You signed up for a “no-logs” VPN to disappear. You typed in your email, paid with the card linked to your bank, and felt safer. Then one night it occurs to you: the company now has your email, your payment method, and a tidy record that you are a customer who wanted to be hidden. You didn’t buy anonymity. You bought a receipt with your name on it.
The short version: Mullvad VPN is a Swedish service that collects no personal information — no email, no name, no billing address. You log in with a randomly generated 16-digit account number and you can pay with cash mailed in an envelope or with cryptocurrency, including Monero. It runs on WireGuard for speed, offers multi-hop routing across jurisdictions, and publishes its app code for independent verification. The point isn’t a stronger no-logs promise. The point is that there is nothing to hand over: if Mullvad is subpoenaed or data incidented, it cannot identify you, because it never knew who you were.
Why most “privacy” VPNs quietly fail: the email anchor
Here is the thing nobody selling you a VPN wants to say out loud. The risk signal to your identity usually isn’t your traffic logs. It’s your subscriber record.
The 12-point setup for a private, secure, high-output digital life — in one afternoon. No spam, unsubscribe anytime.
Every mainstream VPN asks for an email address. That email is the kill shot. It is linked to your PayPal, which is linked to your bank, which holds your home address. When an investigator wants to know who was behind an encrypted tunnel, they rarely need browsing history. They need the customer list. Your email is the metadata map that connects the account to the human.
It gets quieter and worse. Standard VPNs send renewal notices, promotional offers, marketing nudges. Each message is fresh proof that you are a paying customer of a privacy tool — a small, dated confirmation sitting in two inboxes and one mail server, all of it seizable.
The architecture is backwards: you’re asked to trust a company not to log your traffic, when the real fix is to make it impossible for the company to know who you are at all.
How Mullvad solves it: provisioning with no identity attached
This is the turn — the reframe that reorganizes the whole problem. Mullvad doesn’t promise to protect your identity. It deletes the question of identity from the start.
You don’t create an account. You generate a random 16-digit number, and that number is your key. You fund it with cash in the mail, with cryptocurrency, or with Monero sent to an address that isn’t tied to your name. Mullvad has no way to contact you, no way to identify you, and no incentive to log you — because your identity was never collected in the first place.
The server only checks one thing: does this random number have a valid payment balance? If yes, you connect. If no, you don’t. There is no database of users to leak, no master subscriber list to subpoena. Your account exists only as a number you hold.
So when the worst case arrives — a legal demand, a data incident, an insider — there is simply nothing to surrender. No email. No payment method. No name. They can’t expose you because they never knew you.
Mullvad’s technical architecture: WireGuard, multi-hop, and verifiability
Anonymity at signup is the headline, but the tunnel underneath has to be sound. Here is what carries it.
- WireGuard protocol. Mullvad runs on WireGuard, not OpenVPN. WireGuard is roughly 2–3x faster and uses modern cryptography (ChaCha20 and Poly1305). Speed isn’t a luxury here — a slow VPN gets switched off, and a tool you switch off protects nothing.
- Multi-hop routing. Your traffic can bounce through two servers in two different countries before it reaches the open internet. The entry hop sees your client IP; the exit hop sees the traffic but not where it originated. That structural split means even a malicious operator with access to a single server can’t reconstruct your position.
- Open-source apps. Mullvad publishes the code for its applications and commissions regular external audits. You don’t have to take its word — you can read the logic. Closed-source VPNs ask for trust; Mullvad invites verification.
- Kill switch. If the connection drops, your internet is cut at the operating-system level, so your real IP never leaks even for a moment.
- DNS hardening. Mullvad routes DNS-over-QUIC through its own resolvers, so your ISP can’t read your DNS queries. Most VPN users leak DNS without ever realising it; this closes that gap by default.
The honest caveat: open-source code and published audits raise the floor of trust, but they don’t make any provider magic — they make its claims checkable, which is exactly the property a closed VPN can’t offer you.
How to set up Mullvad: the anonymous handshake, step by step
The relief is that the hardest part is conceptual, not technical. Once the idea clicks, the setup is a quiet afternoon.
- Generate your account number. On mullvad.net you generate a random 16-digit ID. You aren’t filling in a form — you’re minting a number. It takes about two seconds. Write it down immediately, somewhere physical you control.
- Fund the account. You have three routes. Cash in the mail: post an envelope of cash to Mullvad’s office in Gothenburg, Sweden, with your account number written on it; funds are credited for a set period once it arrives. Cryptocurrency: send Bitcoin, Ethereum, or Monero to an address the app generates — near-instant. Monero specifically: preferred for this job, because Monero transactions are private by default, whereas Bitcoin is pseudonymous, not anonymous.
- Download the app from the official domain only. Use mullvad.net and verify the GPG signature if you want the extra assurance.
- Enable the kill switch. In settings, switch it on so your connection fails closed.
- Test for leaks. Visit a leak-test site to confirm your IP is masked and your DNS isn’t escaping.
- Optional — enable multi-hop if you’re doing genuinely sensitive work.
