contained no user connection logs, no traffic records, and no account association data. The incident was publicly disclosed by Mullvad within hours of it occurring.
This event is significant for two reasons. First, it validates Mullvad’s no-logs claims under real adversarial conditions — not a self-commissioned audit, but an actual law enforcement action. Second, Sweden’s membership in the 14-Eyes surveillance network raises theoretical concerns about data sharing; the raid demonstrated that those concerns do not translate into practical risk when the underlying data simply does not exist.
Sweden Jurisdiction: Risk Assessment
Sweden participates in intelligence sharing arrangements with the 14-Eyes alliance. However, Swedish law does not require VPN providers to retain user connection data. The legal obligation to hand over data only applies to data that exists. Mullvad’s architecture ensures that no useful data exists to hand over. Compare this to Proton VPN’s Swiss jurisdiction: both provide strong legal protection through the absence of data, though Switzerland’s non-alliance status provides an additional layer of legal separation that Sweden cannot match.
Flat Pricing and No Discounts
Mullvad charges €5 per month. No annual plans. No two-year discounts. No promotional pricing. No email required for a coupon code. This pricing model has been unchanged for over 15 years. The consistency is a deliberate statement: Mullvad does not need to pressure users into long-term commitments because the service is worth its monthly rate on its own terms. The lack of multi-year plans also means you are not locked into a service if your needs change.
Speed and Protocol Support
Mullvad supports WireGuard, OpenVPN, and a DAITA (Defense Against AI-guided Traffic Analysis) mode that adds traffic shaping to resist machine-learning based traffic analysis. On standard WireGuard, we measured 448 Mbps download and 390 Mbps upload on a 500 Mbps baseline. DAITA reduces speeds by approximately 15–20% due to traffic padding overhead but provides the strongest available defense against sophisticated traffic analysis attacks.
Limitations to Know Before Signing Up
Mullvad is deliberately not designed for streaming. They do not maintain specialized streaming servers, do not rotate IPs specifically for platform unblocking, and do not provide any media-focused features. Netflix US unblocking succeeds occasionally but is unreliable. BBC iPlayer and Disney+ block Mullvad servers consistently. If streaming access is your primary use case, CyberGhost or NordVPN are more appropriate choices. Mullvad is purpose-built for privacy-first users who want the most credible, independently validated no-log VPN available in 2026.
