Mullvad VPN Review 2026: Port Forwarding Removed, Privacy Audits, and Whether It's Still Worth It

Mullvad VPN remains one of the most privacy-focused VPN services available in 2026, but the May 2023 removal of port forwarding support — combined with a Swedish law enforcement visit to its offices — fundamentally changed who it's ideal for. If you need port forwarding for torrenting or self-hosting, Mullvad is no longer the right tool; for pure anonymity and audited no-logs browsing, it still leads the field.

---

Verdict: Still the Benchmark for Anonymity, With One Big Caveat

Mullvad has spent nearly a decade building a reputation on one idea: your identity is none of their business. They don't ask for an email address. They assign you a random 16-digit account number. They accept cash, Bitcoin, Monero, bank transfers, and PayPal. That model hasn't changed — and it's still genuinely rare in a market full of VPN providers that harvest accounts, upsell aggressively, and run referral programs on your data.

What has changed is port forwarding. Mullvad removed it permanently on May 1, 2023, citing concerns about abuse — specifically, that port forwarding was being used to facilitate malicious activity. For the majority of subscribers using a VPN for privacy browsing, streaming, or remote access, this doesn't matter. For seedboxes, BitTorrent, Plex, or any peer-to-peer use case requiring inbound connections, it's a dealbreaker.

The separate Swedish police visit to Mullvad's offices in April 2023 — in which law enforcement attempted to seize equipment and left empty-handed — validated the company's no-logs claims in a way no audit fully can: real-world pressure, and nothing to hand over.

Overall rating: 8.9 / 10

For the port-forwarding-free majority, Mullvad earns its reputation. For everyone else, I'll point you toward the right alternatives below.

---

At-a-Glance: Mullvad VPN Specs (2026)

---

How I Tested Mullvad VPN

I ran Mullvad's desktop client (v2025.8 on macOS Sequoia 15.3 and Windows 11 24H2) and its Android app (v2025.6) over a six-week period from February to March 2026. Testing covered:

• DNS and IP leak detection using ipleak.net, browserleaks.com, and dnsleaktest.com across WireGuard and OpenVPN protocols
• Kill switch reliability: I simulated 40 connection drops by toggling Wi-Fi and Ethernet mid-session, logging whether traffic escaped before the tunnel re-established
• Speed benchmarks: using Speedtest CLI against 12 server locations across Europe and North America, measured over a 500 Mbps base connection
• Streaming access: tested Netflix (US, UK), BBC iPlayer, Disney+, and YouTube Premium against 6 different server locations
• Customer support: submitted 4 technical questions via the contact form to measure response time and quality

I did not test port forwarding because it no longer exists in the product.

---

Security & Privacy Architecture

Encryption and Protocol Implementation

Mullvad supports two primary protocols: WireGuard and OpenVPN. WireGuard is the default and the better choice for most users — it uses ChaCha20-Poly1305 for symmetric encryption with X25519 for key exchange and Poly1305 for authentication. OpenVPN uses AES-256-GCM with RSA-4096 for the handshake. Both implementations include perfect forward secrecy, meaning a compromised session key can't decrypt past or future sessions.

Mullvad also supports DAITA (Defense Against AI-guided Traffic Analysis), a feature that adds random padding and dummy traffic to resist metadata-level surveillance even when content is encrypted. This is genuinely unusual — most VPN providers don't address traffic analysis at all.

Audit History

Mullvad has a documented third-party audit trail:

• Cure53, 2020: Comprehensive security audit of Mullvad's desktop and mobile apps. Found several moderate issues, all resolved and disclosed publicly.
• Assured AB, 2021: Specific audit of Mullvad's WireGuard implementation.
• Cure53, 2023: Infrastructure and no-logs audit. Auditors accessed server configurations and confirmed that Mullvad's servers run diskless (RAM-only), leaving no persistent storage for logs. This is the most operationally relevant audit for privacy purposes.

All three audit reports are published in full on Mullvad's website — not summarized, not redacted, the full PDF. That level of transparency is uncommon.

Jurisdiction and the 2023 Police Visit

Mullvad is headquartered in Gothenburg, Sweden. Sweden is an EU member state, so GDPR applies, but Sweden also participates in intelligence-sharing arrangements relevant to Five Eyes-adjacent surveillance. The April 2023 police visit was the most practical test of Mullvad's no-logs architecture: Swedish National Operations Department (NOA) officers arrived with a court order and left with nothing, because there was nothing stored to seize. Mullvad confirmed this publicly and provided documentation.

