Is Mullvad VPN Safe to Use? Logs, Audits & Trust Gaps in 2026

Quick verdict

Yes, I still consider Mullvad VPN safe for most privacy-focused users. I put it near the top of the market for data minimisation because you can create an account without an email address, its no-logging policy is unusually specific, all of its VPN servers run from RAM, and it has a long record of publishing independent security work.

I would not turn that into a promise of anonymity. A VPN cannot stop browser fingerprinting, logged-in accounts, malware or poor operational security, and mobile operating systems can create their own leak paths. Mullvad also disclosed an exit-IP fingerprinting issue in May 2026. It did not reveal home IP addresses, but it could make separate Mullvad server sessions easier to link for some users.

For streaming results, speed testing and day-to-day usability, read our full Mullvad VPN review. This page stays focused on safety, logging, audits, leaks and trust.

Mullvad trust scorecard

When I ask whether Mullvad is safe, I split the question into logging, account data, infrastructure, platform leaks and independent verification. That gives a more useful answer than treating “safe” as one yes-or-no marketing label.

Trust area	Status	What it means for users
Legitimacy	Strong	Mullvad VPN AB is a real Swedish company, owned by Amagicom AB, with the founders publicly named by Mullvad.
No-log position	Strong	Mullvad says it stores no activity logs and uses numbered accounts instead of email-based accounts.
Independent checks	Very good	Recent audits cover infrastructure, apps, account/payment services, Android security and GotaTun; the latest audit post I found is the June 2026 Android MASA assessment.
Payment anonymity	Depends how you pay	Cash and some crypto routes are more private. Card, PayPal, Swish and bank wire are not anonymous payment methods.
Leak protection	Strong, with caveats	The desktop kill switch is always active while connected, but iOS and Android still have platform-specific leak caveats that the VPN app cannot completely control.
Anonymity	Not guaranteed	Mullvad helps privacy, but browser fingerprinting, logged-in accounts and behaviour patterns can still identify you.

Does Mullvad keep logs?

Mullvad’s account model is still one of the main reasons I trust it more than most consumer VPNs. You do not need a username, password, phone number or email address to create a standard account. Mullvad generates a numbered account, and its current no-logging policy says the core account record is the account number plus the time remaining.

I checked the no-logging policy again for this update; Mullvad last updated it on 17 June 2026. It says the service keeps no activity logs of any kind, while documenting the limited account, payment, support and WireGuard configuration data it does process. I prefer that level of detail to a vague “zero logs” badge with no explanation behind it.

Not requiredNo email, username or password is needed to create a standard Mullvad account.

Stored account basicsAccount number and account expiry time are the core account fields.

WireGuard dataWireGuard use involves a public key and tunnel address linked to the numbered account.

The distinction is important: Mullvad can run the VPN account without asking who you are, but that does not make every interaction anonymous. Payment providers, app stores, support emails and problem reports can still create personal data outside the basic numbered-account record.

Payment privacy is good, not automatic

Mullvad gives you unusually good control over payment privacy, but the method you choose matters more than the VPN logo. Mailing cash gives Mullvad very little useful payment data. Cryptocurrency can also reduce the information shared with conventional payment processors; Mullvad also accepts Bitcoin Lightning, which avoids putting the payment itself on the Bitcoin blockchain. None of that automatically makes a badly handled wallet anonymous.

Card, PayPal, Swish and bank-wire payments are different. Mullvad’s policy explains that payment providers can retain personal transaction records and that Swedish accounting requirements apply to some payment data. That is why I would not describe a card-funded Mullvad account as anonymous just because the VPN login itself has no email address.

My read: the account model is privacy-friendly, but your bank, card issuer or payment provider can still know that you paid Mullvad unless you deliberately choose a more private route.

Is Mullvad’s Swedish jurisdiction a problem?

Mullvad is based in Sweden. I do not score a VPN up or down simply because somebody can put its country inside a “14 Eyes” graphic. What matters more is whether the law requires the provider to retain VPN traffic or can force it to begin logging users.

Mullvad says Swedish law does not require VPN providers to log customer traffic and says it would stop operating in an affected jurisdiction rather than become a surveillance tool if the legal position changed. I treat that as a company position rather than a magic jurisdiction guarantee, but it is more useful than simply advertising the country as “privacy friendly”.

