Mullvad

Mullvad is one of the best for privacy, they have a totally anonymous sign up process, you don't need to provide any details at all, you can choose to pay anonymously too (with Monero, BTC or cash).

Security Audited Open Source

Mullvad Privacy Policy

Privacy Policy Summary

  • The terms for this service are easy to read
  • You must create an account to use this service
  • The service does not guarantee accuracy or reliability of the information provided
  • The service provider makes no warranty regarding uninterrupted, timely, secure or error-free service
  • The service is provided 'as is' and to be used at your sole risk
  • An onion site accessible over Tor is provided
  • An anonymous payment method is offered
  • No third-party analytics or tracking platforms are used
  • Information is provided about what kind of information they collect
  • A free help desk is provided
  • Third parties are involved in operating the service
  • You are responsible for maintaining the security of your account and for the activities on your account
  • The court of law governing the terms is in location X
  • The court of law governing the terms is in a jurisdiction that is friendlier to user privacy protection
  • Information is gathered about you through third parties
  • You are informed about the risk of publishing personal info online
  • The data retention period is kept to the minimum necessary for fulfilling its purposes
  • Some personal data may be kept for business interests or legal obligations
  • This service gives your personal data to third parties involved in its operation
  • Third parties used by the service are bound by confidentiality obligations
  • Your personal data will not be used for an automated decision-making
  • You can request access, correction and/or deletion of your data
  • A complaint mechanism is provided for the handling of personal data
  • Inconvenient process for obtaining personal data
  • First-party cookies are used
  • A list of all cookies set by the website is provided
  • The service does not use any third-party advertising services
  • The service will resist legal requests for your information where reasonably possible
  • You will be notified if personal data has been affected by data breaches
  • You can access most of the pages on the service's website without revealing any personal information
  • The service explains how to prevent disclosure of personal information to third parties
  • You are not being tracked
  • IP addresses of website visitors are not tracked
  • There is a date of the last update of the agreements
  • When the service wants to make a material change to its terms, you are notified at least 30 days in advance
  • The service claims to be GDPR compliant for European users
  • Only necessary logs are kept by the service to ensure quality
  • You can retrieve an archive of your data (under very limited circumstances)

Score

B

Documents

Domains Covered by Policy

  • mullvad.net
  • o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion

About the Data

This data is kindly provided by tosdr.org. Read full report at: #641

Mullvad Source Code

Author

mullvad

Description

The Mullvad VPN client app for desktop and mobile

#electron#nodejs#openvpn#rust#vpn#wireguard

Homepage

https://mullvad.net/

Repository

  • LicenseGPL-3.0
  • Created19 Dec 17
  • Primary languageRust
  • Size309,051 KB
  • Stars7,529
  • Forks516
  • Watchers7,529

Language Usage

Language Usage

Project Health

  • Last commit5 days ago
  • Open issues164
  • Latest releasetui

Recent Commits

  • Markus Pettersson(03 Sept 26)

    Merge branch 'fix-node-cves'

  • Markus Pettersson(03 Sept 26)

    Bump `fast-uri`

  • Markus Pettersson(03 Sept 26)

    Bump `browserslist`

  • Markus Pettersson(03 Sept 26)

    Bump `@xmldom/xmldom`

  • Markus Pettersson(03 Sept 26)

    Bump `@humanfs/node`

  • David Lönnhager(03 Sept 26)

    Merge branch 'win-extend-dns-flush'

  • David Lönnhager(02 Sept 26)

    Extend DNS cache flush timeout Mitigates timeouts likely related to large hosts files

  • David Lönnhager(02 Sept 26)

    Do not flush DNS cache on DNS reset We can assume that the cache isn't poisoned when there's a tunnel

  • Kalle Lindström(03 Sept 26)

    Merge branch 'make-unsupported-info-less-intrusive-for-alpha-and-dev-droid-2706'

  • Kalle Lindström(02 Sept 26)

    Do not show version notification for alpha and dev

  • Kalle Lindström(02 Sept 26)

    Use different icons for alpha, dev and release

  • Jonatan Rhodin(03 Sept 26)

    Merge branch 'fix-kotlin-dependency-not-being-pinned'

  • Jonatan Rhodin(03 Sept 26)

    Fix some kotlin dependencies using the latest version of kotlin

  • Linus(03 Sept 26)

    Merge branch 'ios-rust-ffi-single-job'

  • Linus(03 Sept 26)

    Build and lint in one job and test the iOS FFI crates in another Clippy reuses the target directory the build just populated, so keeping the two in one job measurably shortens the lint. Measured over 30 runs of the old layout the lint took 2.91 min from cold against 1.80 min after a build in the same job. The tests build for the host rather than the iOS target, so they shared nothing with the build and are better off in their own job, where a red check says whether the tests or the build and lint failed. Clippy is split per feature set for the same reason.