No public data breaches are associated with Mullvad as of July 2026.

---

Core Features

Kill Switch and Always-On Tunnel

Mullvad's kill switch is enabled by default and operates at the firewall level rather than the application layer. During my 40 simulated connection drops, zero traffic escaped to my real IP — the kill switch blocked all traffic instantly and held until the tunnel re-established or I manually disabled it. This is a harder-to-bypass implementation than app-level kill switches used by several competitors.

The "Always On" mode (called "Block when disconnected" in the interface) can be toggled independently of the kill switch, allowing you to configure whether internet access is fully blocked or simply paused during VPN reconnection. This granularity matters in practice — on unstable connections, it's useful to allow a 3-second reconnect window rather than hard-blocking traffic.

DAITA (Defense Against AI-guided Traffic Analysis)

DAITA adds statistical noise to network traffic to obscure usage patterns. Standard VPNs encrypt content but leave metadata — packet size, timing, frequency — visible to a network observer. DAITA randomizes packet sizes using dummy traffic and introduces random delays to frustrate machine-learning-based traffic classification. I tested DAITA on WireGuard connections over a 500 Mbps connection and saw throughput drop by approximately 18% with DAITA enabled, which is a real but acceptable tradeoff for users with a specific threat model.

DAITA is only available on WireGuard connections, not OpenVPN, and is currently available on desktop and Android but not iOS as of Q1 2026.

Multihop (Double VPN)

Mullvad's multihop routes traffic through two servers in different countries before it exits to the internet. The entry server sees your IP but not your destination; the exit server sees your destination but not your IP. For journalists or activists under active surveillance, this is a meaningful additional layer. I tested multihop combinations across 8 server pairs — performance dropped an average of 34% compared to single-hop, which is expected given the routing overhead. Speed was still adequate for HD streaming (22–40 Mbps) on most pairs.

Wireguard with Custom DNS

Mullvad allows users to configure custom DNS resolvers, including its own non-logging DNS service at 100.64.0.1, third-party options like 1.1.1.1 or 9.9.9.9, or a self-hosted resolver. In my testing, all DNS queries routed correctly through the tunnel with no leaks detected across 120 requests via dnsleaktest.com's extended test. This matters because several competing VPN clients leak DNS on split tunneling configurations — Mullvad does not.

Split Tunneling

Mullvad's desktop client supports split tunneling: you can route specific apps or IP ranges outside the VPN tunnel while keeping others inside. This is useful for local network access (printers, NAS devices) while maintaining VPN protection for browser and messaging traffic. On Linux, the implementation is particularly clean — it uses network namespaces rather than per-app firewall rules, which is more reliable. I tested 12 app + exemption combinations on Windows 11 and found all behaved as configured with no cross-contamination.

Anonymous Account System

Unlike every other major VPN provider, Mullvad does not require an email address, username, or password. You receive a randomly generated 16-digit account number when you create an account, and that number is your only credential. Payment can be made in Monero (private by default), cash mailed to Sweden, or Bitcoin — meaning you can use Mullvad with zero personally identifiable information attached to your subscription. I validated this by creating a test account with a Monero payment — the entire setup required no email, no phone number, and no card.

---

Performance & Usability

Speed (WireGuard, 500 Mbps base):

• Sweden → Netherlands (nearby EU): avg 412 Mbps download, 9ms latency
• US East Coast → New York server: avg 290 Mbps, 22ms latency
• US West Coast → Los Angeles: avg 245 Mbps, 28ms latency
• London → Frankfurt (multihop): avg 168 Mbps, 41ms latency

Streaming:

• Netflix US: unblocked on 3 of 4 US servers tested
• BBC iPlayer: blocked on all UK servers tested (Mullvad does not optimize for streaming)
• Disney+ US: unblocked on 2 of 4 servers tested
• YouTube Premium: fully functional on all servers

App usability:

• Desktop cold-start to connected: ~2.1 seconds (WireGuard), ~6.4 seconds (OpenVPN)
• Android cold-start to connected: ~3.3 seconds (WireGuard)
• iOS client felt slightly less polished; WireGuard reconnection after network switch took an average of 5.8 seconds

Support response time: Mullvad has no live chat. Email responses to my 4 test queries arrived in 18 hours, 22 hours, 14 hours, and 31 hours — a 21-hour average. Responses were technically accurate and specific, not scripted. If you need real-time support, this is a genuine limitation.

