Skip to content
NoKYC Score
DirectoryExchangesSwapsBuyRatesIncidentsGuides List a project Sign in

VPNs Since 2009 Reviewed 22 Oct 2026

Mullvad VPN review

Swedish VPN using numbered accounts; accepts cash by post and Monero

  • No account needed
  • Accepts Monero
  • Tor onion address
  • Open source
  • No-logs policy
  • Accepts cash
ID never required KYC 0 Documentation reviewed
Visit mullvad.net Onion address Report an incident Watch

Privacy

9.7/ 10

Excellent

Safety

7.6/ 10

Strong

Based on terms and documentation. No test transactions published yet. See the arithmetic

Mullvad VPN review in short

Mullvad VPN is a VPN operating since 2009. Its terms put it at KYC level 0 of 4: ID never required. NoKYC Score grades it 9.7/10 for privacy (excellent) and 7.6/10 for safety (strong). In its favour: no account needed, no email needed and no phone number. One incident is on record, the latest from 20 May 2026.

Category
VPNs
KYC level
0 of 4: ID never required
Grades
Privacy 9.7/10, Safety 7.6/10
Sign-up
Random account number
Fees
Flat monthly price; 14-day money-back guarantee except for cash payments
Jurisdiction
Sweden
Onion address
Yes
Incidents on record
1
Last reviewed
22 Oct 2026
Cite this review

NoKYC Score, "Mullvad VPN review", reviewed 22 Oct 2026, https://nokycscore.com/service/mullvad

Also available as plain text.

What Mullvad VPN is

Mullvad is a Swedish VPN provider that identifies customers only by a randomly generated account number. Its data policy states that sign-up asks for no username, password or email address. The pricing page lists cash sent by post, Bitcoin, Bitcoin Cash, Monero, bank wire, cards, PayPal and several local methods, and offers a 14-day money-back guarantee except on cash payments. The apps are open source and the company publishes a no-logging policy and an onion address. In May 2026 it disclosed an exit-IP assignment behaviour that could let an observer link sessions across servers, and said a fix was being tested.

What Mullvad VPN offers, and what to watch

11 of 14 privacy and safety features, 0 warnings in its terms.

"Not stated" means its own pages do not say.

Identity

  • ID never required Yes The terms rule identity checks out, or the design makes them impossible.
  • No account needed Yes Usable without creating an account, or the account is only a random number.
  • No email needed Yes An email address is not required to sign up or use it.
  • No phone number Yes A phone number is never required.

Payment

  • Accepts Monero Yes Monero hides sender, receiver and amount, so the payment cannot be traced to you.
  • Accepts Lightning Not stated
  • Accepts cash Yes Cash by post or in person: no bank and no blockchain record.

Access

  • Tor onion address Yes An official .onion address, reachable only through Tor.
  • Works without JavaScript Not stated

Trust

  • Open source Yes The code that matters is public and can be inspected.
  • No-logs policy Yes States that connection or activity logs are not kept.
  • Independent audit Not stated
  • Company named Yes The operating company and its jurisdiction are published.
  • 5+ years operating Yes Has operated continuously for five years or more.

Warnings

  • May ask for ID Not in terms
  • Email required Not in terms
  • Phone number required Not in terms
  • Closed source Not in terms
  • Nobody accountable Not in terms

Does Mullvad VPN require KYC?

  1. 0
  2. 1
  3. 2
  4. 3
  5. 4

KYC level 0: ID never required. The terms rule out identity checks, or the design makes them impossible.

Data policy states no username, password or email is requested; a random account number is the only identifier.

Read the terms we assessed ↗

How the grades add up

Both grades start at 50 points and move by fixed, published amounts. Nothing is adjusted by hand. The total is divided by ten.

