Mullvad VPN Review: Still Worth It Without Port Forwarding?

Mullvad VPN is a privacy-first virtual private network service based in Gothenburg, Sweden, operated by Amagicom AB (also known as Assured AB), built around anonymous accounts, a flat monthly price, and a strict no-logs policy verified by independent audits.

Picking a VPN in 2026 is harder than it looks. The market is crowded with services that bundle password managers, dark web monitoring, and antivirus tools you never asked for. Mullvad does none of that. It offers exactly one thing: a well-built, privacy-hardened VPN at a price that undercuts most of the competition.

For data hoarders, home lab operators, and privacy-conscious users, the question is not whether Mullvad is trustworthy, it is whether it fits your specific workflow after the company removed port forwarding in 2023.

That removal triggered real frustration in archival and automation communities. We cover that tradeoff honestly here. This review also looks at Mullvad’s security architecture, real-world speeds, pricing model, and which use cases it still handles well in mid-2026.

Who Mullvad Makes Sense For in 2026

Mullvad occupies a specific lane among the best VPNs available today. It is not the fastest, it does not support unlimited simultaneous connections, and it has a smaller server network than most major competitors. What it does exceptionally well is privacy, transparency, and simplicity at a price that holds firm regardless of subscription length.

Best Fit for Privacy-First Archival Workflows

If your primary goal is protecting your identity while pulling down large datasets, accessing public domain archives, or running automated download pipelines that do not require inbound connections, Mullvad fits naturally.

The no-logs policy is audited and credible. The anonymous account system means no email address or personal data is ever linked to your subscription. For archivists who want a clean privacy layer between their ISP and their home lab traffic, that combination is hard to beat.

WireGuard performs reliably on high-throughput connections. Usenet downloads routed through Mullvad stay fast because Usenet is a client-initiated pull protocol, not a peer-to-peer system that depends on inbound port access.

Where Mullvad Falls Short for Certain Home Lab Setups

The port forwarding removal in 2023 is a genuine limitation for specific automation stacks. If your workflow depends on seeding, running a home server accessible from outside your network, or any setup that requires inbound connections through the VPN tunnel, Mullvad no longer supports that.

The simultaneous connection cap of five devices is also a constraint for users running multiple virtual machines, containers, or network-attached storage devices behind a single VPN subscription. Competitors like Surfshark offer unlimited connections at a comparable or lower long-term price.

When To Consider Other Best VPNs Instead

Users who need port forwarding for their media stack or archival automation should look elsewhere. AirVPN and IVPN still support port forwarding as of mid-2026. Proton VPN offers port forwarding on paid plans alongside a strong privacy reputation.

If streaming geo-restricted content is a priority, Mullvad’s track record there is inconsistent. For budget users who want more simultaneous connections and a longer refund window, a cheap VPN like Surfshark may offer better practical value depending on your specific use case.

Mullvad Review: Privacy Model and Trust Signals

Mullvad’s privacy reputation is not marketing language. It is backed by specific structural decisions about how accounts are created, how payments are processed, and how the company responds to legal pressure. The jurisdiction question matters too, and Sweden’s position in the 14 Eyes alliance deserves a clear-eyed look rather than a reflexive dismissal.

Anonymous Accounts, No Email, and Cash Payments

When you sign up for Mullvad, the service generates a random 16-digit account number. No username. No email address. No name. There is nothing to hand over to a third party because nothing was collected in the first place.

Payment options reinforce that design. You can pay with a credit card if you accept the tradeoff, but you can also pay with Bitcoin at a slight discount, or mail physical cash to Mullvad’s office in Sweden with just your account number included. Prepaid cards are also available.

Mullvad ended recurring subscription billing in 2022 specifically because recurring payments require retaining payment data.

