Mullvad: a sixteen digit number is the whole account

The best identity model I have ever paid money for arrived as a sixteen digit number and nothing else. No email address, no password, no name, no recovery question about my first pet. You generate the account in a browser tab, you write the number down, you top it up, and that is the entire relationship between Mullvad and whoever you are. It's €5 a month, flat, and it has been flat since 2009, which at today's rates is about $5.62 and about half of what most VPNs charge after their intro price doubles.

I've had the same account for four years. This post is what a VPN actually does for you, what this one does differently, and the honest list of reasons mine would annoy you.

the part everyone gets wrong

A VPN moves trust. It does not remove it. When the tunnel is up, your traffic hides from your ISP and every website sees Mullvad's IP instead of yours, and in exchange every byte of that traffic now transits a Swedish company that could, under Swedish law, see connection metadata if they kept it. The whole product rests on them not keeping it, and on the infrastructure being built so that they mostly can't.

What a VPN does not do is make you anonymous. Your browser fingerprint, your logged-in sessions, your fonts, and your behavior all identify you to ad networks with or without a VPN. Attackers do not care about your IP either; they care about your credentials. I've watched people buy a VPN, feel invincible, and then reuse the same password everywhere. The tunnel changed nothing about how that story ends.

Here's the thing. The honest use cases are narrow and boring: getting off hostile wifi, hiding your IP from the sites you visit, and keeping your ISP from selling the list of domains you touch. Mullvad is built for exactly those and refuses to pretend at the rest.

the mechanics

The clients are open source and WireGuard only, because they removed OpenVPN support in 2023 rather than maintain two stacks. The servers run from RAM with no disk storage, so a seizure or a reboot leaves less behind than a normal deployment. Accounts are numbers, so there is no email for a phisher to hit with password resets, which quietly deletes an entire class of social engineering. Payment can be cash in an envelope mailed to Gothenburg, Bitcoin, Bitcoin Cash, or Monero, and if you pay with a card like a normal person they accept that too and know as much about you as your bank does.

Two technical features are worth naming. DAITA, their defense against AI-guided traffic analysis, mixes cover traffic into your tunnel so timing analysis gets harder, and it costs some throughput, which is the correct shape for that trade. And their WireGuard implementation supports post-quantum pre-shared keys for the tunnel handshake, which protects recorded traffic against a future machine that can break the current curves. Neither feature appears in the marketing of the VPNs with podcast sponsors.

In September 2023, Swedish police attempted to raid their office and left with nothing, because the design left nothing to take. That same year they pulled about a hundred servers from datacenter providers that were getting legal pressure they couldn't verify. Both events are the best argument for the architecture: when the pressure came, there was simply no data at the pressure point.

where it breaks

No port forwarding. They removed it in 2023 and won't bring it back, so if you need inbound connections through the tunnel, self-hosting something friends reach from outside, Mullvad is the wrong tool.

Streaming is the complaint I hear most, and it's fair: Netflix and its peers flag Mullvad's IP ranges constantly, so the "watch other countries' catalogs" use case is unreliable at best. If that's your reason for a VPN, buy the one that sponsors the podcast, it will be better at it, and I mean no sarcasm there.

Speed varies by server and DAITA shaves more off. Five devices per account, enforced, no family plans. And the account number is a single secret with no recovery path: lose it and the balance is gone, which is exactly like the password managers I keep writing about and exactly as unforgiving.

The deeper limitation is jurisdiction. Mullvad is subject to Swedish law and the Swedish foreign intelligence apparatus is not hypothetical. I'm comfortable with that trade against, say, a US provider subject to FISA, and reasonable people weight it differently than I do.

what to do

1. Write down your actual threat model first. If it's "hotel and airport wifi," most VPNs clear that bar and the cheapest competent one wins.
2. If it's "I don't want my ISP monetizing my browsing," Mullvad's account-number model earns the €5.
3. Pay with Monero or cash if the identity story matters, with a card if it doesn't. Your payment method leaks more than your traffic does.
4. Turn on DAITA where the traffic itself matters more than the speed.
5. Run their leak check with the tunnel both on and off, once, so you know what each state looks like.

My number lives on an index card taped inside my desk drawer, next to a sticky note with an apartment gate code that changed in 2021 and that nobody ever threw away. The card has survived three moves and one coffee spill that took out a receipt and nothing that mattered.

Run the leak test twice. On, then off.