Mullvad VPN – Review 2020
In the confusing and chaotic world of VPNs, where the companies sometimes seem as untrustworthy as the forces they protect against, Mullvad is different. It is hyper-focused on offering secure and affordable VPN protection from a radically transparent company. You won’t get upsells, a huge variety of servers, or a breathtaking interface, but you will get online securely, for surprisingly little money. In fact, Mullvad is our Editors’ Choice for cheap VPNs.
What Is a VPN?
When you switch on a VPN, your web traffic passes through an encrypted tunnel to a server operated by the VPN provider. This prevents anyone from spying on your local network and even stops your ISP from keeping tabs on you—that’s good, because they’ve been given the green light to sell anonymized user data. Once your data exits onto the web, spies and advertisers will only be able to see the IP address of the VPN server, not your machine’s true IP address. This makes it harder to track you across the web, and helps obscure your true, physical location. You can also spoof your location by tunneling to a distant VPN server.
VPNs are enormously powerful tools for improving your privacy online, especially when you’re using public Wi-Fi. They cannot, however, protect against every ill. We still recommend that you use local antivirus, create unique and complex passwords with a password manager, and enable two-factor authentication wherever possible.
Pricing and Features
Mullvad breaks with the competition by offering an extremely affordable, flat pricing model. An account costs €5 per month, which at the time of writing is $5.42. There are no other pricing tiers, no additional upsells, no free versions. Just one price: €5 per month. You can pay for your Mullvad account with major credit cards, PayPal, Swish, and Bitcoin (at a 10 percent discount).
Mullvad also lets you pay via bank wire transfer or cash mailed directly to the company’s offices in Sweden. These are excellent options for anyone with qualms about privacy or the global credit system. TorGuard, notably, lets you apply prepaid gift cards from other establishments (Starbucks, for example) as an alternative to anonymous cash payments.
That €5 fee is significantly less than the average monthly price of a VPN, which currently sits at $10.10 per month. Only FrootVPN and Kaspersky Secure Connection offer cheaper VPN plans. Many worthy VPN services do charge more than the average, and significantly more than Mullvad, but balance that cost with extra features and excellent user experience. Surfshark and NordVPN, for example, charge $11.95 per month but also offer many privacy tools not found in Mullvad.
The only thing cheaper than cheap is free, and, while Mullvad does not offer a free version, there are a few free VPNs that are worth your time. Unfortunately, many come with restrictions. TunnelBear’s free subscription limits you to 500MB per month, and Hotspot Shield raises the limit to 500MB per day. ProtonVPN, however, has no data restriction on its free subscription and offers affordable paid tiers that can accommodate most needs.
Nearly all VPNs aside from Mullvad offer longer-term subscriptions at a steep discount. Across the services I’ve reviewed, this works out to be an average $73.06 per year, up front. Over the course of a year, Mullvad will cost only about $65. Many other services beat both those price points, however. TunnelBear, for example, is only $59.88 per year. Note, though, that its monthly price is $9.99.
In any case, I recommend that readers avoid long-term subscriptions. VPN performance and compatibility can change suddenly, and a fast available service could quickly become useless. Instead, consider using a free or short term subscription to test a service in your home environment before considering a longer commitment.
Mullvad allows five devices to connect simultaneously with a single account. That’s the industry average, but a few companies have started offering more tempting options. CyberGhost allows seven devices out of the box, and TorGuard has a sliding scale that you can adjust to fit your needs. Some don’t even bother setting such limits. Avira Phantom VPN, Encrypt.me VPN, Ghostery Midnight. Surfshark VPN, and Windscribe VPN all place no limit on the number of devices you can use at a time.
While Mullvad will protect your connection with a VPN, it doesn’t include additional tools for enhanced privacy and security. For instance, NordVPN and ProtonVPN provide easy access to the Tor anonymization network through their VPN servers.
Mullvad does provide multihop connections by enabling bridge mode in its apps. A multihop connection means your data travels through two servers before exiting to the internet, instead of just one. This can be used to circumvent VPN blocking, but also to add an additional layer of security to your connection. Notably, ProtonVPN takes extra steps to ensure the physical security of its multihop servers, hardening the connection against potential eavesdropping. I’m glad Mullvad includes this feature, but accessing it is a bit obscure.
