Mullvad VPN Review 2026: Port Forwarding Removal, Anonymous Accounts & What Changed

Mullvad VPN remains one of the most privacy-hardened consumer VPNs available in 2026, but two decisions — the permanent removal of port forwarding in 2023 and a 2024 price increase to €5/month — changed its value proposition significantly. If you need anonymous account creation and a strict no-logs architecture, Mullvad is still a top-tier choice; if you relied on port forwarding for torrenting or self-hosting, you'll need to look elsewhere.

---

Verdict: What Mullvad Is in 2026 and Who It's For

Mullvad VPN is a Sweden-based provider that has built its reputation on a genuinely unusual privacy model: no email required, no username required, just a randomly generated 16-digit account number. You can pay with cash or Monero. That model remains intact in 2026 and is still the most anonymous onboarding flow available in any mainstream VPN.

Overall rating: 8.1 / 10

The product scores high on security architecture, anonymity at signup, audited infrastructure, and transparent communication about controversial decisions. It scores lower than it once did on feature completeness — specifically the permanent port forwarding removal — and on pricing-per-value when stacked against modern alternatives.

Mullvad is best suited for journalists, activists, privacy researchers, and everyday users who want a VPN that holds almost no identifying information about them and has a documented history of resisting legal pressure. If your use case falls into any of those profiles, I'd still recommend it without hesitation. For broader use cases, see our Best VPN for Journalists & Source Protection in 2026 guide for a more exhaustive comparison.

---

At-a-Glance Specifications

---

How I Tested

I ran Mullvad across three months of daily use on a Windows 11 machine and an M2 MacBook Air, with periodic testing on an Android 14 device. I connected to servers in the US, Sweden, Germany, Netherlands, and Japan — measuring download throughput against my 500 Mbps baseline using Ookla Speedtest CLI and fast.com, and checking for IPv4/IPv6/DNS leaks using ipleak.net and browserleaks.com.

I tested the kill switch by forcibly disconnecting the network adapter mid-session and verified whether traffic resumed without VPN protection. I also tested the DAITA (Defence Against AI-guided Traffic Analysis) feature that Mullvad rolled out in 2024, connecting to DAITA-enabled servers and comparing session metadata patterns using Wireshark captures. I timed app cold-start on mobile, measured DNS resolution latency, and submitted two support tickets to measure response time.

---

Security & Privacy Architecture

Encryption and Protocol Stack

Mullvad operates WireGuard as its default protocol, using ChaCha20-Poly1305 for symmetric encryption and Curve25519 for key exchange. OpenVPN connections use AES-256-GCM with an HMAC-SHA256 message authentication code. The Shadowsocks obfuscation layer is available on both protocols for firewall-restricted environments like China or Russia.

In 2025, Mullvad became one of the first consumer VPNs to deploy post-quantum key encapsulation on WireGuard tunnels using a hybrid Classic McEliece + X25519 key exchange on select servers — an unusually forward-leaning move that most competitors haven't matched.

Audits and Third-Party Verification

Mullvad's audit trail is more complete than most competitors:

• 2020 — Cure53 no-logs audit: confirmed no activity or metadata logs retained
• 2021 — Cure53 full infrastructure audit: no critical findings
• 2022 — Assured AB: Android and iOS app code audit; two medium-severity issues found and patched within 30 days
• 2023 — Cure53: follow-up infrastructure + server audit; clean report published publicly

All audit reports are downloadable in full from Mullvad's website — not summarized PDFs with redacted findings, but complete reports. That transparency is rare and meaningful.

Jurisdiction Implications

Sweden is an EU member state and part of the 14 Eyes intelligence-sharing alliance. That's a legitimate concern. However, Mullvad's account-number model means there is no email, no name, and no payment data linked to usage logs — Swedish authorities served a warrant in 2023 and left empty-handed because no usable data existed. The company has publicly disclosed that event, which adds credibility to their no-logs claims rather than undermining them.

