Case file · VPN
Mullvad
The account-number VPN. No email, no name — just a random number.
The systematized overview
The bureau vs the internet.
9.7/10 · Guaranteed no-KYC
The strongest no-KYC posture we have reviewed. You are a 16-digit number; there is nothing to hand over, and in 2023 a police raid proved exactly that.
4 recurring praises · 3 recurring gripes
Most praised: widely regarded as the benchmark for a genuinely anonymous vpn. Most cited downside: flat €5/mo with no long-term discount frustrates bargain hunters.
We track our editorial score and community sentiment separately — neither moves the other. Read together, they're the systematized overview.
The facts
Specs & jurisdiction.
- Jurisdiction
- Sweden
- Intel-sharing
- 14 Eyes member
- Logging
- No activity logs (audited)
- Anon. payment
- Cash by post, Monero, BTC
- Protocols
- WireGuard, OpenVPN
- Network
- ~600+ servers · 40+ countries
- Devices
- 5 simultaneous
- Kill switch
- Yes
- RAM-only
- Yes — System Transparency
- Open source
- Yes (apps)
- Audited
- Yes — Cure53, Assured, ROS
- Free tier
- No
The full read
Our analysis, in plain words.
Mullvad inverts the normal VPN sign-up. There is no email, no username, no name — you click "generate account" and receive a random 16-digit number. That number *is* your identity, and you top it up like a prepaid card. Because there is no account record tied to a person, there is nothing that can later be demanded of you: no "verify your identity to continue," no withdrawal step to gate. This is the structural difference between a service that promises privacy and one that is built so it has no private data to surrender.
Payment is where most "anonymous" VPNs quietly fail, because a card or PayPal ties a real name to the account. Mullvad accepts Monero and — unusually — physical cash mailed in an envelope with your account number, so the money trail need never touch your identity. In 2022 it went further and removed recurring subscriptions entirely, cutting the standing payment tokens that most services keep on file. Fewer stored handles, by design.
On logging and infrastructure, Mullvad runs diskless, RAM-only servers under its System Transparency project and publishes recurring third-party audits (Cure53, Assured, Radically Open Security). The claim was stress-tested in the real world: in April 2023 Swedish police arrived with a search warrant to seize customer data and left with nothing, because there was none to take. Sweden is a 14-Eyes country — normally a mark against a VPN — but that jurisdiction risk is neutralised structurally rather than promised away.
The score, broken down
How the 9.7 is built.
Privacy
weight 50%What identity, data and metadata the service can demand or collect.
98 × 50% = 4.9 of 10
Trust
weight 30%Whether it can technically deliver what it claims — code, audits, age.
94 × 30% = 2.8 of 10
Reliability
weight 20%Whether the no-KYC claim holds under real-world pressure.
100 × 20% = 2.0 of 10
Weighted total 9.7 / 10 · no reliability rule triggered, so the score stands. See the rubric →
Every point, sourced
What earned the score.
Privacy
The fine print, read for you
Terms reviewed — no trapdoor found.
“With Mullvad, your privacy comes first. We don't store any activity logs, don't ask for personal information, and encourage anonymous payments.”
What it meansNo discretionary "we may request ID" carve-out exists anywhere in the terms. The privacy posture is structural — they collect nothing to begin with — not a promise they could quietly reverse at withdrawal. This is what a genuine level-0 reads like.
Read the source →None. No identity is ever required — not to sign up, not to pay (cash and Monero are accepted), and not to keep using the account. There is no withdrawal step to gate because you top up a prepaid number.
Policy review — point by point
-
No personal data collected at sign-up
The account is a generated number; no email, phone, or name is requested or stored. ↗
-
No activity logs — independently audited
The no-logging policy is backed by published third-party audits, not just a policy statement. ↗
-
Anonymous payment is a first-class option
Cash-by-post and Monero are officially supported, and recurring subscription tokens were removed in 2022. ↗
-
Swedish (14-Eyes) jurisdiction
Sweden participates in intelligence-sharing. The risk is real in principle but mitigated because there is no customer data to compel — as the 2023 raid demonstrated. ↗
-
No discretionary "we may request ID" clause
Nothing in the terms reserves a right to demand identity later — the defining trait of a genuine level-0 service. ↗
Sweden is part of the 14-Eyes intelligence-sharing arrangement, which would normally count against a VPN. Mullvad neutralises it structurally: with no account identity and no activity logs, a lawful request has nothing to return — precisely what the April 2023 police raid proved in practice.
We keep watching
Incident & policy timeline.
- Apr 2023
Police raid — nothing to seize
Swedish police executed a search warrant to seize customer data. They left empty-handed: Mullvad holds no customer data to hand over. A real-world stress test of the no-logs claim, passed.
source ↗ - 2022
Dropped recurring subscriptions
Removed auto-renewing subscriptions and PayPal/renewal tokens that could tie a payment identity to an account over time — a privacy-forward move against most of the industry's direction.
source ↗ - Ongoing
Recurring third-party audits published
Apps and infrastructure re-audited on a cycle by Cure53, Assured and Radically Open Security, with reports published in full.
source ↗
The verdict
Where it stands.
Strengths
- You never provide an identity — the account is a random number
- Cash-by-post and Monero make the payment trail anonymous too
- The 2023 raid is public proof the no-logs claim holds under pressure
- Open-source and independently audited, repeatedly
Trade-offs
- Flat €5/mo with no long-term discount — cheaper rivals exist
- Smaller server network than the big commercial VPNs
- No streaming-unblocking guarantees — it is a privacy tool, not a Netflix tool
Across the internet
What reviewers report.
Consistently praised
- Widely regarded as the benchmark for a genuinely anonymous VPN
- Reliability and honest, flat pricing are consistently praised
- The 2023 raid outcome is cited as proof the no-logs claim is real
- Trusted by the privacy/technical community for its ethics
Recurring complaints
- Flat €5/mo with no long-term discount frustrates bargain hunters
- Smaller server network than the mega-commercial VPNs
- Not the tool for reliable streaming/Netflix unblocking
Synthesised from themes commonly reported across privacy communities and review sites. Live, trust-weighted user reviews arrive with the Ask-the-bureau launch.
Keep exploring
Related lists & categories.
Ask the bureau
Mullvad, common questions.
Is Mullvad no-KYC?
Yes - Mullvad is our top-rated no-KYC VPN (KYC level 0, 9.7/10 overall). You get a random 16-digit account number instead of an email or name, no identity is ever requested, and a 2023 police raid on its offices produced no customer data because none exists to hand over.
Does Mullvad ever ask for your identity?
No. You get a random 16-digit account number instead of creating an account with an email or name. No identity is requested at sign-up, payment, or any point after.
Can you pay Mullvad anonymously?
Yes. Alongside cards and PayPal, Mullvad accepts Monero and physical cash sent by post referencing your account number, so the payment need not be linked to you.
Has Mullvad ever handed over user data?
There is no record of it doing so, and it holds no activity logs to hand over. In April 2023 Swedish police raided its office with a warrant and left with nothing, because there was no customer data to seize.
Is Mullvad genuinely no-log?
Its no-logging policy has been independently audited, and the 2023 raid demonstrated in practice that no customer data was available to be taken.
Your exact case not covered? The live Ask the bureau answers it and turns it into a public FAQ.