ProtonVPN, and other VPN services, also offer split tunneling. This lets you designate which apps send their data through the VPN connection, and in some cases even let you access some URLs outside the VPN. This is handy if you’re engaged in a low-security but high bandwidth activity, like gaming, or accessing a service that blocks VPNs, like your bank or Netflix.
All these features are valuable and go a long way justifying the cost of other VPN services. But given that Mullvad offers the rock-solid basics at a fraction of the price, it’s hard to argue that they’re necessary.
VPN Protocols
There are many ways to create a VPN connection, but I prefer the OpenVPN protocol. This is an open-source project that has been thoroughly picked over for any potential vulnerabilities. I am happy to see that Mullvad supports OpenVPN in all of its apps.
WireGuard is the heir apparent to OpenVPN. It’s also an open-source project, but uses newer technology and is intended to be faster and simpler than OpenVPN. I have not done extensive WireGuard testing as the technology is very new, but my anecdotal experience has been overwhelmingly positive.
Mullvad has invested heavily in WireGuard, putting it in a great position for the future. For Mullvad’s Android and iOS apps, WireGuard is the only option. It’s the default for the Linux and macOS apps, too, although these support other protocols as well. In my testing, the Mullvad Windows app had support for WireGuard, but defaulted to OpenVPN.
Servers and Server Locations
Mullvad has servers in 36 countries across the globe. That’s a decent offering, but one far below the average of 52 countries I’ve seen across competitors. A large distribution of servers is good, since it gives customers a lot of choices for spoofing their locations and also increases the likelihood of finding a VPN server near wherever you might be at the time. ExpressVPN leads among the VPNs I’ve reviewed, offering servers in 94 countries without relying heavily on virtual servers (more on this later). Mullvad also doesn’t have enormous diversity among its server offerings, with only one country in South America and no coverage in Africa or Central America
The smaller number of countries covered by Mullvad likely won’t be an issue for most readers, who will probably need servers near to their locations for better performance. Notably, a full third of Mullvad’s 669 servers are in the US. Many other VPN companies overshadow that overall server count. ExpressVPN, TorGuard VPN, Hotspot Shield VPN, and Private Internet Access VPN all boast more than 3,000 servers, while CyberGhost and NordVPN have over 5,000. The number of servers can have more to do with the number of customers, so a larger fleet doesn’t necessarily equate with better performance.
Many VPN companies employ virtual servers, which is where a single hardware server can play host to many software-defined virtual servers. These, in turn, can be configured to appear as if they are in a country other than that of their host hardware. This can be a good thing, as it allows companies to quickly spin up servers in response to demand or provide coverage for an unsafe country by placing the physical hardware in a safer location. The issue is when VPN companies are not transparent about where your data is heading.
This isn’t an issue for Mullvad, A company representative told me that it uses only dedicated servers, located exactly where they say they are. That’s great, but Mullvad goes even further. Its server list shows you the country and city of its servers, as well as the company operating the data center and whether Mullvad leases those servers or owns them outright. That’s an unmatched degree of transparency.
Your Privacy With Mullvad
When you use a VPN, the company potentially has access to all of your web traffic. That requires an enormous amount of trust, so it’s important to understand the measures a VPN company takes to protect your privacy. I found that Mullvad has gone to great lengths to protect user privacy, setting an example for others to follow.
Mullvad tackles the thorny issue of privacy with radical transparency. In its article on data logging, it actually breaks down exactly what information is transferred during a credit card transaction, who sees it, and so on. It’s a remarkable, and educational, experience. The downside is that there is a lot of highly technical information. The company does an admirable job of writing in plain, understandable language, but brevity is not its strong suit. Personally, I empathize (this review is well over 3,000 words).
One feature of the policy that I really like is its use of a Q&A format. Did you ever wonder how Mullvad enforces a limit on simultaneous connections without logging? Well:
Each VPN server reports to a central service. When a customer connects to a VPN server, the server asks the central service to validate the account number, whether or not the account has any remaining time, if the account has reached its allowed number of connections, and so on. Everything is performed in temporary memory only; none of this information is permanently stored to disk.
The company is emphatic that it does not log user traffic, DNS requests, any kind of connection timestamp, IP addresses, or bandwidth use. That’s all excellent, and slightly edges out much of the competition in terms of what information is stored.
