Most people install a VPN, switch on private browsing, and assume they are covered. They are not, and the reason is worth ten minutes of your time, because it explains a whole class of tracking that no amount of clearing cookies will touch.
01The problem: your browser has a face
Every time you load a page, your browser volunteers a surprising amount about itself. Not cookies, just ordinary technical detail that websites are allowed to ask for:
- Your exact screen and window dimensions, down to the pixel
- Your operating system, version and CPU architecture
- Every font installed on your machine
- Your timezone and language settings
- Your graphics card, via how it renders a hidden test image
- Your audio hardware, via how it processes a silent test tone
- How many CPU cores and how much memory you have
- Which browser extensions you have installed, inferred from their effects on the page
Any one of these is unremarkable. Combined, they are close to unique. A tracking company hashes the lot into an identifier and can recognise you on the next site, and the site after that, with no cookie, no login, and no account.
Fingerprinting is what makes a VPN alone insufficient. You change your IP address; your fingerprint does not change. So the tracker sees the same distinctive browser that visited from your home address yesterday, arriving today from a Swedish datacentre. Your VPN did not hide you, it just labelled you as the person who uses a VPN. Worse, if you ever log into a personal account from that browser, the fingerprint is now tied to your real name, and every anonymous session before and after it can be linked to you retroactively.
Private browsing does not help
Incognito and private windows delete cookies and history when you close them. They change nothing about your fonts, your screen size, your graphics card or your timezone. Your fingerprint in a private window is the same fingerprint. Private mode protects you from other people using your computer, which is a real but very different problem.
02The fix: look like everybody else
You cannot send no information, a browser that refused everything would be spectacularly rare and therefore trivially trackable. The only working strategy is the opposite: make every user of the browser send the same information, so that individuals dissolve into a crowd.
The Tor Project has spent over a decade perfecting this for Tor Browser. Mullvad Browser is that work, developed by the Tor Project in collaboration with Mullvad, packaged to run over an ordinary connection or a VPN instead of over the Tor network. Concretely, it:
- Reports a standardised, non-unique set of values instead of your real ones
- Opens at standardised window sizes and pads the rendered area so your monitor is not revealed
- Ships a fixed font set, so your installed fonts leak nothing
- Blocks or randomises canvas, WebGL and audio fingerprinting
- Reports UTC, so your timezone does not place you on a map
- Runs in permanent private mode, nothing is retained between sessions
- Ships uBlock Origin, with third-party cookies off and no telemetry of any kind
Do not customise it. Every change you make, a new extension, a resized window, a different theme, a tweaked setting — makes you more distinctive and therefore easier to track. The protection comes entirely from being indistinguishable from other users. A stock Mullvad Browser is far safer than a heavily customised one, and this is the opposite of the instinct most technical people have.
03Mullvad Browser, Tor Browser, or something else?
These solve overlapping but different problems. Choosing wrongly is common.
| Mullvad Browser | Tor Browser | Firefox / Brave | |
|---|---|---|---|
| Hides your fingerprint | Yes, strongly | Yes, strongly | Partially |
| Hides your IP address | No — pair with a VPN | Yes, via Tor | No |
| Speed | Normal | Noticeably slower | Normal |
| Blocked by sites | Rarely | Often | Rarely |
| Needs an account | No | No | No |
| Best for | Daily browsing where you do not want to be profiled | Anonymity that must not trace back to you | Everything else, keep one for logged-in life |
Privacy is "the site cannot build a profile of me." Anonymity is "the site cannot find out who I am, even if it tries hard." Mullvad Browser plus a VPN gives you strong privacy. If you need anonymity — researching a hostile target, submitting material, reaching this archive from a network that watches you, you need Tor, and Mullvad Browser is not a substitute for it.
04Installing it
Windows, macOS and Linux. There is no mobile version; on Android use Tor Browser, or Vanadium if you are running GrapheneOS.
-
Go to the real site
Type
mullvad.net/browserinto the address bar yourself. Do not search for it — fake privacy tools buy search ads, and a trojaned privacy browser is a perfect attack against exactly the people reading this page. -
Download the build for your system
You do not need a Mullvad VPN account, an email address, or any account at all. The browser is free and separate from the paid VPN.
-
Verify the signature if you can
Mullvad publishes a PGP signature next to each download. Verifying it proves the file actually came from them and was not modified in transit. On Linux and macOS with GnuPG installed:
# import the Mullvad signing key (see the download page for the current fingerprint) gpg --verify mullvad-browser-*.asc mullvad-browser-* # you are looking for this line: gpg: Good signature from "Mullvad ..."A warning that the key is "not certified with a trusted signature" is normal and does not mean the file is bad. Bad signature means stop — delete the file and start over on a different network. If this step is beyond you right now, downloading over HTTPS from the hand-typed domain is still reasonable; come back to it later.
-
Install and open it
Standard installer on Windows and macOS; on Linux it extracts to a folder you run in place, no root needed.
