Mullvad VPN review covering the €5 flat rate, 10% Monero discount, June 2026 no-log policy, recent audits, and account setup for privacy-focused users.
Mullvad charges a flat €5 per month including VAT for every subscription length, from one month to a decade. The rate has stayed fixed since the service launched in 2009.
Bitcoin, Bitcoin Cash and Monero each qualify for a 10% discount, bringing the monthly cost to €4.50. Payments can be made by cash mailed to the company, bank wire, credit card, PayPal, Swish or the three cryptocurrencies. Monero transactions are handled through the provider’s self-hosted wallets.
The 14-day money-back guarantee does not cover cash or cryptocurrency payments. Every account supports a maximum of five simultaneous devices.
These rules appear on the current pricing page accessed in October 2026. The fixed euro price and crypto discount remain the clearest advantages for users who value predictable costs and privacy-preserving payment options.
Mullvad updated its no-logging policy on June 17, 2026. The policy states that the service stores none of the following data linked to accounts: traffic contents, DNS requests, connection timestamps, originating IP addresses, or bandwidth usage.
Payment processing follows the same minimal approach. For Monero transactions the service retains only the transaction hash beyond the standard 20-day window, and it does so solely to block duplicate crediting of the same payment.
External audits cover the client applications. X41 D-Sec performed an audit of the Windows app in November 2024. Leviathan conducted a security assessment of the Android app in February 2026. Both reports are referenced directly on the download pages.
The policy document notes an illustrative total of 555,541 numbered accounts at the time of the June 2026 update. These measures apply uniformly regardless of payment method, including Monero, and are published on the official no-logging policy page.
Mullvad generates accounts as random numeric identifiers rather than usernames or email-linked profiles. Users receive only the number after the initial payment and never supply personal details at any stage.
The June 17, 2026 update of the no-logging policy cites an illustrative figure of 555,541 such numbered accounts to demonstrate the scale of this approach.
Each account permits a maximum of five simultaneous device connections. Official client applications for Windows, macOS, Linux, Android, and iOS are published as open-source code on the company repository. External reviews of these clients include a security assessment of the Android app conducted by Leviathan in February 2026 and an app-wide audit performed by X41 D-Sec in November 2024.
Mullvad removed OpenVPN server support earlier in 2026 and now routes all connections exclusively through WireGuard. The move eliminates dual-protocol maintenance and concentrates development on WireGuard's lighter codebase and faster handshake times.
Primary sources contain no published speed tests, packet-loss figures, or server-count data. The pricing page, no-log policy, and Windows download page list only the current app version 2026.5 and reference external audits; they do not disclose throughput retention, latency averages, or geographic server distribution. Independent testers therefore supply the only available performance numbers.
WireGuard's fixed cryptographic suite reduces configuration choices for users while removing older cipher options previously available under OpenVPN. Without official benchmarks, operators must verify real-world behavior on their own hardware and network paths before committing to sustained use.
| Payment Method | Anonymity Level | Refund Policy | Processing Fees | Suitability for Monero Users |
|---|---|---|---|---|
| Cash (mail) | High – mailed notes require no account linkage | No 14-day guarantee | Standard postal costs only | Low – does not involve Monero |
| Bank wire | Medium – bank records can link sender identity | 14-day money-back guarantee | Bank transfer fees apply | Low – no Monero option |
| Credit card | Low – card details tied to personal billing | 14-day money-back guarantee | Card processing fees | Low – no Monero option |
| PayPal | Low – PayPal account required | 14-day money-back guarantee | PayPal fees | Low – no Monero option |
| Swish | Medium – mobile number linked to Swedish bank account | 14-day money-back guarantee | Swish fees | Low – no Monero option |
| Cryptocurrencies (incl. Monero) | High – blockchain transactions only | No 14-day guarantee | 10% discount for lower fees | High – direct Monero support with discount |
Cryptocurrency payments stand out for Monero users because they qualify for the 10% discount on the €5 monthly rate and align with the numbered-account model that stores no personal details. Cash and crypto both forgo the 14-day guarantee, reflecting their irreversible nature. Other methods provide the refund window but require more identifiable information, reducing anonymity even though the service itself maintains numbered accounts.
Generate a numbered account on the Mullvad site, send the exact Monero amount shown to the displayed self-hosted wallet address, then enter the transaction hash on the payment page to credit the account. The service stores the tx_hash longer than 20 days solely to block double-crediting.
The policy updated June 17, 2026 states that Mullvad stores no traffic data, DNS requests, connection timestamps, IP addresses, or bandwidth usage linked to any account. Payment details required for crediting remain the only retained information.
Referenced audits include a February 2026 security assessment of the Android app by Leviathan and a November 2024 audit of the Windows app by X41 D-Sec. No broader service-wide audit dates appear in the published references.
Each numbered account supports a maximum of five simultaneous devices, regardless of payment method chosen.
No. The 14-day money-back guarantee excludes cryptocurrency and cash payments; only card, PayPal, or bank-wire subscriptions qualify for refunds.
Keep the 16-digit account number safe. Mullvad provides no email or password recovery because no personal identifiers are collected; access is restored only by entering that number on the login page.
Only the transaction hash needed to confirm the payment and prevent reuse is kept; no other activity or identity data is linked to the account under the published no-log policy.
