Mullvad Review 2026: Flat €5, No Email, WireGuard Only

One price, and it has never moved

Mullvad's pricing page lists one product at €5 per month, and states plainly: "Our price hasn't changed since, well, ever! We're still offering privacy at the same rate as when we launched in 2009." At the exchange rates shown on that page in August 2026, €5 displays as roughly $5.79, £4.28 or SEK 55.58, though those are live conversions rather than fixed local list prices.

The billing page offers three durations — 1 month, 1 year and 1 decade — and all three bill at the same rate per month. A year is €60 and a decade is €600. There is no tier above or below, no annual saving, no first-term promotion and therefore no renewal shock, which is the single most common complaint about every other VPN in this category.

The comparison that matters is not the first year but the second. A competitor's two-year plan at an advertised $2.99 a month typically renews somewhere near $100 a year; Mullvad's second year costs exactly what the first one did. Over any period longer than about eighteen months, the boring flat rate usually wins on total spend, and it always wins on predictability.

No email, no username, no password

Signing up produces a randomly generated 16-digit account number and nothing else. There is no registration form, no email confirmation and no CAPTCHA. That number is your entire identity: you type it into the app to log in, and you type it in again to add time. Mullvad never learns who you are because it never asks.

The trade-off is that recovery is essentially your problem. There is no "forgot password" flow, because there is no password and no address to send a reset to. Mullvad offers an account recovery tool only if you made a payment on their website within the last 20 days and can be matched by that transaction. Lose the number outside that window and the remaining time is gone.

• Write the 16-digit number into a password manager the moment it is issued — it is the only copy that exists.
• The app warns you in the connection screen starting three days before your credit expires.
• Time is added either by buying credit on the website or by redeeming a voucher, including vouchers bought from resellers.
• Because the account holds only prepaid time, there is no subscription to cancel and no card left on file to forget about.

Paying for it, including cash in an envelope

Mullvad accepts "cash, Bitcoin, Bitcoin Cash, Monero, bank wire, credit card, PayPal, Swish, Eps transfer, Bancontact, iDEAL | Wero, and Przelewy24." The cryptocurrencies carry a stated discount: "Our accepted cryptocurrencies are discounted at 10% due to lower fees and less administration," which brings the effective rate to €4.50 a month.

The cash option is the one that gives the model its point. You post banknotes together with your account number, and the payment reaches Mullvad without a card network, a bank or a payment processor recording that you bought a VPN. Combined with an account that has no email attached, it is the closest thing to an anonymous purchase that a mainstream service still offers. Mullvad asks that you avoid coins, cheques, money orders, registered mail and sealed or taped parcels.

WireGuard only, since 15 January 2026

Mullvad announced the end of OpenVPN in November 2024 and carried it out on schedule: "we are fully removing support for OpenVPN on January 15th 2026." Client-side protocol selection went first, in a 2025 desktop release, and the OpenVPN servers were decommissioned on the announced date. The stated reason was focus — "by moving to a single protocol, we will be able to focus our resources where they can make a difference."

For most users this changed nothing, because WireGuard was already the default and is faster. It matters if you relied on OpenVPN to get through a restrictive network that blocks UDP, or ran it on a router or an older device with no WireGuard client. Those setups had to be migrated, and if you have not touched your configuration since 2024, it has already stopped working.

What Mullvad built with the freed-up resources is DAITA — Defense Against AI-guided Traffic Analysis — developed with Computer Science at Karlstad University. Encryption hides what you send, but the size and timing of your packets can still fingerprint which site you are visiting. DAITA pads packets to constant sizes and injects dummy traffic to defeat that analysis. Version 2, released across all platforms in March 2025, moved the padding rules from the client to the server, so new defences can be deployed without shipping an app update, and cut the dummy-packet overhead by around half.

Quantum-resistant tunnels became the desktop default in the 2025.2 release, announced in January 2025, using Classic McEliece and ML-KEM. This defends against "harvest now, decrypt later" — traffic captured today and stored until a quantum computer can break the key exchange. Mullvad said it hoped "to enable this by default on iOS and Android in the future, once we are sure that it works well."

A small network, and the evidence behind the no-logs claim

Checked on 29 August 2026, Mullvad's server page showed 553 servers online out of 569, across 50 countries. That is a fraction of the 5,000-plus counts advertised elsewhere, and Mullvad's answer is that the composition matters more than the number: every server is "either owned by us or dedicated servers that we rent," rented machines are not shared with anyone else, and there are no virtual servers or virtual locations. A country in the list is a machine physically in that country.

In September 2023 Mullvad completed a migration it had been running since 2022: "we have completely removed all traces of disks being used by our VPN infrastructure." Servers boot from a signed image into RAM using a system they call stboot, so a reboot wipes everything and a seized machine yields nothing that was not already loaded into memory.

The no-logs policy states plainly that "we do not keep activity logs of any kind" — no traffic, no DNS queries, no connection timestamps, no IP addresses, no bandwidth records. What separates Mullvad from every provider making the same claim is that it has been tested. On 18 April 2023 the Swedish police visited Mullvad's Gothenburg office with a search warrant. Mullvad's account: "They left without taking anything and without any customer information."

The audit record is unusually dense, and it continues. Cure53 completed a fourth infrastructure audit in June 2024. Assured Security Consultants published a web application assessment in October 2025 that found no critical, high or medium severity issues. X41 D-Sec published a white-box source-code audit of the payment and account API in January 2026, and Assured audited the GotaTun WireGuard implementation for the Android app in March 2026. In June 2026 Leviathan Security Group passed the Android app through the MASA standardised assessment for the second time.