How the No-Logs Policy Holds Up

Mullvad explicitly states it does not log user traffic, DNS requests, connection timestamps, IP addresses, or bandwidth usage. In April 2023, Swedish police arrived at Mullvad’s headquarters with a search warrant. Mullvad confirmed the visit publicly and reported that no data was taken because no data existed to take.

That real-world test is more meaningful than any policy statement. The company also states it would shut down the service rather than comply with a legal order to monitor users.

Independent Audits, Open Source, and Cure53

Mullvad has commissioned multiple independent audits from Cure53, a well-regarded German cybersecurity firm. The app code and infrastructure have both been reviewed. Audit reports are published publicly.

The VPN client is open source, meaning the code can be inspected by anyone. This combination of third-party audits and open-source transparency is a meaningful signal for a trustworthy VPN.

Sweden, 14 Eyes, and What Jurisdiction Really Means

Sweden is a 14 Eyes member, which means intelligence-sharing agreements exist with the United States, the United Kingdom, and others. For many users, this raises concern.

The practical counterpoint is that jurisdiction matters most when data exists to share. Mullvad’s no-logs architecture means there is nothing useful to share even under a valid legal request. The 2023 police visit confirmed that in practice. Assured AB, Mullvad’s parent company, has been consistent on this point across public communications.

Security Features That Matter Day to Day

Mullvad’s security stack goes well beyond the basics. The combination of protocol flexibility, layered kill switch options, DNS controls, and obfuscation tools gives it more depth than its simple pricing suggests. For data hoarders running automated workflows, these features translate directly into practical protection.

WireGuard, OpenVPN, and Current Protocol Support

WireGuard is the default and recommended protocol on all platforms. The implementation varies slightly by operating system: WireGuardNT on Windows, Linux Kernel WireGuard on Linux, and WireGuard-GO on iOS and macOS. Each version is suited to its environment.

OpenVPN is also available for users who need it, particularly in environments where WireGuard traffic is actively detected or blocked. Mullvad supports both UDP and TCP modes for OpenVPN.

The VPN protocols are all open source. Mullvad publishes its client code publicly, so the implementation can be verified rather than trusted on faith.

Kill Switch, Lockdown Mode, and DNS Leak Protection

A standard kill switch is enabled by default. If the VPN connection drops, outbound traffic is blocked immediately. That baseline protection is what most users need.

Mullvad also offers a more aggressive option called lockdown mode. In lockdown mode, any connection that is not routed through the VPN is automatically disabled, including traffic that would normally bypass the kill switch. This is particularly useful for always-on home lab setups.

DNS leak protection is built in. Mullvad routes DNS queries through its own servers by default, preventing the ISP from seeing your query traffic even when the VPN is active.

Custom DNS, Private DNS, and Content Blocking

Mullvad supports custom DNS configuration. Users can point the VPN to a private DNS resolver of their choice, which matters for home lab operators who run their own DNS infrastructure.

The built-in content blocker can filter ads, trackers, adult content, gambling sites, and social media at the DNS level. A malware-blocking option is also available, though Mullvad is transparent that it is not a substitute for a dedicated antivirus solution.

IPv6 tunneling is supported but disabled by default, since IPv4 configurations are significantly less prone to information leakage.

Obfuscation Options Including Shadowsocks and QUIC

Mullvad supports Shadowsocks obfuscation, which wraps VPN traffic to make it look like standard HTTPS. This helps in environments where VPN protocols are actively fingerprinted or blocked.

QUIC obfuscation is also available as a newer option. Both can be configured through the app’s anti-censorship settings without requiring manual configuration files.

Multi-hop routing sends your traffic through two servers rather than one, adding an extra layer of separation between your real IP and your destination. There is a performance cost, but for high-sensitivity archival work, it is a meaningful option.

Speed, Servers, and Real-World Performance

Mullvad’s performance story is solid but not exceptional. The network is smaller than most major competitors, and raw throughput varies by location. For most data hoarding and archival workflows, the speeds are more than adequate.

