GhostlyInc VPN review lab
Mullvad VPN Review 2026: Anonymous Accounts, WireGuard-Only Apps, Audits, and Real-World Limits
Mullvad is the VPN I would shortlist when the provider should know as little as possible about you. This updated review focuses on the details that matter in 2026: account numbers instead of emails, cash and Monero payments, no affiliate incentives, WireGuard-only infrastructure, DAITA, audits, and the trade-offs that privacy purists still need to test.
Quick verdict
Mullvad is excellent for anonymity, but no longer the best self-hosting VPN
Choose Mullvad if anonymous signup, transparent pricing, open-source clients, and a low-marketing privacy culture matter most. For self-hosting, it only makes sense when you do not need incoming VPN ports; public services, seedboxes, or game servers should use another path because port forwarding was removed in 2023 and OpenVPN support ended on January 15, 2026.
Buyer snapshot
Mullvad pros, limits, and the users it actually fits
Mullvad is not trying to be the flashiest VPN bundle. It is trying to minimize identifiers, keep pricing predictable, and publish enough technical detail for demanding users to inspect the trade-offs.
Why Mullvad still stands out
- Anonymous account number model with no email, username, name, or password required.
- Cash, Monero, Bitcoin, bank wire, card, PayPal, and regional payment options make privacy trade-offs explicit.
- Flat EUR 5 monthly pricing avoids renewal traps and fake urgency.
- Open-source clients, external audits, and detailed server transparency support the privacy claim.
- Strong Linux app with firewall protection, custom DNS, split tunneling, multihop, DAITA, and WireGuard controls.
- No paid reviews or affiliate program reduces the incentive for coupon-driven coverage.
- Good fit for privacy researchers, journalists, Linux users, and people who want a low-identifier subscription.
What changed or still needs caution
- Port forwarding was removed in 2023, so self-hosting and some P2P workflows are weaker than older reviews suggest.
- OpenVPN support was removed on January 15, 2026; WireGuard is now the practical path.
- Server reach is smaller than NordVPN or Proton VPN, especially outside Europe and North America.
- Streaming access is inconsistent because Mullvad does not optimize around streaming catalogs.
- No live chat and no account recovery safety net if you lose the account number.
- Advanced privacy features such as DAITA can increase bandwidth use or break some websites.
- A May 2026 exit-IP fingerprinting issue needs attention if you switch servers to avoid linkability.
Table of Content
Research update
What changed since the earlier Mullvad test
The old version of this review had several outdated assumptions. I checked Mullvad's current server page, pricing page, no-logging policy, affiliate policy, OpenVPN removal notice, port forwarding notice, recent audit posts, and recent community discussions before rewriting it.
Port forwarding is gone
Mullvad announced the removal of forwarded ports in May 2023 and removed existing ports on July 1, 2023. This changes the recommendation for seedboxes, game servers, and self-hosted services.
OpenVPN is gone
Mullvad removed OpenVPN on January 15, 2026 and now directs users toward WireGuard. Router guides and old fallback scripts need to be updated.
Payment and account systems were reviewed
Mullvad's January 2026 audit post describes an X41 D-Sec white-box review of authentication, device provisioning, payments, and WireGuard key distribution.
Exit-IP fingerprinting is being mitigated
In May 2026 Mullvad disclosed a server-switching linkability issue. It does not reveal a real IP, but high-threat users should regenerate keys by logging out and in when switching servers until the mitigation is fully deployed.
Privacy model
Anonymous account numbers, payments, audits, and Swedish jurisdiction
Mullvad's privacy story is unusually concrete because it starts before the VPN connection exists. You generate an account number, add time, and can avoid giving the provider an email, name, or password at all.
Mullvad minimizes account data at signup
The account number model is the practical privacy win. You can start without an email address, password, or name, and you decide how much payment metadata to expose.
Cash and Monero are meaningful options
Cash by post and Monero are slower or more technical than card payments, but they fit users who want payment records separated from VPN access.