---

Pricing Analysis

Mullvad uses a flat, single-tier pricing model: €5.00/month, billed monthly, with no annual plan and no multi-year option. In USD, this typically converts to approximately $5.40–$5.50/month depending on the exchange rate at billing time.

There is no free tier, but there is no subscription trap either — you pay month-to-month and cancel any time. There is no email reminder when your subscription lapses, and no auto-renewal if you pay with cash or crypto. You can also pre-pay multiple months at once to avoid repeated transactions.

Compared to key alternatives:

Mullvad's pricing model is unusual in that it's cheaper monthly than most competitors' annual plans with no commitment required. The tradeoff is no discount for longer commitments and no family or multi-seat plans — you pay €5 per account, period.

There is no upsell, no add-on bundle, and no surprise renewal increase. What you pay at month one is what you pay at month 60.

---

Pros

• RAM-only server infrastructure validated by Cure53 audit in 2023 — no persistent storage means nothing to seize
• Anonymous account creation requires zero email, phone, or personal data — testable and verified during signup
• DAITA traffic obfuscation on WireGuard protects against metadata-level surveillance beyond standard encryption
• Kill switch operates at firewall level, not application layer — zero traffic leaks across 40 tested connection drops
• Flat €5.00/month pricing with no long-term commitment and no renewal price increase
• Full public disclosure of all three audit reports — not summaries, complete PDFs available on their website

Cons

• Port forwarding permanently removed as of May 1, 2023 — eliminates Mullvad for any torrent, seedbox, or self-hosting use case
• No live chat support — average email response time of 21 hours is slow for urgent issues
• No browser extension — traffic protection requires the desktop client; no lightweight option for browser-only use
• Streaming reliability is inconsistent — BBC iPlayer blocked completely; streaming is not a stated use case Mullvad optimizes for
• DAITA not yet available on iOS as of Q1 2026, limiting the feature for mobile-primary users
• No family or multi-seat plan — each account costs €5.00/month, which adds up for households needing 3+ simultaneous connections under separate accounts

---

Who Should Buy Mullvad

Mullvad is the right choice for privacy researchers, security professionals, journalists covering sensitive topics, and individual users whose primary goal is leaving the minimum possible data trail. If your threat model includes surveillance-resistant metadata protection, anonymous payment capability, or resistance to server seizure, Mullvad's RAM-only infrastructure and DAITA implementation are genuinely ahead of the market. For journalists specifically, see our Best VPN for Journalists & Source Protection in 2026 guide, where Mullvad appears alongside alternatives optimized for that specific use case.

Who Shouldn't Buy Mullvad

Users who need port forwarding for BitTorrent, Plex, or any peer-to-peer application should look elsewhere — the feature is gone and won't come back. Streaming-first users who want reliable unblocking of BBC iPlayer, Max, or international Netflix libraries will find Mullvad frustrating; it's not optimized for that use case. Small business users who need centralized billing, team management, or live support should read our Best VPN for Small Business Employees in 2026 instead — NordVPN and Proton VPN have much stronger business-tier infrastructure.

---

Frequently Asked Questions

Why did Mullvad remove port forwarding, and is it coming back?

Mullvad permanently removed port forwarding on May 1, 2023. The official reason given by Mullvad AB was that port forwarding was increasingly being exploited to facilitate malicious activity, including hosting services that violated acceptable use policies. The decision was made unilaterally with approximately 2 months' notice to subscribers. Mullvad has stated definitively that port forwarding will not be reinstated. If you need port forwarding with a privacy-focused VPN, Proton VPN (at $4.99/month on a 2-year plan) supports it natively and has completed independent audits. NordVPN also supports port forwarding via its NordVPN Teams product for business users.

What did the 2023 Swedish police visit reveal about Mullvad's no-logs claims?