To its credit, Mullvad is very clear about its business practices. The company does not pay for reviews or support affiliate partners. When I asked if Mullvad had revenue from sources beyond VPN subscriptions, the answer was a simple, “No.” Mullvad is organized under the parent company Amagicom AB, and is based in Gothenburg, Sweden, and operates under Swedish law. Understanding what laws apply to your VPN provider is useful for understanding how your data is protected. Mullvad goes far beyond others by offering up an extensive list of legislation that applies to the company.
The company says that while it would comply with a legal request for information by law enforcement, it would only do so after investigating the claim, and points out that it retains very little information that could be obtained. It also goes further by committing to “shut down the service” if it’s ever legally required to spy on its users. I cannot say I have seen any other company make the same commitment.
Many VPN companies have commissioned third-party audits to establish their trustworthiness. In general, this is a good development for the industry, although not all audits are as useful as others. Mullvad was last audited in 2018 by Cure53, and focused on penetration testing of its apps (PDF link). While Mullvad has gone to lengths to make its practices transparent, I would still like to see public evaluations of its server infrastructure. TunnelBear, for example, has committed to exhaustive annual audits.
Security is really an issue of trust. Even if a company does everything right, it doesn’t matter much if you, the customer, don’t trust them. I recommend that consumers consider this information, and choose a service based on which company they feel they can trust.
Hands On With Mullvad
I tested Mullvad on an Intel NUC Kit NUC8i7BEH (Bean Canyon) desktop running the latest version of Windows 10 and had no trouble installing the app. Creating an account and logging in were a different story. Mullvad eschews usernames and passwords and instead issues a really long number. It’s much simpler than a password and username, but it is unfamiliar and the process can be disorienting if you’re not expecting it. This is your sole means of identification and authentication with the service. It’s a system that’s similar to ExpressVPN, which uses activation codes for its app, but still uses a traditional login system for its online portal.
On its website, Mullvad espouses the privacy benefits of this system: “We ask for no email, no phone number, no personal information whatsoever.” I thought this might make account recovery impossible, but I was surprised to find that Mullvad has a variety of ways to get your account back. Most are time-sensitive, and many are more involved than a simple password recovery. This could be an issue for anyone nervous about technology.
Mullvad’s website impressed me with its clean graphics, which are in a bit of a cartoony style. They’re more playful than NordVPN, but not as cute as TunnelBear. I had expected that the app would offer a similar experience, but I was disappointed.
When you launch the app, it immediately connects to the server it thinks is best. I have mixed feelings about this. On the one hand, it’s a frictionless experience. On the other, it might not be clear to users that the app is doing anything at all, since they haven’t clicked anything. You can disable this behavior in the settings.
I am pleased that the app echoes the look of the Mullvad website, with large text and bold blocks of color. The app is centered around a map, but this creates a problem. There are city locations marked on the map, and sometimes this is overlapped by the connection status text. This renders it unreadable.
Another issue: the app is vertically oriented, making it look very much like the design of the mobile app was simply brought to Windows. The large buttons and text would be great on a phone, which has a small screen held a good distance from your face, but this is a desktop app. The result is a cramped, almost claustrophobic experience. It’s as if you’re looking at the application through a mouse hole in the baseboard, and you have to manipulate it with a long stick. A coherent design across platforms is a great thing to strive for, but this app needs room to breathe.
Once connected, the app displays your real IP address, your new VPN-induced IP address, the name of the server you’re using, and the protocol used to secure your connection. That’s handy, but not particularly useful.
Click the Switch Location button to do that thing. You’re presented with a list of countries, which can be expanded to show cities, and that in turn open to show the individual servers in that area. I really like the level of control this allows. If you find yourself blocked, you can poke around and find a server that works. It would be better if the Mullvad app included information about each server, such as its current user load. All the app offers now is a green dot (you can use it) or a red dot (better not). It would also be useful to be able to favorite those servers so you can come back to them later.
The app’s settings are simple enough, with an option to enable local network sharing. The Advanced section has juicier options, such as a kill switch to block internet access if your VPN disconnects as well as the option to change VPN protocols, along with some other more arcane options. What you won’t find are additional tools such as split tunneling, or advanced network settings. Mullvad is laser-focused on a private, affordable VPN service, so it’s hard to fault them for lacking these features.