Sweden is not magic, but the design helps
Mullvad argues Swedish VPN rules do not force secret traffic logging. The stronger point is that the service is designed to have little user data to provide.
Technical reality
WireGuard-only in 2026: simpler, faster, but less forgiving on old setups
Mullvad now focuses on WireGuard. That is good for performance and engineering focus, but it means router users, legacy OpenVPN configs, and old automation guides need to be rewritten.
| Topic | Current state | What it means for you |
|---|---|---|
| Port forwarding | Removed | Do not choose Mullvad for incoming connections, public seedboxes, or self-hosted services that depend on VPN port forwarding. |
| OpenVPN | Removed | Use WireGuard configs for routers and servers. If your network blocks WireGuard, test Mullvad's obfuscation methods before relying on it. |
| WireGuard | Primary protocol | This is the default path for performance, app features, and future development. |
| DAITA | Available in apps | Useful against traffic analysis, but test bandwidth, CPU, and site compatibility before leaving it on everywhere. |
| GotaTun | Audited Android WireGuard implementation | Mullvad is moving WireGuard internals toward its Rust implementation, with more platform work planned after Android. |
Linux and routers
Linux works well, but servers and routers need WireGuard hygiene
The Linux app remains one of Mullvad's strongest surfaces because the firewall lock, split tunneling, custom DNS, DAITA, multihop, and WireGuard controls are available without turning the app into a marketing dashboard. The server story is more manual: export WireGuard configs and own the firewall rules.
Best for privacy-first daily drivers
- Use the app when you want nftables-based leak protection, custom DNS, multihop, obfuscation, DAITA, and automatic key rotation in one workflow.
- Test DAITA and quantum-resistant tunnels separately because both can change CPU use, bandwidth, and compatibility.
- If websites break, test again with DNS content blockers, DAITA, multihop, and obfuscation disabled before blaming the exit city.
No OpenVPN fallback, no port forwarding
- Move legacy OpenVPN router profiles to WireGuard. OpenVPN servers are offline or being shut down after the January 15, 2026 removal.
- Do not plan new self-hosted services around Mullvad port forwarding. It has been unavailable since the 2023 removal.
- For split routing, bind services explicitly and verify DNS, IPv6, reconnect behavior, and kill-switch rules under failure conditions.
Network and speed
Server reach is smaller than NordVPN or Proton VPN, but transparency is better than the raw count
Mullvad's public server list showed 579 servers in 50 countries and 90 cities when checked in May 2026. That is much smaller than NordVPN or Proton VPN, but Mullvad exposes practical details such as city, provider, ownership, capacity, status, and DAITA support.
Best in Europe and North America
If you need many locations in Africa, Asia, or South America, compare the exact cities before paying. Mullvad is intentionally smaller than the biggest commercial networks.
Server details are unusually visible
The server page exposes ownership, provider, capacity, status, messages, bridge servers, and DAITA support. That is more useful than a raw server count alone.
Fast when the route is clean
Recent forum patterns are mixed: many users praise stability, while others report route-specific WireGuard or DAITA issues. Test your city, ISP, device, and feature set.
Daily use
Streaming, torrenting, travel, and the current fingerprinting caveat
Mullvad is excellent for private browsing, public Wi-Fi, research, and a low-identifier subscription. It is less convincing when you want a streaming-first VPN or a P2P setup that depends on incoming connections.
Use another VPN if streaming is the priority
Mullvad can work with some services, but it does not provide streaming-optimized servers. NordVPN is usually easier for streaming-first households.
Fine for legal P2P, weaker for incoming peers
P2P transfers work, but no port forwarding means some clients will connect less efficiently. Bind the torrent client to the VPN interface and test leak behavior.
Good for public Wi-Fi and research
The app's kill switch, DNS behavior, and obfuscation options make it useful on hotels, trains, airports, and shared networks. Test local banking and work tools because some exit IPs trigger blocks.
Regenerate keys for server-switch linkability
If your threat model depends on switching servers to break session linkage, log out and log back in before switching until Mullvad's mitigation has reached your chosen servers.
