No Account. No Email. Just a Number.
| Company | Mullvad VPN AB, Gothenburg, Sweden |
| Jurisdiction | Sweden - 14 Eyes |
| Founded | 2009 |
| No-logs | Yes - audited |
| Audit | Cure53 (2020, 2021), KPMG (2023) |
| Price | €5/month flat |
| Free plan | None |
| Refund | No (cancel anytime) |
| Devices | 5 simultaneous |
| Protocols | WireGuard, OpenVPN, DAITA |
| Encryption | AES-256 / ChaCha20 |
| Obfuscation | Shadowsocks, DAITA |
| Servers | 700+ in 45 countries |
| Kill switch | All platforms |
| DNS leak | Protected |
Mullvad's account model is fundamentally different from every other provider here. There is no email, no username, no password - just a 16-digit account number. You can pay by cash in an envelope or with Monero. For users whose threat model includes a subpoenaed account database, Mullvad is the logical choice because there is no meaningful database to subpoena.
DAITA (Defence Against AI-guided Traffic Analysis) addresses a class of attack most providers don't acknowledge: machine-learning systems that identify VPN users by analysing the shape and timing of encrypted traffic without decrypting it. Mullvad adds random noise and dummy traffic to counter this.
Sweden's 14 Eyes membership is the significant caveat. Mullvad's no-logs architecture limits the damage, and the 2023 KPMG audit confirmed the logging policy, but the jurisdiction is a genuine risk factor that a Swiss or Greek provider does not carry.