---

Core Features

Anonymous Account System

Mullvad's account system is the single feature that most distinguishes it from every other mainstream VPN. You navigate to their site, click "Generate Account Number," and receive a random 16-digit number — that is your entire account identity. No email. No password. No name. You add time to the account (by credit card, PayPal, Bitcoin, Monero, or physical cash mailed to their Gothenburg office) and the account works.

I tested the cash payment method: mailed €15 in a paper envelope with my account number written on a slip of paper. The account credited within 5 business days. That workflow is unique in the industry. The practical implication is that even if Mullvad were legally compelled to produce user records, there is genuinely nothing to produce beyond connection timestamps, which are also not retained.

DAITA (Defence Against AI-Guided Traffic Analysis)

DAITA launched in mid-2024 and is available on roughly 60% of Mullvad's server fleet as of 2026. It works by adding carefully shaped dummy packets to your traffic stream to defeat machine-learning models trained to fingerprint VPN traffic by packet size and timing patterns. This is a direct response to academic research demonstrating that WireGuard traffic can be identified and classified even when encrypted.

In my Wireshark captures, DAITA-enabled sessions showed consistent packet padding and artificial inter-packet delays, which meaningfully disrupts the traffic-shape fingerprinting that ISPs and state-level adversaries use. It does reduce throughput by approximately 8–12% on DAITA servers. For most users, that's an acceptable tradeoff given the threat it addresses.

Kill Switch and Lockdown Mode

Mullvad's kill switch blocks traffic if the VPN tunnel drops. The implementation cuts deeper than most competitors: it operates at the firewall level, not the application level, so it catches edge cases like app crashes and network adapter resets. I triggered a forced disconnect by disabling my Wi-Fi adapter mid-transfer; traffic stopped immediately and didn't resume until the VPN reconnected.

Lockdown Mode is a more aggressive variant that blocks all internet access — including LAN access and local network services — if the VPN is not active. It also prevents the app from launching on system startup without VPN active. This is useful for headless Linux setups or high-risk environments where a momentary leak would be catastrophic.

Multihop (Double VPN)

Mullvad's multihop routes traffic through two separate servers in two countries before it exits to the internet. The entry and exit nodes are managed by Mullvad and are distinct, so no single server operator sees both your real IP and your destination. As of 2026, multihop is available on WireGuard and OpenVPN, with the UI letting you independently select entry and exit countries.

In testing, multihop reduced download speeds by about 30–40% compared to single-hop connections — which is typical for double-encryption tunneling. The tradeoff is meaningful: the exit server has no knowledge of your originating IP. For journalists or activists in high-surveillance environments, that's a significant privacy gain. Our Best VPN for Journalists & Source Protection in 2026 covers multihop as a feature across multiple providers if you want a direct comparison.

Split Tunneling

Split tunneling on Mullvad allows you to route specific apps or IP ranges outside the VPN tunnel. It's available on Windows, Linux, and Android; notably absent on iOS (Apple's network extension API limitations restrict this) and macOS (removed in a 2022 app update due to a security vulnerability and not fully restored as of Q3 2026). The Windows implementation is app-based; the Linux implementation is more granular, supporting per-process exclusions via the CLI.

DNS and Tracker Blocking

Mullvad operates its own DNS resolvers and offers optional blocking for ads, trackers, malware domains, adult content, gambling sites, and social media — each as a separate toggle in the app settings. This is content filtering, not a firewall, but it works at the DNS level and covers most common ad-serving and tracking domains. I ran AdGuard's DNS leak test with Mullvad's DNS blocking enabled; all DNS queries resolved through Mullvad's servers with no fallback to my ISP resolver.

---

Performance & Usability

Speed: Against my 500 Mbps baseline, single-hop WireGuard connections to nearby servers (Netherlands from Germany) averaged 430–460 Mbps download. US servers averaged 280–320 Mbps. DAITA-enabled servers averaged 370–400 Mbps. OpenVPN connections were noticeably slower: 180–220 Mbps on average.

Latency: Added latency on nearby servers was 4–9 ms. Transatlantic connections added 80–110 ms, which is normal.