  • Linus(03 Sept 26)

    Remove the iOS simulator target from the Rust FFI workflow The simulator target differs from the device target only in target_abi and target_env, and in the simulator's wider target_feature baseline. No crate in this repo branches on any of those, and both targets resolve to an identical dependency closure, so building and linting the simulator caught nothing the device target did not. With one target left the matrix goes away. The target name moves to a job level env variable so it is still stated once per job.

  • Linus(03 Sept 26)

    Set the iOS FFI package list and shell in one place The two crates were named in every cargo invocation, so adding or renaming one meant editing each in step. Substituting the list also shortens the clippy commands enough to fit on one line. Two steps declared `shell: bash` while the rest relied on the default. That is not only cosmetic: an unspecified shell runs `bash -e`, whereas `shell: bash` runs `bash --noprofile --norc -eo pipefail`, so only the explicit form fails a step when a command in a pipeline fails.

  • Jon Petersson(03 Sept 26)

    Merge branch 'devices-logs-are-duplicated-when-being-sent-ios-1767'

  • Jon Petersson(01 Sept 26)

    Remove duplication of logs

  • David Lönnhager(02 Sept 26)

    Log failure to compile shaders instead of showing alert

  • David Lönnhager(02 Sept 26)

    Merge branch 'bound-driver-removal-timeouts'

  • David Lönnhager(02 Sept 26)

    Handle unpopped values from nsExec::Exec in Windows installer The intended "return value" was passed in as an argument instead. Likely caused no issues in practice other than growing the stack for no reason.

  • David Lönnhager(02 Sept 26)

    Kill mullvad-setup.exe if it lingers after timed out device cleanup

  • David Lönnhager(02 Sept 26)

    Update changelog for removed Wintun adapter cleanup

  • David Lönnhager(01 Sept 26)

    Get rid of RemoveAbandonedWintunAdapter The macro was added in 2021.3-beta1 to clear an adapter holding our fixed GUID even when it belonged to a different Wintun pool (#2505). "Pools" have not been relevant since 2022.5-beta1. Wintun dropped pools in 41a962e7d0.

  • David Lönnhager(01 Sept 26)

    Do not loop forever when a device removal needs a reboot

  • David Lönnhager(01 Sept 26)

    Add timeout for removal of abandoned drivers in installer From a log: [13:04:19.377] RemoveAbandonedWintunAdapter() [13:37:46.381] RemoveAbandonedWintunAdapter() completed successfully Since these cleanups are nice to have rather than strictly necessary, this commit adds a timeout.

  • Emīls(02 Sept 26)

    Merge branch 'ios-gotatun-3-path'

  • Emīls(31 Aug 26)

    Leave TODO to remove soon to be dead code

  • Emīls(13 Aug 26)

    Test GotaTun reachability handling Covers offline blocking and adapter teardown, starting while offline, restoration reconnects, socket recycling on satisfied paths, debounce of repeated unsatisfied updates, and observer lifecycle. DefaultPathObserverFake previously swallowed updatePath calls; it now delivers them, delivers the current path on start like real observers, and gains a GotaTun counterpart.

