# Mullvad VPN privacy rating

Flat-priced VPN from Sweden. Accounts are a random number with no email, and payment in cash or Monero is accepted.

**Our pick.** No email, no name and no card needed. A stable, flat price, WireGuard on every platform, fully open-source apps, and repeated public audits of both the apps and the server infrastructure.

## Summary

Mullvad VPN scores 79 out of 100 (grade B) on the VPN providers criteria. It meets 8 of 12 criteria: no trackers or telemetry, no ads or data sales, independent audit, TLS configuration, security headers, anonymous payment, open-source apps and modern protocols. It partly meets open source, transparency report and audited no-logs policy. It does not meet tells users about requests. It is based in Sweden: Fourteen Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://mullvad.net
- Source code: https://github.com/mullvad/mullvadvpn-app
- License: GPL-3.0
- Jurisdiction: Sweden. Fourteen Eyes member. EU member (GDPR).
- Platforms: Windows, macOS, Linux, Android, iOS
- Home page trackers: none found
- Category: [VPN providers](https://privacyratings.com/vpns/)
- Also rated: [Mullvad Browser](https://privacyratings.com/browsers/mullvad-browser/) (Browsers), [Mullvad DNS](https://privacyratings.com/dns-resolvers/mullvad-dns/) (DNS resolvers)
- Grade: B (79/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Partial | All apps are open source under GPL-3.0. Server infrastructure is not fully published. | https://github.com/mullvad/mullvadvpn-app/blob/main/LICENSE.md |
| No trackers or telemetry | Yes | The policy states no usage data is sent to external analytics. The Android app has no known trackers on Exodus. | https://mullvad.net/en/help/no-logging-data-policy |
| No ads or data sales | Yes | One flat monthly price. No ads. | https://mullvad.net/en/pricing |
| Independent audit | Yes | Full public reports are published, including X41 D-Sec on account and payment services and Cure53 on the relay infrastructure. | https://www.x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-Report-2026-01-20.pdf |
| Transparency report | Partial | Explains which Swedish laws allow authorities to request data and what can be disclosed. No request counts are published. | https://mullvad.net/en/help/swedish-legislation |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=mullvad.net&hideResults=on |
| Security headers | Yes | Grade A+ (135/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=mullvad.net |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Audited no-logs policy | Partial | The relay audits that checked for logging are older than three years. The no-logging policy is published. | https://www.assured.se/publications/Assured_Mullvad_relay_server_audit_report_2022.pdf |
| Anonymous payment | Yes | Accounts are a generated number. Cash, Monero and Bitcoin are accepted. | https://mullvad.net/en/pricing |
| Open-source apps | Yes | Apps for every platform are open source under GPL-3.0. | https://github.com/mullvad/mullvadvpn-app |
| Modern protocols | Yes | WireGuard is the default protocol. | https://mullvad.net/en/help/wireguard-and-mullvad-vpn |

Source: https://privacyratings.com/vpns/mullvad-vpn/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/vpns/mullvad-vpn.md