Pricing
Flat pricing is the point: EUR 5 per month, no artificial urgency
Mullvad's pricing is refreshingly boring. One month, one year, or one decade all work out to EUR 5 per month. The lack of long-term discounts is a downside if you want the cheapest VPN, but it removes renewal traps and coupon games.
Who should pay for Mullvad
- You want the provider to know less about you than most VPN account systems allow.
- You prefer transparent pricing over annual discount theater and renewal surprises.
- You can use WireGuard and do not need port forwarding, dedicated IP addresses, or streaming profiles.
Cash, Monero, and normal payments each have different trade-offs
- Cash and Monero minimize links to your identity, but cash processing is slower and crypto has its own operational risks.
- Card, PayPal, Swish, bank wire, and regional payment options are convenient but less anonymous.
- Mullvad says cryptocurrency payments receive a discount because of lower fees and administration.
Setup checklist
My recommended Mullvad setup for privacy-first users
Mullvad rewards careful setup. These steps give you a better privacy baseline than simply installing the app and trusting the default state forever.
- 1
Create the account with a privacy boundary
Generate the account number in a clean browser profile or Tor session if anonymity matters, then store it offline. Losing it can mean losing access.
- 2
Choose the payment method intentionally
Use cash or Monero when minimizing identity links matters. Use card or PayPal when convenience matters more than payment anonymity.
- 3
Turn features on one by one
Start with plain WireGuard, verify DNS and IPv6 leak behavior, then test DAITA, multihop, obfuscation, custom DNS, and split tunneling separately.
- 4
Test failure behavior
Force sleep, network drops, router reconnects, and app restarts. Confirm the kill switch blocks traffic and that no app bypasses the tunnel unexpectedly.
Research notes
Current sources checked for this Mullvad update
Official Mullvad pages are especially important here because older reviews often still mention features Mullvad removed.
FAQ
Is Mullvad still good in 2026?
Yes, if you want anonymous signup, transparent pricing, open-source clients, and strong privacy defaults. It is less ideal if you need streaming-first support, port forwarding, OpenVPN, or the largest server network.
Does Mullvad still support port forwarding?
No. Mullvad removed the ability to add new forwarded ports in May 2023 and removed existing forwarded ports on July 1, 2023.
Does Mullvad still support OpenVPN?
No. Mullvad removed OpenVPN support on January 15, 2026. New setups should use WireGuard and test Mullvad's obfuscation options if a network blocks VPN traffic.
Can I sign up to Mullvad without personal data?
Yes. Mullvad generates an account number and does not require an email, username, name, or password. Your payment method still affects how anonymous the subscription is.
Can I pay Mullvad with cash or Monero?
Yes. Mullvad accepts cash and Monero, along with Bitcoin, bank wire, credit card, PayPal, Swish, and several regional payment methods. Cash is slower and has refund limits, but it minimizes payment linkage.
Is Mullvad good for Linux?
Yes. Mullvad is one of the stronger Linux VPN choices because the app exposes practical privacy controls and uses the system firewall for leak protection. Router and server users should export WireGuard configs and test firewall behavior manually.
Is Mullvad good for streaming?
It can work, but streaming is not Mullvad's main focus. If streaming reliability is the top requirement, NordVPN is usually the easier recommendation.
What is the Mullvad exit-IP fingerprinting issue?
In May 2026 Mullvad disclosed that switching VPN servers could sometimes let websites guess that the same anonymous user moved between servers. It does not reveal your real IP address, but users with stricter threat models should log out and log in again before switching servers until mitigations are deployed.
Bottom line
Use Mullvad when anonymity is the job, not when extras are the job
Mullvad remains one of the cleanest privacy picks in 2026 because the account model, payment options, audit culture, and no-affiliate stance all pull in the same direction. The honest trade-off is that WireGuard-only infrastructure, no port forwarding, no dedicated streaming focus, and a smaller network make it less universal than NordVPN or Proton VPN.