The VPN industry is one of the most dishonestly marketed corners of technology. Sponsored videos promise military-grade encryption and total anonymity; review sites that look independent are owned by the companies they rank. Almost none of it is true, and believing it is actively dangerous when your safety depends on getting this right.
01What a VPN actually does
A VPN builds an encrypted tunnel from your device to a server run by the VPN company. Your traffic goes out from that server instead of from your own connection.
- From your ISP, your employer, the café wifi, and anyone watching the local network: which sites you visit. They see only that you are connected to a VPN.
- From the websites you visit: your real IP address, and therefore your approximate location and who your ISP is.
- From a censor: it can carry you past national or network-level blocking.
- From the VPN company: everything your ISP used to see. You moved the trust, you did not remove it.
- From sites you log into: your identity. You told them.
- From trackers: your browser fingerprint — see Mullvad Browser.
- From your phone company: your physical location, via cell towers.
- From malware already on your device.
A VPN does not make you anonymous. It changes who can watch you. Choose a provider that cannot be made to hand over anything useful, and you have made a real improvement. Choose a bad one and you have handed a complete log of your life to a company with a marketing budget and, in several documented cases, undisclosed owners.
02Why Mullvad, specifically
Every VPN claims no logs. The claim is unfalsifiable in the abstract, so the useful question is a different one: what could this company hand over if it were compelled to? Mullvad's answer is unusually convincing, and it rests on architecture rather than promises.
No account, no identity
You do not create an account. There is no email address, no username, no password, no name. You click a button and are given a random 16-digit number. That number is your entire identity to them. If you lose it, they cannot help you, because they know nothing else about you.
This is the crucial structural point. A subpoena to a normal VPN provider yields an email address, a payment method and a billing address. A subpoena to Mullvad yields a number, and they have no way to connect that number to a person.
Payment that need not identify you
Card, PayPal, bank transfer, Monero, Bitcoin, or cash in an envelope with your account number written on a slip of paper, posted to their office in Sweden. That last option is not a gimmick; it is a deliberate design decision to make it possible to be a customer with no financial trail whatsoever. There are no tiers and no discounts to think about: €5 a month, for everything, however long you subscribe.
Proven, not promised
- Their servers were raided. Swedish police arrived at the Mullvad offices with a warrant seeking customer data. They left with nothing, because there was nothing to take, and Mullvad published an account of the visit.
- Independent security audits of the apps and infrastructure, commissioned by Mullvad and published in full, including the findings that were unflattering.
- Diskless, RAM-only servers. The entire fleet runs from memory. Physically seizing a server yields no stored data, because a powered-down server has forgotten everything.
- They removed features that could not be made safe. Port forwarding was a popular feature; they discontinued it when it was being abused in ways that risked the wider user base. A company optimising purely for subscriptions does not do that.
- Open-source apps. The clients are public and auditable.
The heavily advertised VPNs share problems that disqualify them for this audience: a large share of apparently independent brands are owned by a handful of parent companies, sometimes undisclosed; several have been caught logging while advertising that they do not; the "independent" review sites that rank them are frequently owned by the same groups; and a free VPN, by definition, is monetising something, and that something is you. If you are using a VPN because your safety depends on it, the €5 is not the expensive part of your setup.
03Setting it up
-
Go to the real site and get an account number
Type
mullvad.netby hand. Click to generate an account, you will be shown a 16-digit number immediately, with nothing to fill in.Write it down nowThat number is the only thing standing between you and losing the account. There is no password reset, no recovery email, no support ticket that can restore it, because they hold no other information about you. Put it in a password manager, and put a copy on paper somewhere safe. People lose access to paid Mullvad accounts this way constantly.
-
Add time to the account
Choose a payment method appropriate to your threat model. Card and PayPal are fine if your concern is advertisers and your ISP rather than a state; Monero or posted cash if the payment trail itself is a risk. You are buying time on the account, not a subscription, nothing auto-renews unless you set it up to.
-
Install the official app
Windows, macOS, Linux, Android, iOS. Get it from mullvad.net, or from F-Droid or the app store on mobile. Sign in with the account number.
-
Turn on the kill switch and lockdown mode
Non-negotiable. A VPN that drops for four seconds while you are mid-upload has exposed your real address at exactly the wrong moment. In the Mullvad app, enable both the kill switch and lockdown mode, which blocks all traffic whenever the tunnel is not up, including during boot, before the app has started.
-
Enable auto-connect and launch on start-up
Protection you have to remember to switch on is protection you will forget. Set it to connect automatically, always.
-
Leave DNS and WireGuard settings alone
The app routes DNS through the tunnel by default and uses WireGuard, which is the right modern choice — fast, small, and much easier to audit than the alternatives. Unless you know precisely why you are changing these, do not.
-
Verify there are no leaks
Connect, then load mullvad.net/check. You want a green confirmation, the server location you selected, and no WebRTC or DNS leak warnings. Then do the honest test: disconnect your wifi for ten seconds while connected and reconnect. With lockdown mode on, nothing should reach the internet during the gap.