For a VPN to be useful, it needs to keep your IP and DNS information safe from prying eyes. In my testing, I confirmed that Mullvad did successfully change my public IP address. Using the DNS Leak Test Tool, I confirmed that my DNS information was likewise secure. That’s great, but note that I only tested one server in Mullvad’s fleet. Others may be incorrectly configured.
Mullvad and Netflix
One reason people may want to spoof their location with a VPN is to access region-locked streaming content. For instance, if you’re traveling in the UK, you may find that you can’t watch your favorite show on Netflix. With a VPN, you can tunnel back to the US and pick up where you left off. Netflix, however, is wise to the scheme and actively works to block access from VPNs.
Unfortunately, you might not be streaming much with Mullvad. In my testing, Netflix was blocked while I was connected to a local US server. This might not last, however. I’ve found that a VPN that works today may not tomorrow, and vice versa.
My impression is that Mullvad is far more concerned with providing a secure and affordable VPN service than one that will let you watch the BBC for free. For some people, that’s just fine, but if accessing region-locked content is your goal, Mullvad may not be the best choice.
Beyond VPN
Some VPN companies have begun bundling extras along with the primary VPN tools. TunnelBear, for instance, offers an ad-blocking browser extension and a password manager aptly called RememBear. The Pango account included with a Hotspot Shield VPN subscription grants access to a number of privacy services, and NordVPN has expanded its reach with a password manager and encrypted file vault.
Mullvad has no such aspirations. Its VPN is its sole product. The service does allow P2P and BitTorrent, but does not provide ad-blocking at the network level. That last point is a non-issue, since a standalone ad-blocker does a better job anyway.
Speed Test Results
A VPN makes your internet traffic jump through more hoops, which almost always means a hit to performance. To try and get a sense of that impact, I use the Ookla speed test tool to find a percent change with and without a VPN. You can read more about my testing, and its limitations, in the aptly named “How We Test VPNs.” Note that Ookla is owned by J2 Global, the parent company of PCMag’s publisher Ziff Media.
Keep in mind that these results are only accurate for a particular time and place, and not an evaluation of each VPN’s overall performance. It’s useful for comparison, but your experience will almost certainly differ.
My tests showed that Mullvad had minimal impact on internet performance, beating the median results for download, upload, and latency. Using Mullvad increased latency by 41.5 percent, and reduced upload and download speeds by 20 percent and 59.5 percent, respectively. The upload scores are particularly impressive, placing it among the top four contenders in that category.
Note that Mullvad supports WireGuard extensively. In my testing, the app defaulted to OpenVPN and I chose to leave it at the default settings. You can see how Mullvad compares to the nine fastest VPNs out of the nearly 40 we tested.
Hotspot Shield VPN is our current pick for fastest VPN. It had the least impact on download speed test results and the smallest increase in latency. Surfshark, however, is close behind.
While there is clearly a difference in performance between these services, I maintain that speed should not be a major factor when choosing between VPNs. Privacy and value are far more important, as is the ability to test a service in your own environment to make sure the speeds are tolerable in your area.
Mullvad on Other Platforms
Mullvad offers apps for Linux, macOS, and Windows, with instructions on how to configure other devices to use the VPN service. An Android app remains in Beta, and an iOS app was recently released with support for WireGuard. In fact, Mullvad only uses WireGuard for its mobile apps.
A Lot for a Little
Mullvad does much correctly. It’s remarkably transparent, providing information we rarely see from any company, with an excellent stance on consumer privacy and security. It’s extremely affordable, and while it may not offer the kitchen sink it offers a lot for less than half the average price. It maintains fewer servers in fewer locations, but its main issue is an app that’s in need of a refresh.
Despite that, Mullvad is still an emphatically excellent service, and we suspect that most consumers will be willing to tolerate a little UX frustration in exchange for secure, cheap VPN protection. It’s an Editors’ Choice winner, specifically for cheap vpns. TunnelBear VPN and ProtonVPN are also Editors’ Choice winners for their friendly, easy-to-use service and high-quality privacy tools, respectively.
Mullvad VPN Specs
| Allows 5+ Simultaneous Connections | Yes |
| 500+ Servers | Yes |
| Geographically Diverse Servers | No |
| P2P or BitTorrent | Yes |
| Blocks Ads | No |
| Free Version | No |