Privacy

9.7
  • Starting points 50
  • KYC level 0: ID never required +20
  • No email needed +3
  • No phone needed +1
  • Account-number login +5
  • Tor onion service +4
  • Accepts Monero +4
  • Accepts cash +4
  • Open source +2
  • No-logs policy +2
  • Refund without ID +2
  • Total, clamped to 0–100 97

Safety

7.6
  • Starting points 50
  • Open source +8
  • 5+ years operating +10
  • Legal entity disclosed +5
  • Refund without ID +6
  • Disclosed exit-IP assignment behaviour that could link sessions across servers low · unknown · 156 days ago -3
  • Total, clamped to 0–100 76

Test ledger

Real transactions run by our editors. A badge without a ledger is an assertion; this is the proof.

No test transactions published yet

The grades above rest on Mullvad VPN’s terms and documentation. Tests will appear here with the date, route, amount band and result as they are run.

Incidents on record

low

Other

Disclosed exit-IP assignment behaviour that could link sessions across servers

Mullvad disclosed that it became aware on 15 May 2026 of a fingerprinting issue: a client reconnecting through a different server was likely to receive an exit address at the same relative position in that server's range, which could let an observer infer that the same user had moved between servers. The company said this does not reveal a user's identity and that a change in behaviour was being tested for rollout in the following weeks.

Outcome unknown Source: mullvad.net ↗

User reviews

Reviews never change a grade. Reviews with a transaction reference are marked.

No reviews yet.

Write a review

Create an account to write a review. It takes ten seconds and needs no email: you get a random key and a random name. Already have a key? Sign in.

Alternatives to Mullvad VPN

All alternatives →

Windscribe

Canadian VPN with open-source apps, a free tier and crypto payment

Privacy 6.8
Safety 8.1
Not mentioned KYC 1 Docs reviewed

AzireVPN

Swedish-founded VPN with no-email sign-up; now card and PayPal payment only

Privacy 7.2
Safety 7.4
Not mentioned KYC 1 Docs reviewed

Proton VPN

Swiss VPN with a free tier; paid plans payable in Bitcoin or cash

Privacy 6.4
Safety 7.3
Not mentioned KYC 1 Docs reviewed

IVPN

VPN with generated account IDs, no email, and cash, Monero or Bitcoin payment

Privacy 9.4
Safety 7.2
Never KYC 0 Docs reviewed

Mullvad VPN vs WindscribeMullvad VPN vs AzireVPNMullvad VPN vs Proton VPNMullvad VPN vs IVPN

Mullvad VPN: common questions

Does Mullvad VPN require KYC?

Mullvad VPN is rated KYC level 0 of 4 on this site: ID never required. Data policy states no username, password or email is requested; a random account number is the only identifier.

Is Mullvad VPN safe to use?

Mullvad VPN has a Safety grade of 7.6 out of 10 and a Privacy grade of 9.7 out of 10. There is 1 incident on record, listed with sources on this page. Evidence level: documentation reviewed.

Is Mullvad VPN legit?

Mullvad VPN is a working VPN that has operated since 2009. It publishes the company that runs it, in Sweden. Being real is not the same as being safe: its Safety grade here is 7.6 out of 10, built from custody, liquidity, track record and incidents.

Is Mullvad VPN a scam?

NoKYC Score does not label services as scams; it records documented incidents with their sources and outcomes. Mullvad VPN has 1 incident on record, 1 not resolved, the latest: "Disclosed exit-IP assignment behaviour that could link sessions across servers". Each is listed on this page with its source.

Do I need an account or email to use Mullvad VPN?

Random account number.

What fees does Mullvad VPN charge?

Flat monthly price; 14-day money-back guarantee except for cash payments. Fees were recorded from Mullvad VPN's own pages and can change; check before you send.

Does Mullvad VPN have a Tor onion address?

Yes. Mullvad VPN publishes an official onion address, shown on this page. Open it in Tor Browser.

Which cryptocurrencies does Mullvad VPN support?

Mullvad VPN supports BTC, BCH, XMR, and fiat payments in EUR, USD, SEK.

Can I use Mullvad VPN over Tor?

Yes. Mullvad VPN publishes an official onion address, shown on this page.

Listing history

  • Listing added. Facts and KYC level set from the service's own terms and documentation.
  • Incident recorded: Disclosed exit-IP assignment behaviour that could link sessions across servers