Mullvad was launched in March 2009 by Amagicom AB.[6] Its name is Swedish for mole.
Mullvad began supporting connections via the OpenVPN protocol in 2009.[7] Mullvad was an early adopter and supporter of the WireGuard protocol, announcing the availability of the new VPN protocol in March 2017[8] and making a "generous donation" supporting WireGuard development between July and December 2017.[9]
In September 2018, the cybersecurity firm Cure53 performed a penetration test on Mullvad's macOS, Windows and Linux applications.[10] Seven issues were found which were addressed by Mullvad.[11] Cure53 tested only the applications and supporting functions. No assessment was made on the Mullvad server side and back end. [10]
In October 2019, Mullvad partnered with Mozilla.[12] Mozilla's VPN service, Mozilla VPN, utilizes Mullvad's WireGuard servers.[13][14]
In April 2020, Mullvad partnered with Malwarebytes and provided WireGuard servers for their VPN service, Malwarebytes Privacy.[15]
In May 2022, Mullvad started officially accepting Monero.[16]
On 18 April 2023, Mullvad's head office in Gothenburg was visited by officers from the National Operations Department of the Swedish Police, who had a search warrant to seize computers containing customer data. Mullvad demonstrated that, in accordance with their policies, no such data existed on their systems. After consulting with the prosecutor, the officers left without seizing any equipment or obtaining customer information. Mullvad shared this information in a blog post two days later making the incident public knowledge and mentioning this was the first time their offices had been visited with a search warrant.[17] In a letter sent to Mullvad 9 days after the search the Swedish Police stated they conducted the search at the request of Germany for an ongoing investigation. The investigation involved a blackmail attack that hit several institutions in the state of Mecklenburg-Western Pomerania which uncovered IP addresses that led back to the Mullvad VPN service.[18]
On 29 May 2023 Mullvad announced that they would be removing support for port forwarding, effective on 1 July 2023. This was done due to malicious use from users leading to law enforcement involvement, Mullvad IP addresses getting blacklisted, and hosting providers cancelling their services.[19]
Service
A TechRadar review noted 2019 that "Mullvad's core service is powerful, up-to-date, and absolutely stuffed with high-end technologies."[3] Complementing its use of the open-source OpenVPN and WireGuard protocols, Mullvad includes "industrial strength" encryption (employing AES-256GCM methodology), 4096-bit RSAcertificates with SHA-512 for server authentication, perfect forward secrecy, "multiple layers" of DNS leak protection, IPv6 leak protection and "multiple stealth options" to help bypass government or corporate VPN blocking.[3]
Mullvad provides VPN client applications for computers running under Windows, macOS and Linux operating systems. As of April 2020[update], native iOS and Android Mullvad VPN clients using the WireGuard protocol are available. iOS and Android mobile operating system users can also configure and use built-in VPN clients or the OpenVPN or WireGuard apps to access Mullvad's service.[20]
Privacy
No email address or other identifying information is requested during Mullvad's registration process. Rather, a unique 16-digit account number is anonymously generated for each new user. This account number is henceforth used to log in to the Mullvad service.[21]
To help ensure the privacy of its users, Mullvad accepts the anonymous payment methods of cash and Monero. (Payment for the service can also be made via bank wire transfer, credit card, Bitcoin, Bitcoin Cash, PayPal, Swish, EPS Transfer, Bancontact, iDEAL, Przelewy24, and vouchers sold by multiple resellers.[3][22][23] Payments made via cryptocurrency have a 10% discount.[24] In June 2022, the service announced that it will no longer offer new recurring subscriptions, as this would further reduce the amount of personal information that will have to be stored.[25]
Mullvad does not log VPN users' IP addresses, the VPN IP address used, browsing activity, bandwidth, connections, session duration, timestamps, and DNS requests.[3][21]
Mullvad has many privacy-focused features built into their VPN. The first is multi-hop, which routes all traffic through an additional Mullvad server before it arrives at its destination.[26] The second is the ability to add a quantum-resistant key exchange to the encryption process, making all data encrypted resistant to quantum computer related attacks.[27] Last is the ability to enable "Defense Against AI-guided Traffic Analysis" (DAITA), which ensures all packets are the same size and also inserts random network traffic (significantly increasing bandwidth usage), though this is only enabled on select servers.[28]
While Mullvad has been noted for taking a strong approach to privacy and maintaining good connection speeds, the VPN client setup and interface has been noted as being more onerous and technically involved than some other VPN providers especially on some client platforms.[31] However, a follow-up review by the same source in October 2018 notes, "Mullvad has a much improved, modern Windows client (and one for Mac, too)." A PC World review, also from October 2018, concludes, "With its commitment to privacy, anonymity (as close as you can realistically get online), and performance Mullvad remains our top recommendation for a VPN service."[20]
In November 2018, TechRadar noted Mullvad as one of five VPN providers to answer a set of trustworthiness questions posed by the Center for Democracy and Technology.[32][33] In March 2019, a TechRadar review noted slightly substandard speeds.[22] However, a more recent and more thorough TechRadar review dated June 11, 2019 stated that "speeds are excellent."[3] This is also backed up by a 2024 CNET review that showed 13.5% speed loss in spring 2024 tests.[34] While the latter review notes a shortcoming for mobile users in that Mullvad provided no mobile VPN client apps,[3] there is now a mobile app for both Android and iOS available.
The non-profit Freedom of the Press Foundation, in their "Choosing a VPN" guide, lists Mullvad amongst the five VPNs that meet their recommended settings and features for VPN use as a tool for protecting online activity.[35]
On April 3, 2023, the Mullvad browser was released, built by the Tor Project team and distributed by Mullvad. It has similar safety levels as the Tor Browser, but works independently of the Tor network and is meant to be used with a VPN service instead.[38] The Mullvad browser has been designed to minimize the threat of tracking and fingerprinting.[39][40] It aims to achieve this through several measures:
Private mode is enabled by default. This means that cookies are never saved between sessions, nor are visited pages, forms or search bar entries.
It uses Firefox's 'resist fingerprinting' feature.
So-called 'first-party isolation' is in place, whereby cookies are placed in separate cookie jars so that trackers cannot connect to each other to build a profile of its user.
On 20 June 2023 Mullvad announced their search engine Mullvad Leta. Mullvad Leta uses the Google SearchAPI as a proxy and caches each search. The service is only accessible to paid Mullvad VPN accounts.[42] When a user searches something the service first checks if it has a cache of the search, which can be up to 30 days old, before making a call to the Google search API.[43]
Public DNS
Mullvad also offers public DNS servers, which offer DNS over HTTPS, DNS over TLS, and various content-blocking filters.[44]