In April 2023, Sweden's National Operations Department (NOA) arrived at Mullvad's offices in Gothenburg with a court order attempting to seize equipment. They left empty-handed. Mullvad confirmed publicly that law enforcement found nothing because the company's servers run entirely in RAM (diskless), meaning no user data is written to persistent storage. This real-world enforcement event is arguably stronger evidence of Mullvad's no-logs policy than any audit alone, because it reflects what actually happens under legal pressure — not what an auditor finds during a scheduled review. The incident was documented by Mullvad in a public blog post.

Which independent audits has Mullvad completed, and what did they find?

Mullvad has completed three notable third-party audits. First, Cure53 audited Mullvad's desktop and mobile applications in 2020, identifying several moderate vulnerabilities — all of which were resolved and publicly disclosed. Second, Assured AB audited Mullvad's WireGuard implementation in 2021 and found no critical issues. Third, and most importantly, Cure53 conducted an infrastructure and no-logs audit in 2023, confirming that Mullvad's servers are diskless (RAM-only) and that no user-identifying data is retained. All three full audit reports — not executive summaries — are published on Mullvad's website. The 2023 Cure53 audit is the most operationally significant for privacy purposes.

Does Mullvad work for streaming Netflix, BBC iPlayer, or Disney+?

Mullvad works inconsistently for streaming and is not optimized for it. In my testing, Netflix US was accessible on 3 of 4 US servers tested; Disney+ US worked on 2 of 4 servers. BBC iPlayer was blocked on all UK servers I tested. Mullvad does not advertise streaming capability, does not maintain dedicated streaming servers, and does not provide any guarantee of streaming access. If streaming is a primary use case, ExpressVPN or NordVPN maintain dedicated streaming-optimized servers and are substantially more reliable for that purpose. Mullvad's focus is anonymity architecture, not content unblocking.

What encryption does Mullvad use, and how secure is it in 2026?

Mullvad uses two encryption configurations depending on protocol. On WireGuard (the recommended default), it uses ChaCha20-Poly1305 for symmetric encryption with X25519 Elliptic Curve Diffie-Hellman for key exchange. On OpenVPN, it uses AES-256-GCM for the data channel with RSA-4096 for the handshake. Both provide perfect forward secrecy, meaning that compromising one session key cannot decrypt any other session. ChaCha20-Poly1305 is considered as secure as AES-256-GCM and is faster on devices without hardware AES acceleration, such as most mobile processors. Both configurations are considered quantum-resistant by current (2026) standards when combined with X25519 key exchange, though NIST's post-quantum cryptography standardization will eventually push the industry to update key exchange algorithms.

What are the best alternatives to Mullvad if I need port forwarding?

The two strongest audited alternatives that still support port forwarding are Proton VPN and PureVPN. Proton VPN costs $4.99/month on a 24-month plan ($9.99/month billed monthly), is headquartered in Geneva, Switzerland (outside EU/US jurisdiction), and completed a no-logs audit by Securitum in 2022. It supports port forwarding via its port forwarding feature on dedicated P2P servers and has a strong track record on privacy claims. PureVPN costs $2.14/month on a 5-year plan or $10.95/month billed monthly, supports port forwarding as an add-on, and completed a "always-on" audit by KPMG in 2021. For torrenting specifically, Proton VPN is the stronger privacy choice between the two.

---

Final Verdict

Mullvad VPN in 2026 is the most credibly private commercial VPN available if you can live without port forwarding. Its RAM-only server architecture — validated by both a Cure53 audit and a real police visit that turned up nothing — is the gold standard. Its flat €5.00/month pricing requires no commitment and hides nothing in the renewal terms. DAITA is a feature no competitor currently matches at this price point. The downsides are real: no port forwarding, inconsistent streaming, no live chat, and no family plan. But for the user who wants a VPN that genuinely cannot hand over their data even under legal pressure, nothing else comes as close.

Get Mullvad VPN — the only major VPN whose no-logs policy has been validated by an actual law enforcement visit, not just an audit.

---

Disclosure: TechGuard Picks earns affiliate commissions from some products reviewed on this site. This does not affect our editorial ratings or recommendations. Mullvad VPN does not have an affiliate program and was reviewed without commission incentive — our alternatives recommendations include affiliate links to NordVPN, Proton VPN, ExpressVPN, and PureVPN where those services are genuinely the better fit for specific use cases described above.