04Using it well
Choosing a server
- Nearby is faster. Distance costs latency. Pick a neighbouring country if speed matters.
- Jurisdiction matters less than people think for a provider that stores nothing, but avoid exiting in a country hostile to your work if the sites you use might treat that as a signal.
- Consistency has a cost and a benefit. Hopping servers constantly looks unusual and triggers captchas; never changing means your traffic is consistently associated with one exit address. Pick a couple of servers and rotate between them.
- Bridges and obfuscation are available if your network blocks VPNs outright. The app can disguise the traffic so it does not look like a VPN connection.
When a VPN is not enough
A VPN gives you a single hop, and one company that could in principle be watching both ends. Tor gives you three hops run by three unrelated volunteers, none of whom can see both who you are and what you are doing. It is slower and that is the price of the guarantee.
| Situation | Use |
|---|---|
| Daily browsing, reading, research | Mullvad VPN + Mullvad Browser |
| Public or untrusted wifi | Mullvad VPN, always on |
| Getting around censorship | Mullvad VPN with obfuscation, or Tor bridges |
| Submitting material to this archive | Tor Browser |
| Anything that must never trace back to you | Tor Browser |
| Investigating a hostile target | Tor, from a device that is not your daily one |
Mullvad offers a bundled option that routes your VPN traffic through the Tor network, which is useful when you want the VPN's convenience with Tor's guarantee. It is not a replacement for Tor Browser: Tor Browser's value is as much in its fingerprinting defences as in its routing, and running an ordinary browser over Tor still leaves you identifiable by the browser itself.
On your phone
The app runs as an always-on VPN on Android and iOS, which is worth switching on in system settings so nothing escapes before the app starts. Two caveats that matter more on mobile:
- A VPN does nothing about cell-tower location. Your carrier knows where you are whenever the phone has signal, VPN or not. Only airplane mode or leaving the phone behind changes that.
- On GrapheneOS you can combine the always-on VPN with the per-app network permission, so apps that have no business online cannot reach it even if the tunnel drops.
05What it does not protect you from
- Anything you log into. The account is the identifier, not the IP address.
- Browser fingerprinting. Different problem, different tool.
- A compromised device. Malware reads your screen before encryption happens.
- Traffic-correlation by a global observer. An adversary who can watch both your connection and the VPN's exit can line up the timing. This is a real limitation of any single-hop VPN, and it is why Tor exists.
- Your own patterns. Logging into the same accounts, at the same hours, writing the same way, from a "different" IP address identifies you anyway.
- Physical surveillance, informants, or a phone that has been physically tampered with.
06Questions people actually ask
Is a free VPN ever acceptable?
Running a VPN network costs real money, so a free service is being paid for some other way: selling browsing data, injecting ads, or in documented cases renting out users' own connections as exit nodes for other people's traffic. There are narrow exceptions — the Tor network is free and trustworthy because it is volunteer-run and structurally cannot profile you, and organisations like Proton run limited free tiers as a public good. A free commercial VPN advertising on social media is not one of the exceptions.
Will using a VPN make me look suspicious?
VPNs are mainstream — corporate remote work runs on them and hundreds of millions of people use one. The exception is a network that blocks VPNs outright, where connecting is itself visible; use obfuscation or bridges there. In a few countries VPN use is restricted or criminalised, and there the answer depends entirely on local law and local risk.
Can Mullvad be forced to start logging?
In principle any provider anywhere can be served an order to begin collecting data going forward. What no order can do is produce records that were never kept, which is why the no-account design matters more than the marketing. The realistic residual risk is future targeted collection, not retrospective disclosure, and that risk applies to every VPN that has ever existed. If your threat model includes a state specifically targeting you, the answer is Tor, not a better VPN.
Should I run a VPN and Tor together?
For most people, no, it adds complexity and can make you more distinctive rather than less. The one useful case is where connecting to Tor at all is dangerous or blocked on your network: a VPN hides from your ISP that you are using Tor. If that is your situation, Tor bridges are designed for exactly this and are usually the better answer.
How many devices can I use?
Five at once on one account, at the same flat €5. Enough for a phone, a laptop and a spare. Do not share an account with people outside your household, their traffic and yours share an identifier.
What about the VPN built into my browser or antivirus?
Browser "VPNs" are usually proxies covering only that browser's traffic, leaving everything else on your machine exposed. Antivirus-bundled VPNs come from companies with poor records on exactly this question, one major antivirus vendor was caught selling users' browsing data through a subsidiary. Use a standalone VPN from a company whose only product is the VPN.
07Sources and further reading
- Mullvad VPN — official site mullvad.net
- Mullvad blog, including their account of the police visit and the port-forwarding removal mullvad.net/en/blog
- Published independent security audits mullvad.net/en/blog/tag/audits
- Connection check — VPN, DNS and WebRTC leaks mullvad.net/check
- The Tor Project, when a VPN is not enough torproject.org
- EFF Surveillance Self-Defense — choosing a VPN ssd.eff.org
Last reviewed: 25 September 2026