What To Expect From Mullvad Speeds

On a 1 Gbps fiber connection, Mullvad typically delivers around 600 to 650 Mbps on WireGuard under good conditions. That is competitive but places it mid-tier among the services we have tested.

Latency is generally low on nearby servers. Connecting to servers in the same country or region produces minimal overhead. Long-distance connections, particularly to Asia-Pacific from the United States, introduce more noticeable latency.

Enabling multi-hop or DAITA (Mullvad’s AI-assisted traffic analysis defense) significantly reduces throughput. Use those features selectively based on your actual threat model.

Server Footprint, Mullvad Servers, and Network Limits

Mullvad operates over 690 servers across 90 countries as of mid-2026, up from roughly 580 servers in 50 countries the year before — the network has expanded significantly. That is still a smaller footprint than NordVPN or ExpressVPN, but the network is notably transparent.

Each server listing on Mullvad’s website includes ownership details, precise physical location, IP address, current user load, and activity status. That level of disclosure is rare. Mullvad does not use virtual servers; every server is physically located where the listing says it is.

Coverage includes underserved regions in South America and Africa, which is useful for users who need geographic diversity in their archival pipelines.

RAM-Based Infrastructure and Operational Tradeoffs

Mullvad uses RAM-only servers across its network. Servers that run entirely from RAM cannot retain data across reboots. If a server is seized or powered down, no persistent data can be recovered from storage.

The tradeoff is that RAM-based servers require more careful operational management. Reboots wipe everything, which is the point from a privacy standpoint. For users who care about infrastructure-level privacy guarantees, this design choice is a meaningful commitment rather than a marketing claim.

Data Hoarder Use Cases and the Port Forwarding Problem

For the data hoarding community, Mullvad occupies a complicated position. The privacy model is genuinely excellent. The removal of port forwarding in 2023 created real friction for specific automated workflows. Understanding where that line falls matters before you commit.

Why Mullvad Still Works Well for General Privacy

Usenet downloads work cleanly behind Mullvad. Because Usenet is a client-pull protocol, your client connects outbound to the provider’s servers, and no inbound port is required. SSL-encrypted Usenet traffic over port 563 routes through the VPN tunnel without any special configuration.

For general browsing, research, and pulling archival data from public sources, Mullvad’s privacy protections are difficult to match at this price point. The kill switch and lockdown mode keep accidental exposure minimal.

How Port Forwarding Removal Changes Advanced Workflows

Mullvad removed port forwarding on July 1, 2023. The decision was driven by abuse: individuals were using forwarded ports to host malicious services, which triggered blocking at the destination end and degraded the experience for legitimate users.

The consequence for home lab automation is direct. If your stack relies on inbound connections through the VPN, including certain API-driven download managers or remote access configurations, Mullvad cannot support that configuration anymore.

Users in the r/DataHoarder community reported significant throughput drops on peer-to-peer protocols after the removal, even with workarounds like SOCKS5 proxies and adjusted connection settings. Those workarounds do not fully compensate for the missing feature.

Split Tunneling for Selective App Routing

The Mullvad app supports split tunneling, which lets you route specific applications outside the VPN tunnel while keeping everything else protected. This is useful for tools that conflict with VPN routing, such as local network storage access or certain home lab management interfaces.

Split tunneling is a partial workaround for some port forwarding use cases, but it does not replicate inbound connection support. Applications excluded from the tunnel send their traffic through your regular ISP connection, which means your real IP is visible for that traffic.

What We Would Recommend for Archival Data and Automation

For Usenet-based archival workflows, Mullvad works well. Pair it with a quality Usenet provider like Get Newshosting or Get Easynews for a clean, private download pipeline that requires no port configuration at all.

For automation stacks that need inbound connections or port forwarding, we would point you toward AirVPN or IVPN as current alternatives that still support that feature. Proton VPN is another option worth evaluating if you want a strong privacy record alongside port forwarding on paid tiers.

