Mullvad VPN, the provider that doesn't even know your name

The article on VPNs explained that using a VPN means shifting your trust onto your provider, not removing it, and that choosing that provider matters more than simply using one at all. Mullvad, a Swedish VPN, is a good illustration of what that choice can look like when taken seriously: no sponsored recommendation, no partnership, just a concrete, verifiable example of what a provider looks like when it takes its own promise at its word.

An account that asks for neither a name nor an email

The first thing that sets Mullvad apart from nearly every commercial VPN shows up right at sign-up: no email address, no name, no password to pick. The site generates a 16-digit account number, and that number, and nothing else, serves as both the identifier and the way to log in. Payment can be made by card or other standard means, but also in cash sent by mail, or in cryptocurrency (see the article on cryptocurrency), two options that let you remain a plain number from start to finish, with no personal information ever attached to the account.

Mullvad's published privacy policy directly reflects this technical choice: it states that only the account number, remaining subscription time, and a payment record when the method used requires one are kept. Traffic, DNS queries, IP addresses, and connection timestamps are, according to that policy, never stored.

A flat price, no subscription trap

Mullvad charges a single rate of about €5 a month, regardless of how long a subscription is bought upfront: no low introductory price that doubles on renewal, no "premium" tier holding features hostage, a practice nonetheless common among many commercial VPNs (see the article on VPNs for what to watch out for in a VPN's business model). The same rate applies to a one-month subscription or a multi-year one.

The real-world test of 2023

A privacy policy remains a written promise, until it's tested under real conditions. On April 18, 2023, Swedish police showed up at Mullvad's offices in Gothenburg with a search warrant, as part of international judicial cooperation with Germany, to seize data on a specific customer. Investigators left with nothing seized: the company showed how its infrastructure worked, and the requested data simply didn't exist, since it had never been collected in the first place. Mullvad's own director noted that, in the company's fourteen years of existence, it was the first visit of this kind.

The company has also had its infrastructure audited more than a dozen times by independent security firms, including Cure53 and Assured AB, with reports made public rather than kept internal.

Things to keep in mind

• Sweden is among the countries taking part in intelligence-sharing agreements between Western services (often summarized as the "14 Eyes"): this doesn't call the 2023 episode into question, but it remains a geopolitical factor worth knowing, just as it would for any provider, regardless of country
• Mullvad doesn't offer a permanent free tier, only a paid subscription from the start
• As with any VPN, choosing a provider shifts trust without eliminating it (see the article on VPNs again): none of this excuses comparing several options based on your own needs

Who it's for

Mullvad is for someone who already understands what a VPN actually protects, and is looking for a provider whose claims have been verified rather than simply stated on a sales page. It isn't the only serious VPN on the market, but it's a concrete, documented benchmark for judging any other candidate against: what does it actually collect, and has that promise ever been put to the test?