Mullvad Security

8.5/10

Repo Security Summary

Updated 24 Aug 26

  • Code-Review10/10
  • Maintained10/10
  • Security-Policy10/10
  • Dangerous-Workflow10/10
  • CII-Best-Practices5/10
  • PackagingN/A
  • License10/10
  • Token-Permissions10/10
  • Branch-Protection8/10
  • Signed-Releases8/10
  • Pinned-Dependencies8/10
  • Fuzzing0/10
  • Binary-Artifacts8/10
  • SAST10/10

Security Advisories (4)

  • highPatchedCVSS 7

    GHSA-p9rr-wc9m-qmwgManagement interface socket TOCTOU allows unauthorized local access

  • mediumPatchedCVSS 6.8

    GHSA-wx6c-cjr8-6442Windows reconnect clears VPN routes before Hyper-V blocking is restored can lead to WSL2 traffic leaking off-tunnel

  • mediumPatchedCVSS 6.5

    GHSA-h72f-j6r4-c3jcRenderer-controlled installer path can lead to arbitrary package launch due to missing main-process binding to verified installer path

  • highPatchedCVSS 7.3

    CVE-2026-32323CVE-2026-32323: macOS Local Privilege Escalation in Mullvad VPN installer

Mullvad Website

Website

Free the internet with Mullvad Browser

The Mullvad Browser is a privacy-focused web browser developed in collaboration between Mullvad VPN and the Tor Project. It’s produced to minimize tracking and fingerprinting.

Redirects

Redirects to https://mullvad.net/en/browser

Security Checks

All 65 security checks passed

Server Details

  • IP Address45.83.223.209
  • LocationMalmoe,Skane lan,Sweden,EU
  • ISP31173 Services AB
  • ASNAS39351

Categories

Some proxies may block this service, as it falls into the following categories

  • VPN Provider

Associated Countries

  • USUS
  • DEDE
  • SESE
  • CACA

Safety Score

Website marked as safe

100%

Blacklist Check

mullvad.net was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview

Mullvad Android App

APK Info

De-Googled Compatibility

Native4.00/ 426 ratings
microG4.00/ 417 ratings
  • GrapheneOSNative4.0 / 4(18)
  • CalyxOSmicroG4.0 / 4(9)
  • LineageOSNative4.0 / 4(5)
  • LineageOSmicroG4.0 / 4(3)
  • iodeOSmicroG4.0 / 4(3)
  • crDroidNative4.0 / 4(2)

Tested on Android 13–16 · Updated 28 Aug 26 · View on Plexus →

Trackers

No trackers found

    Permissions

    • Access Network State
    • Foreground Service
    • Foreground Service System Exempted
    • Internet
    • Post Notifications
    • Query All Packages
    • Dynamic Receiver Not Exported Permission

    Mullvad iOS App

    App Info

    Mullvad VPN

    Free the internet from data collection with Mullvad VPN – a service that helps keep your online activity, identity, and location private. Only €5/month. GET STARTED 1. Install the app. 2. Create an account. 3. Add time to your account via in-app purchases, vouchers or on our website. To make sure to block third-party cookies and other tracking technologies – use Mullvad VPN together with Mullvad Browser (free of charge). ANONYMOUS ACCOUNTS – NO ACTIVITY LOGS * Creating an account requires no personal info - not even an email address. * We keep no activity logs. * We offer the possibility to pay anonymously with cash or cryptocurrency. * Our app uses WireGuard, a superior VPN protocol that connects fast and doesn’t drain your battery. HOW DOES MULLVAD VPN WORK? With Mullvad VPN, your traffic travels through an encrypted tunnel to one of our VPN servers and then onward to the website you are visiting. In this way, websites will only see our server’s identity instead of yours. Same goes for your ISP (internet service provider); they’ll see that you’re connected to Mullvad, but not your activity. It also means that all the third-party actors with technology integrated into the various websites you visit can’t sniff out your IP address and use it to track you from one site to another. Using a trustworthy VPN is a great first step to reclaim your privacy online. In combination with Mullvad Browser you make sure to block third-party cookies and other tracking technologies. FREE THE INTERNET FROM MASS SURVEILLANCE AND DATA COLLECTION A free and open society is a society where people have the right to privacy. That’s why we fight for a free internet. Free from mass surveillance and censorship. Free from big data markets where your personal information is up for sale. Free from authorities mass monitoring every click you make. Free from an infrastructure mapping your whole life. Mullvad VPN and Mullvad Browser is our contribution to the fight. TELEMETRY AND CRASH REPORTS The app collects a very minimal amount of telemetry, and it does not in any way tie it to an account number, IP or other identifiable information. Account numbers are used for authentication. App logs are never sent automatically but are rather explicitly sent by the user. App version checks are performed every 24 hours to tell the app if there are any upgrades available and if the currently running version is still supported.