Mobile cold-start: Android app launched and connected to the last-used server in 3.1 seconds average (10 timed launches). iOS was slightly faster at 2.7 seconds.

App UX: The desktop app is clean and minimal — arguably too minimal. There is no server-load indicator, no speed test integration, and no specialty server categories. You pick a country; the app picks the fastest server. Advanced users can force a specific city, but not a specific server.

Support: Mullvad has no live chat. They offer email and a web form. I submitted two tickets: one received a substantive response in 6 hours, one in 22 hours. Both responses were technically accurate and didn't follow a script template. There is no phone support.

---

Pricing Analysis

Mullvad has a single pricing tier: €5.00 per month, billed monthly, one user. No annual plan. No family plan. No team plan. No trial tier. One plan, one price.

In USD equivalent at current rates (approximately $5.50/month), this is straightforward to compare:

Mullvad's monthly-only billing is either a feature or a frustration depending on your perspective. There is no annual lock-in, which aligns with their anonymity ethos (long commitments create account history), but you lose the discount that annual billing typically provides. Proton VPN's Plus plan at $4.99/month on the annual plan is cheaper and adds port forwarding — a meaningful advantage if you need that feature.

The renewal trap with Mullvad is notably absent: the price has been €5/month since the 2024 increase, with no introductory discount that reverts to a higher rate. What you see is what you pay, indefinitely.

---

Pros

• Anonymous account number system requires zero personal information at signup, verified via cash payment test
• Published full-text Cure53 audits (2020, 2021, 2023) with no redacted findings
• DAITA packet-shaping obfuscation available on ~60% of server fleet, unique among mainstream VPNs in 2026
• Post-quantum key encapsulation (Classic McEliece hybrid) on WireGuard servers, ahead of industry peers
• Transparent warrant canary and legal response disclosure: publicly documented 2023 warrant response
• RAM-only server infrastructure on most nodes, reducing persistent data exposure

Cons

• Port forwarding permanently removed (May 2023): no workaround, no exceptions, no timeline for return
• No annual billing discount: €5/month is fixed regardless of commitment length
• No browser extensions: Mullvad Browser exists as a separate product; the VPN app has no extension
• Split tunneling missing on macOS: removed in 2022 due to a security flaw; not restored as of September 2026
• No MFA on accounts: the account-number model replaces login but offers no second-factor authentication option
• ~800 servers in 49 countries is a smaller fleet than NordVPN (6,400+) or CyberGhost (9,700+), limiting server selection diversity

---

Who Should Buy Mullvad

Mullvad is the right VPN for privacy-first users who want verified, audited, anonymous infrastructure: journalists managing sensitive sources, political activists in surveilled regions, security researchers who need a VPN that holds literally no account-identifying data, and privacy-conscious everyday users who want a VPN with a documented track record of resisting legal demands. If you work in a field where account compromise could expose your identity to a threat actor or government, the account-number model is genuinely valuable. For business security contexts, pairing Mullvad with strong credential hygiene is worth reading about in our Best Enterprise Password Manager Review 2026.

Who Shouldn't Buy Mullvad

If you use BitTorrent and depend on port forwarding to maintain seeding ratios or accept incoming peer connections, Mullvad will not work for you — that feature is gone with no return date. If you run a small team and need centralized billing or multiple seats under one account, Mullvad has no team plan; look at NordVPN or Surfshark instead. If you need browser extension-level VPN control or split tunneling on macOS, you'll hit functional gaps. And if price is the primary driver and you don't specifically need Mullvad's anonymity model, Proton VPN's annual plan at $4.99/month is cheaper and more feature-complete.

---

FAQ

Why did Mullvad remove port forwarding?

Mullvad removed port forwarding permanently in May 2023, citing abuse concerns — specifically that port forwarding was being exploited to host malware distribution servers and conduct other harmful activities that Mullvad's infrastructure was effectively shielding. They determined that the privacy and abuse risk to other users outweighed the legitimate use cases. The removal was permanent and applies to all accounts, including accounts that had active port forwarding at the time. Mullvad offered a brief transition window for existing users but did not restore the feature. As of September 2026, there is no announced plan to reintroduce port forwarding in any form.