The 2023 police visit is still the best real-world check on that position. According to Mullvad, Swedish officers arrived at its Gothenburg office with a search warrant and intended to seize computers containing customer data, but left without taking equipment because the requested customer data was not there.

Audit history: why I give Mullvad credit

I do not treat an audit as permanent proof that a VPN is safe, but Mullvad has done more than commission one report and forget about it. Its published audit trail covers infrastructure, supported apps, account and payment services, the Android app and GotaTun, its Rust-based WireGuard implementation.

Audit or check	Date	Why it matters
Android MASA assessment by Leviathan	June 2026	Mullvad’s Android app passed the standardised MASA mobile security assessment for the second time after minor issues were addressed.
GotaTun audit by Assured	March 2026	Checked Mullvad’s Rust-based WireGuard implementation used in Android. No major vulnerabilities were found.
Account and payment services audit by X41	January 2026	Covered authentication, device provisioning, payments and WireGuard key distribution. Mullvad said no finding weakened its privacy guarantees.
App audit by X41	November 2024	A third-party audit of supported Mullvad apps found a high security level, with non-critical issues addressed where possible.
Fourth infrastructure audit by Cure53	June 2024	Looked at OpenVPN/WireGuard server infrastructure and privacy-impacting issues in a staging environment configured like production.

These are point-in-time checks, not a blanket guarantee. I still give Mullvad credit for the repetition and the breadth of the work, especially because the January 2026 account/payment audit reported real low- and medium-severity findings instead of reading like a marketing certificate.

WireGuard, encryption and key management

Mullvad is now a WireGuard-only VPN. OpenVPN support ended on 15 January 2026 on both the app and server side, so I would ignore older Mullvad guides that still tell you to choose between the two protocols.

WireGuard uses a modern cryptographic suite including ChaCha20 encryption with Poly1305 authentication, Curve25519, BLAKE2s and HKDF. I have no concern with that cryptographic baseline; the more interesting security questions are Mullvad’s key handling, leak controls and the code around the protocol.

Key management also matters. Mullvad documents automatic WireGuard key rotation in its app materials, and its CLI help shows a default key rotation interval of 720 hours, or 30 days. Rotation is not the same thing as making you anonymous, but it does reduce how long a given key remains stable. For the wider concept, see our guide to perfect forward secrecy.

My read: dropping OpenVPN reduces legacy protocol surface and makes the current product easier to reason about, but it also means old router and third-party OpenVPN setups have to migrate.

Kill switch and leak protection

On desktop, Mullvad’s built-in kill switch is always active once the VPN is connected. That is the behaviour I want from a privacy-first VPN: if the tunnel fails, traffic should stop rather than quietly fall back to the normal network.

Mullvad also exposes the sort of controls I expect from a technical privacy service: DNS settings and warnings, split tunnelling, multihop, DAITA, obfuscation and Lockdown mode. The desktop design is clearly built around avoiding accidental traffic exposure rather than just making the connect button look simple.

Mobile is more complicated because the operating system controls part of the networking stack. On iOS, Mullvad added a “Force all apps” option in version 2026.2 to push more traffic through the tunnel, but its own documentation still explains update-related leakage and Apple networking limitations. On Android, Mullvad has also warned about platform-level DNS and connectivity-check leaks.

There is a more serious Android 16 caveat. Mullvad publicised a platform bug in May 2026 that can let a malicious app send traffic outside the VPN tunnel — exposing the real IP address — even with Android’s “Always-On VPN” and “Block connections without VPN” enabled. This affects VPN apps generally rather than being a Mullvad-specific flaw, but I would still count it in the safety advice for Android users.

The 2026 fingerprinting caveat

The main Mullvad-specific privacy caveat I would still mention is the exit-IP fingerprinting issue disclosed in May 2026. It could let a website make a stronger-than-normal guess that the same Mullvad user had moved from one VPN server to another.

According to Mullvad, this did not reveal the user’s identity or home IP address. The risk was linkability between VPN sessions. That is minor for someone who simply wants ISP privacy, but it matters much more if you deliberately change VPN servers to separate activities that you do not want linked.