-
Change nothing
Resist every instinct. Do not add extensions, do not maximise the window out of habit, do not import bookmarks from your normal browser, do not sign into a sync account. Use it as shipped.
-
Check the security level
The shield icon in the toolbar offers Standard, Safer and Safest. Safer is the sweet spot for most people: it disables JavaScript on unencrypted sites and turns off the riskiest web features while leaving the web usable. Safest disables JavaScript everywhere — maximum protection, and many sites will not function.
05Using it well
Keep two browsers, permanently
This is the habit that makes the tool work. Split your browsing in two and never mix them:
- Research and reading
- News, forums, documentation
- Anything you would rather not be profiled on
- Anything sensitive to your work
- Never logged into anything personal
- Banking, email, shopping
- Anything already tied to your legal name
- Sites that break without your usual setup
- Keep it, do not try to do everything in one browser
Signing into a personal account inside Mullvad Browser links that fingerprint and that session to your real identity, and undoes the protection for everything else you did in that session. If you must log into something in there, treat it as a separate identity: a distinct account, a distinct email, never used elsewhere, and ideally in a separate browser profile or on a separate machine.
Do not resize the window
Window dimensions are among the strongest fingerprinting signals there is, because everyone's monitor and window habits differ. Mullvad Browser opens at standardised sizes and pads the content area with a letterbox to hide the rest. Maximising the window defeats that. Leave it as it opens, even though it looks slightly odd on a large screen.
Pair it with a VPN or Tor
The browser hides your fingerprint. It does not hide your IP address, your ISP still sees every domain you visit and every site still sees where you are connecting from. Combine it with Mullvad VPN for daily use, or use Tor Browser instead when you need genuine anonymity. The browser and the VPN are independent products; you can run either without the other, and neither requires the other.
Test that it is working
Load a fingerprinting test in your normal browser and then in Mullvad Browser, and compare:
- Cover Your Tracks, the EFF's test, the clearest explanation of what it found
- mullvad.net/check — confirms VPN, DNS and WebRTC leaks at the same time
These tests measure you against the visitors that test site has seen, not against the real internet, so treat the exact numbers as indicative rather than authoritative. What you are looking for is the shape of the change: a normal browser typically comes back as unique or near-unique, and Mullvad Browser should come back as one of a large crowd, with canvas, WebGL, fonts and timezone all reported as blocked or standardised.
06What it does not do
- It does not hide your IP address. Use a VPN or Tor alongside it.
- It does not make you anonymous. Privacy, not anonymity. See the table above.
- It does not protect accounts you log into. If you sign in, they know who you are.
- It does not exist on mobile. Tor Browser or Vanadium there.
- It does not stop a compromised computer. Malware on your machine sees everything before the browser does.
- It does not defeat behavioural analysis. Writing style, posting times and the specific combination of things you search for can identify you across sessions no matter how standard your browser looks.
07Questions people actually ask
Do I have to pay Mullvad, or use their VPN?
No. The browser is free, standalone, and works over any connection including no VPN at all or a different provider's VPN. Mullvad funds it as a public good and the Tor Project does the engineering.
Why not just use Brave, or Firefox with hardening?
Brave's randomisation approach is good and much better than nothing. Firefox with resist-fingerprinting enabled helps too. Neither reaches the level of the Tor Project's implementation, which is the most tested in existence and — critically — comes with a large crowd of users configured identically.
The hardened-Firefox path has a particular failure mode worth naming: every custom setting and every extension you add makes your browser more unique, so people who spend an afternoon on privacy tweaks routinely end their day more trackable than when they started. Mullvad Browser exists so you do not have to get that right.
Can I add my password manager extension?
You can, and it costs you some of the protection, the extension is detectable and adds to your fingerprint. If you need a password manager in this browser, a desktop application like KeePassXC with copy-paste avoids adding anything to the browser itself. For most people the honest answer is: do not log into things in this browser, and then you do not need the extension.
Sites keep breaking or showing me captchas.
Drop the security level from Safest to Safer, or Safer to Standard, for that site. If it is still broken, that is what your normal browser is for, do not weaken this one permanently to accommodate one stubborn site. Persistent captchas usually come from the VPN exit address rather than the browser; switching to a different server often clears them.
Does it keep my history?
No. It runs in permanent private mode: history, cookies and site data are gone when you close it. That is intentional and it is part of the protection. If you need to keep something, bookmark it or save the link elsewhere.
Is it actually maintained?
Yes, it tracks Firefox Extended Support Release and receives security updates alongside it, with the Tor Project's fingerprinting patches applied on top. It updates itself. Let it.
08Sources and further reading
- Mullvad Browser — official page and downloads mullvad.net/browser
- The Tor Project — announcing Mullvad Browser, and the reasoning behind it blog.torproject.org
- EFF — Cover Your Tracks fingerprinting test coveryourtracks.eff.org
- Tor Browser manual — security levels explained tb-manual.torproject.org · the same levels apply here
- Mullvad connection check — VPN, DNS and WebRTC leaks mullvad.net/check
Last reviewed: 25 September 2026