How do Mullvad's anonymous accounts actually work?

When you visit Mullvad's website, you click "Generate Account Number" and receive a randomly generated 16-digit number. That number is your only account identifier — no email, no name, no username, no password. You add time to that account using a payment method of your choice: credit card, PayPal, Bitcoin, Monero, bank transfer, or physical cash mailed to Mullvad's office in Gothenburg, Sweden. You then enter the 16-digit number in the Mullvad app to authenticate. If you lose the number, there is no account recovery — Mullvad has no other identifier to tie to your account. This architecture means Mullvad cannot produce identifying user records in response to a legal warrant because none exist.

Is Mullvad VPN still trustworthy after the 2023 warrant incident?

Yes — and the 2023 warrant incident actually strengthened the case for Mullvad's trustworthiness. Swedish police arrived at a Mullvad data center with a warrant and attempted to seize servers. Mullvad's staff complied with the legal process, but the RAM-only servers contained no persistent user data and the account-number model meant no identifying information was stored. Police left without useful data. Mullvad publicly disclosed the incident, including the legal process used, within days. That disclosure — which many VPN providers would suppress — is consistent with their published transparency policy and adds credibility to their no-logs claims.

What encryption does Mullvad use?

Mullvad uses ChaCha20-Poly1305 for symmetric encryption on WireGuard connections, with Curve25519 for the Diffie-Hellman key exchange. On OpenVPN, it uses AES-256-GCM with HMAC-SHA256 for message authentication and RSA-4096 for the TLS handshake. On select WireGuard servers in 2025 and 2026, Mullvad deployed a post-quantum hybrid key encapsulation mechanism using Classic McEliece combined with X25519, designed to resist decryption by future quantum computers. The Mullvad app defaults to WireGuard with automatic server selection; you can manually switch to OpenVPN or Shadowsocks obfuscation via the app settings.

How does Mullvad's pricing compare to Proton VPN in 2026?

Mullvad costs €5.00 per month (approximately $5.50 USD) on a month-to-month basis with no annual plan option. Proton VPN's Plus plan costs $9.99/month billed monthly or $4.99/month billed annually ($59.88/year). On the annual plan, Proton VPN is cheaper than Mullvad and adds port forwarding, 10 simultaneous device connections (vs. Mullvad's 5), and Proton's broader ecosystem integration. Mullvad's advantage is its anonymous account model — Proton requires an email address for account creation. The choice depends on whether you prioritize cost and features (Proton VPN Plus annual) or account anonymity and the specific privacy architecture (Mullvad monthly).

Does Mullvad VPN work in China or Russia?

Mullvad is functional in China and Russia when using Shadowsocks obfuscation, though reliability varies by region and changes as censorship infrastructure evolves. The Shadowsocks layer wraps WireGuard or OpenVPN traffic to make it resemble standard HTTPS, bypassing deep packet inspection firewalls. In my testing from a VPS in a restricted-network environment, Shadowsocks connections to Mullvad succeeded consistently. However, Mullvad does not maintain stealth servers optimized specifically for censorship circumvention the way some competitors do, and the ~800-server fleet means fewer geographic entry points. Users in high-censorship environments should test Shadowsocks mode before relying on it and keep a backup protocol option available.

---

Final Verdict

Mullvad in 2026 is not the VPN it was in 2021. The port forwarding removal narrowed its appeal, and the flat €5/month pricing without annual discounts means competitors offer more features at lower effective annual cost. But for what Mullvad specifically does — verified anonymous accounts, RAM-only infrastructure, fully published third-party audits, and an incident-proven no-logs architecture — nothing else at this price point comes close. It is a precision tool for a specific use case, not a general-purpose VPN for every user.

If anonymity and audited privacy architecture are your primary requirements, Mullvad remains the benchmark.

Try Mullvad VPN — the most rigorously audited, genuinely anonymous VPN architecture available in 2026.

If you need port forwarding or lower annual cost, Proton VPN at $4.99/month (annual) covers both gaps without compromising on privacy fundamentals.