Mullvad advised users with that threat model to log out and back into the app before changing servers, which regenerates the WireGuard key and internal IP. The mitigation rollout has moved on substantially since my July check: Mullvad’s tracker was updated on 28 August 2026 and showed 518 of 559 online servers, or 92%, with the new exit-IP mitigation applied.

My read: I count the original issue against Mullvad for users with a strong anti-linkability threat model, but I also give the company credit for publishing the mechanism and a live mitigation tracker. At 92% rollout, it is much less concerning than it was in June, although I would not call it fully closed until the remaining servers are covered.

Who should trust Mullvad?

I would choose it forPrivacy-first use, basic journalistic digital hygiene, avoiding email-based VPN accounts, and situations where independent scrutiny matters more than streaming extras.

Also fine forEveryday banking, public Wi-Fi, ISP privacy, travel browsing and general anti-tracking, provided you remember that logged-in websites can still identify you.

I would look elsewhere forStreaming-first use, port forwarding, lots of hand-holding, or any service that claims a VPN alone can deliver total anonymity.

If privacy is the reason I am choosing the VPN, Mullvad remains near the top of my privacy-focused VPN shortlist. I would be less enthusiastic if the main goal were streaming access, port forwarding or an all-in-one security suite.

Mullvad safety FAQs

Is Mullvad VPN legit?

Yes. Mullvad is a legitimate Swedish VPN provider operated by Mullvad VPN AB. Its parent company, Amagicom AB, is described by Mullvad as being 100% owned by founders Fredrik Strömberg and Daniel Berntsson.

Does Mullvad keep activity logs?

Mullvad says it does not keep activity logs. Its account system is built around a numbered account rather than an email address, but it still processes limited data for payments, support, app-store purchases and WireGuard configuration.

Does Mullvad make you anonymous?

No VPN can honestly promise total anonymity. Mullvad reduces the amount of personal data attached to your VPN account, but browser fingerprinting, logged-in websites, repeated behaviour and device settings can still identify or link you. For the recent session-linkability caveat, read our explainer on Mullvad’s browser fingerprinting issue.

Can Mullvad leak your real IP address?

The desktop kill switch is designed to block traffic if the VPN connection fails, and Mullvad routes DNS through the tunnel by default. The 2026 exit-IP fingerprinting issue was not a home-IP leak. Android 16 is a separate platform caveat: a malicious app can potentially bypass the VPN and expose the real IP, so I would keep Android fully patched and pay attention to Mullvad’s known-issues guidance.

Is Mullvad safe for banking?

Yes, Mullvad is safe enough for normal banking privacy on public Wi-Fi or untrusted networks. The bigger issue is that some banks may challenge VPN logins or block shared VPN IP addresses. That is an account-access problem, not proof that the VPN tunnel is unsafe.

Is Mullvad still good after removing OpenVPN?

For most users, yes. Mullvad now focuses on WireGuard, which is fast, modern and easier to audit than older protocol stacks. The downside is compatibility: old OpenVPN router setups and third-party OpenVPN configurations need replacing.

Does Mullvad support port forwarding?

No. Mullvad removed support for forwarded ports in 2023. That does not make the VPN unsafe, but it does make Mullvad less attractive for users who need inbound connectivity, seeding performance or self-hosted services through the VPN.

Sources checked

I rechecked Mullvad’s current policies, audit archive, server documentation and 2026 security disclosures on 3 September 2026. The biggest change since July is that the exit-IP fingerprinting mitigation has reached 92% of online servers; I also added Mullvad’s Android 16 platform-leak warning.

Final safety verdict

I still find Mullvad one of the easier VPNs to trust. The numbered account model, repeated audits, detailed no-logging policy, Swedish legal position, 2023 search-warrant outcome and the fact that all Mullvad VPN servers run from RAM with no persistent storage give the safety case more substance than most providers offer.

I still have caveats. Payment privacy depends on how you pay, OpenVPN and port forwarding are gone, Android and iOS have platform-specific leak behaviour, and the exit-IP fingerprinting issue is not yet at 100% mitigation across online servers. None of that changes my 9/10 score. My conclusion is narrower than “Mullvad makes you anonymous”: I consider Mullvad a very safe VPN for privacy-conscious users who understand the limits of the tool.