Notice how small the first move is: you can mint the number and connect before you’ve even decided how you’ll pay. The activation energy is almost embarrassingly low.
Mullvad Browser: closing the fingerprinting gap
A fast tunnel hides your IP. It does nothing about a browser that announces exactly who you are. Mullvad publishes the Mullvad Browser, built with the Tor Project — a hardened Firefox designed to resist fingerprinting, the technique where a site identifies you by your fonts, plugins, resolution, and configuration.
The logic is to make everyone look identical. By forcing near-uniform configurations across all users, Mullvad Browser makes fingerprinting exponentially harder. It ships with third-party cookies blocked by default, a randomised time zone and locale, automatic HTTPS enforcement, and an option to disable JavaScript for high-security research. Run it alongside the VPN and you cover two separate exposures — your network address and your browser signature — instead of plugging one and leaving the other wide open.
Mullvad vs. other privacy VPNs: where it actually differs
| Feature | Mullvad | Proton VPN | IVPN | Private Internet Access | |—|—|—|—|—| | Requires email | No | Yes | Yes | Yes | | Accepts cash | Yes | No | No | No | | Accepts crypto | BTC, ETH, Monero | Bitcoin only | Bitcoin, Monero | Bitcoin | | Open-source code | Yes | Partially | Yes | Yes | | WireGuard | Yes | Yes | Yes | OpenVPN/WireGuard | | Multi-hop | Yes | Paid tier | Yes | No | | Server ownership | Own hardware, multiple jurisdictions | Mix of owned and third-party | Own hardware | Third-party |
The one line that matters: Mullvad is the only option here where the provider literally cannot identify you. Proton VPN, IVPN, and Private Internet Access all require an email address, which leaves them open to a subpoena that names you — even when their no-logs policies are genuinely strong. That isn’t a knock on their engineering. It’s a difference in what’s structurally possible.
Is Mullvad worth it for you? The honest trade-offs
The manipulative version of this review would tell you it’s pure upside. It isn’t, and you deserve the real picture.
The anonymity that protects you also removes the safety nets you’re used to. There is no email recovery, no password reset, no support agent who can prove you’re you. Lose your account number and you lose access — by design. You’re trading the convenience of “click here to reset” for the security of “no one can reset it but you.” Payment is more friction than tapping a saved card. And Swedish law could, in theory, compel Mullvad to begin logging future traffic — though even then, an anonymous account number gives the logs nothing to attach to.
So the honest verdict: for anyone whose privacy genuinely matters — research, activism, high-risk operations — zero-identification isn’t a feature, it’s the only design that holds, and Mullvad is the standard. For casual privacy where you mostly want your ISP and ad networks off your back, a strong no-logs provider with an email account may be all you need, and Mullvad’s friction may be more than the risk signal justifies. Match the tool to the risk signal, not the marketing.
Frequently asked questions
What if I lose my account number?
You lose access — deliberately. There’s no email recovery, no password reset, no support team that can identify you. Treat the number like a cryptocurrency seed phrase: write it down in a physical place only you control, such as a safe or a notebook.
Is Mullvad really faster than other VPNs?
Generally, yes. WireGuard outpaces OpenVPN, and Mullvad’s infrastructure is well maintained. Real-world speeds typically land at 80–95% of your base connection, with some users seeing almost no loss on nearby servers. It varies with location, ISP, and server load, but Mullvad consistently outperforms older-generation services.
Can Mullvad be compelled to log my traffic?
Swedish law could, in principle, compel logging of future traffic. But even then they can’t identify you: a log reading “account number X visited Y” is useless when that number is unlinked from any identity. Mullvad has faced legal challenges in Sweden and publishes transparency reports.
Is Mullvad safe for torrenting?
It masks your IP from other peers; enable the kill switch to prevent accidental leaks and use IPv6 leak protection if your system supports it. Note plainly: torrenting copyrighted material is illegal in most jurisdictions. Mullvad hides your location, not the legality of what you do.
Should I use Mullvad Browser or just the VPN?
Both, ideally. The VPN hides your IP from sites; the browser stops them fingerprinting your configuration. For sensitive or activist work, run them together. For casual privacy, the VPN alone is enough.
Where Mullvad fits in your sovereignty stack
Mullvad is the network layer — it masks your location and shuts out ISP surveillance. It does its job best as one hardened part of a whole. Pair it with Mullvad Browser to defeat fingerprinting, an encrypted email alternative, Monero for private payments, an anonymity-focused operating system, and hardware security keys for your critical accounts. The layers are interdependent: a Mullvad tunnel on a compromised device is worthless, and a hardened device on a naked ISP connection leaks your location. The stack only holds when every layer is sound.
You opened a VPN account to vanish, then realised you’d left a trail of your own name to do it. That instinct was right. Privacy is hiding what you do; anonymity is hiding who you are — and the second one only exists when your identity was never collected. You don’t get there by trusting a better promise. You get there by handing over a meaningless number and walking away. Generate it, fund it, connect. You’re not a subscriber on a list anymore. You’re a stranger they can’t name.
Join the Inner Circle
Weekly dispatches. No algorithms. No surveillance. Just sovereign intelligence.