    Rating

    Rated 4.15 out of 5 stars by 1,419 users

    Version Info

    • Current Version2026.3
    • Last Updated26 Jun 26
    • First Released08 Apr 20
    • Minimum iOS Version17.0
    • Device Models Supported127

    App Details

    • IPA Size46.77 Mb
    • PriceFree (USD)
    • Age Advisory4+
    • Supported Languages21
    • DeveloperMullvad VPN AB
    • Bundle IDnet.mullvad.MullvadVPN

    Screenshots

    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot
    • App screenshot

    Mullvad Docker

    Container Info

    Mullvad-browser

    The [Mullvad Browser](https://mullvad.net/en/browser) is a privacy-focused web browser developed in a collaboration between Mullvad VPN and the Tor Project. It’s designed to minimize tracking and fingerprinting. You could say it’s a Tor Browser to use without the Tor Network. Instead, you can use it with a trustworthy VPN.

    #Web Browser#VPN

    View on DockerHub

    linuxserver/mullvad-browser:latest

    Run Command

    docker run -d \
      -p 3000:3000/tcp \
      -p 3001:3001/tcp \
      -e PUID=${PUID} \
      -e PGID=${PGID} \
      -e TZ=${TZ} \
      -e LOCAL_NET=${LOCAL_NET} \
      -v /srv/lsio/mullvad-browser/config:/config \
      --restart=unless-stopped \
      linuxserver/mullvad-browser:latest

    Compose File

    version: 3.8
    services:
      mullvad-browser:
        image: "linuxserver/mullvad-browser:latest"
        ports:
          - "3000:3000/tcp"
          - "3001:3001/tcp"
        environment:
          PUID: 1000
          PGID: 1000
          TZ: Etc/UTC
          LOCAL_NET: 192.168.0.0/16
        volumes:
          - "/srv/lsio/mullvad-browser/config:/config"
        restart: unless-stopped

    Environment Variables

    • Var NameDefault
    • PUID1000
    • PGID1000
    • TZEtc/UTC
    • LOCAL_NET192.168.0.0/16

    Port List

    • 3000:3000/tcp
    • 3001:3001/tcp

    Volume Mounting

    • Container PathHost Bind
    • /config/srv/lsio/mullvad-browser/config

    Mullvad Reviews

    More Virtual Private Networks

    • Azire is a Swedish VPN provider, who owns their own hardware with physically removed storage and a no logging policy. Pricing starts at €3.25/mo, with crypto (including XMR) supported. Note that they've not yet been audited, and client applications are not open source, for more info, see #140.

      Not Open Source
    • Independently Security Audited VPN with anonymous signup, no logs, no cloud or customer data stored, open-source apps and website. Strong ethics: no trackers, no false promises, no surveillance ads. Accepts various payment methods including cryptocurrencies.

      Security Audited Open Source ivpn/desktop-app
    • A court-proven VPN service with support for Wireguard and OpenVPN support, and optional ad-blocking. Running on dedicated hardware, with no hard drives.

      No Security Audit
    • Crypto-native VPN with pay-as-you-go pricing. Accepts cryptocurrency only, including Monero. WireGuard and AmneziaWG protocols, no-logs policy, REST API for developers. No subscriptions or credit cards.

      Crypto Payments Accepted No Security Audit
    • From the creators of ProtonMail, ProtonVPN has a solid reputation. They have a full suite of user-friendly native mobile and desktop apps. ProtonVPN is one of the few "trustworthy" providers that also offer a free plan.

      Security Audited Open Source ProtonVPN/android-app
    • An audited and court-proven VPN with a free 10GB plan, in-RAM servers, browser extensions and open source WireGuard/IKEv2/OpenVPN clients. Supports split tunneling, customizable DNS blocking, MAC spoofing, decoy traffic and censorship circumvention.

    About the Data: Mullvad

    Change History

    Edit Mullvad Data

    You can edit Mullvad's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
    Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

    Origin Data

    Modify Data

    API

    You can access Mullvad's data programmatically via our API. Simply make a GET request to:

    https://api.awesome-privacy.xyz/v1/services/mullvad

    The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

    Share Mullvad

    Help your friends compare Virtual Private Networks, and pick privacy-respecting software and services.
    Share Mullvad and Awesome Privacy with your network!