Pricing, Refunds, and Final Value

Mullvad’s pricing model is deliberately simple. There are no annual plans, no multi-year discounts, and no promotional tiers. That simplicity is a feature in itself for users who distrust the subscription tactics common in the VPN industry.

Flat Monthly Cost and Mullvad Pricing

Mullvad costs 5 euros per month, which works out to roughly $5.90 USD at current exchange rates. That price does not change based on how long you subscribe. There are no discounts for committing to a year or two years upfront.

The payment model is pay-as-you-go. You add funds to your account manually rather than setting up a recurring billing arrangement. Bitcoin payments qualify for a small discount due to the absence of processing fees.

Prepaid cards are also available, including through Amazon, which adds a layer of purchase anonymity for users who want it.

Refund Policy Versus 30-Day Money-Back Guarantee Rivals

Mullvad does not offer a standard 30-day money-back guarantee in the way that most competitors do. Refunds are handled on a case-by-case basis rather than as a blanket policy.

This is a meaningful contrast with services like Surfshark or NordVPN, which offer 30-day money-back guarantees as a standard commitment. For users who want a risk-free trial period, Mullvad’s approach requires more trust upfront.

The anonymous account model is part of why a standard refund policy is structurally awkward: there is no email address or payment account to tie a refund request to in many payment scenarios.

How Mullvad Compares With Surfshark and Similar Alternatives

At $5.90 per month with no long-term commitment, Mullvad undercuts most premium VPNs on a month-to-month basis. Surfshark’s monthly rate is significantly higher without a multi-year commitment, though its annual pricing drops it below Mullvad in effective cost.

Surfshark offers unlimited simultaneous connections. Mullvad caps at five. For users running large home lab environments with multiple devices, that difference is practical, not just theoretical.

Mullvad’s privacy architecture is stronger by design. Surfshark collects more account data and operates under a different jurisdiction. If pure privacy is the priority, Mullvad holds the edge. If budget, device count, and refund flexibility matter more, the comparison becomes less one-sided.

Frequently Asked Questions

How trustworthy is Mullvad for privacy and security?

Mullvad is among the most credibly privacy-focused commercial VPNs available. The no-logs policy has been independently audited by Cure53, the client is open source, and a 2023 police search of Mullvad’s headquarters resulted in no data being taken because no user data existed on the servers.

How much does Mullvad cost per month and what payment options are available?

Mullvad costs 5 euros per month (approximately $5.90 USD) with no discounts for longer commitments. Payment options include credit card, PayPal, Bitcoin, bank wire, physical cash mailed to the company’s Sweden office, and prepaid cards available through Amazon.

How does Mullvad compare to NordVPN for speed, features, and privacy?

NordVPN has a larger server network, higher average speeds, and more bundled features including threat protection tools. Mullvad is significantly more anonymous by design, with no email required and no recurring billing. For pure privacy, Mullvad has the structural edge; for speed and feature depth, NordVPN leads.

How does Mullvad compare to Proton VPN for anonymity and streaming support?

Both services have strong privacy reputations and have undergone independent audits. Proton VPN offers a free tier, port forwarding on paid plans, and more consistent streaming support. Mullvad’s anonymous account system goes further in reducing the data footprint, but Proton VPN is more versatile for mixed use cases.

Does Mullvad keep logs, and what data (if any) is stored about users?

Mullvad states it does not log traffic, DNS queries, connection timestamps, IP addresses, or bandwidth usage. The 2023 Swedish police search confirmed this in practice: authorities left without data because none was available. Account numbers are randomly generated and not tied to any personal information.

What do users commonly report about Mullvad’s performance and reliability on Reddit?

Reddit users in communities like r/DataHoarder and r/privacy generally describe Mullvad as reliable and trustworthy for general privacy use. The most consistent criticism since 2023 is the port forwarding removal, with users reporting that peer-to-peer and inbound-dependent workflows became significantly slower or non-functional after July 2023.