• Mullvad on the April 2023 police search ↗

What Mullvad will not do for you

This is where most people decide against it, and Mullvad makes no effort to soften any of it. It is not a streaming VPN. Its own help pages state that services "like Netflix frequently block VPN services because their license agreements with content owners do not allow them to show all the movies and shows in all countries," and rather than fight that with rotating IPs, Mullvad documents how to route Netflix outside the tunnel with split tunnelling. If unblocking a foreign catalogue is your reason for buying a VPN, buy a different one.

Port forwarding is gone too, removed on 1 July 2023. Mullvad explained that "individuals have frequently used this feature to host undesirable content and malicious services from ports that are forwarded from our VPN servers," which led to "law enforcement contacting us, our IPs getting blacklisted, and hosting providers cancelling us." Its conclusion: "the abuse vector of port forwarding has caught up with us." Torrent users who need an incoming port will find seeding ratios suffer.

• No free trial. A short trial existed years ago and was withdrawn after bot abuse; the 14-day refund window is the replacement, and it requires paying first.
• Five devices maximum, against unlimited connections at several cheaper competitors.
• No dedicated IP, no ad-blocking bundled as a paid extra, no password manager, no cloud storage — the €5 buys a VPN and nothing else.
• Multihop is available by chaining the SOCKS5 proxy that runs on WireGuard servers, but it is a manual setup rather than a one-click toggle.

Who should actually buy it

Mullvad suits people whose threat model is real: journalists, researchers, activists, anyone on a network they do not trust, and anyone who simply objects to their browsing being commercially observable. For that group, the anonymous account, the cash payment route, the RAM-only servers and the audit history are not marketing features but the whole product.

It suits a second, larger group too: people tired of VPN pricing games. If you want to pay a fair price, never think about renewal dates, and never be upsold an antivirus bundle, €5 flat is the least annoying transaction in the category.

It is the wrong purchase if you want a streaming unblocker, if you need more than five devices, if you want port forwarding for seeding, or if you want a bundle where the VPN is one line item among six. Those are legitimate needs and Mullvad has deliberately declined to meet any of them.

Frequently asked questions

How much does Mullvad cost?

€5 per month, whatever term you buy — about $5.79 at August 2026 exchange rates. One month, one year (€60) and one decade (€600) all bill at the same monthly rate. Paying in Bitcoin, Bitcoin Cash or Monero takes 10% off, making it €4.50 a month. There is no cheaper tier and no more expensive one.

Is there a free trial?

No. Mullvad ran a short no-signup trial years ago and withdrew it after bot abuse. The 14-day money-back guarantee is the substitute, so you pay for at least one month first and request a refund if it disappoints. Note that the guarantee excludes cash, cryptocurrency, vouchers and Apple App Store purchases.

Can I get a refund, and how?

Within 14 days, on credit card, PayPal, Google Play, Swish and bank wire — and bank wire refunds are limited to SEPA payments within Europe. Cash is never refundable, which Mullvad attributes to anti-money-laundering rules, and cryptocurrency payments and vouchers are excluded as well. Choose your payment method with the refund rules in mind if you are unsure about the service.

Does Mullvad work with Netflix?

Not reliably, and Mullvad does not try to make it work. Its help pages explain that streaming services block VPNs for licensing reasons, and instead of running an unblocking arms race Mullvad documents split tunnelling so you can send Netflix around the VPN. Treat Mullvad as a privacy tool and use something else if regional streaming is the goal.

Does Mullvad still support OpenVPN?

No — OpenVPN was fully removed on 15 January 2026, announced more than a year in advance in November 2024. WireGuard is now the only protocol, with DAITA and quantum-resistant key exchange layered on top. Any router or legacy configuration still pointed at Mullvad's OpenVPN endpoints stopped working on that date and has to be rebuilt with WireGuard.

How many devices can I use at once?

Five, on a single account number. There is no higher tier that raises the limit, because there is no higher tier at all. Households needing more than five simultaneous connections either buy a second account at €5 or configure Mullvad on a WireGuard-capable router, which covers everything behind it as one connection.

What happens if I lose my account number?

You probably lose the remaining time. There is no password reset because there is no password, and no email on file to recover through. Mullvad's recovery tool only helps if you paid on their website within the previous 20 days and can be matched to that payment. Save the 16 digits in a password manager immediately after signing up.

Key takeaways

• €5 a month for every term, unchanged since 2009 — no promotional first year and therefore no renewal increase to plan around.
• Accounts are a random 16-digit number with no email, username or password, so losing the number generally means losing the remaining time.
• Cash by post and a 10% crypto discount make it possible to pay without a bank, card network or processor recording the purchase.
• OpenVPN was removed on 15 January 2026; WireGuard is now the only protocol, hardened with DAITA traffic-analysis defence and quantum-resistant tunnels.
• Roughly 550 servers in 50 countries, all owned or exclusively rented, running RAM-only with no disks since 2023.
• The no-logs claim survived a Swedish police search in April 2023, backed by a continuing run of published third-party audits through mid-2026.
• No streaming unblocking, no port forwarding since July 2023, no free trial and a five-device cap — deliberate omissions, not oversights.
• Best for people who want privacy and predictable billing; wrong for anyone buying a VPN to watch a foreign Netflix catalogue.