Mullvad
No account, no email, no fuss — and the only provider we've seen survive an actual police raid with nothing to hand over.
Where it holds up
- No account or email required to sign up
- Survived a 2023 Swedish police raid with zero data to hand over
- Flat €5/month pricing, no upsell tiers
- DAITA traffic obfuscation and post-quantum key exchange
Mullvad has run the same flat-rate, no-questions-asked model since 2009: €5 a month, no tiers, no email required, an account number instead of a login. That design choice is also its strongest evidence. In April 2023, Swedish police raided Mullvad’s Gothenburg office with a warrant for customer data. They left with nothing, because nothing existed to seize — an unusually concrete, real-world test of a no-logs claim that most providers can only assert on paper.
Audits and infrastructure
Mullvad has been independently audited multiple times since 2018, most recently by Cure53 (infrastructure, June 2024) and Assured Security Consultants (penetration test, August 2025), which found no critical, high, or medium-severity issues. The company is moving to WireGuard-only, retiring OpenVPN support in January 2026, and has added DAITA (Defense Against AI-guided Traffic Analysis) and post-quantum key exchange — both unusual for a provider this size to ship first.
Where it’s weaker
Speed is the honest trade-off: independent testing puts average speed loss around 24% versus a direct connection, meaningfully behind the fastest mainstream providers. Streaming support is inconsistent — Netflix works on some servers, Disney+ and Amazon Prime Video largely don’t unblock reliably. The server network is also comparatively small, around 600 servers in roughly 49 countries. If your priority is unblocking streaming libraries, look elsewhere on this list. If your priority is not being logged in the first place, Mullvad has more to point to than almost anyone.
The verdict
Recommended, specifically for people who weight privacy and auditability above raw speed or streaming convenience. Sweden has no mandatory data-retention law compelling VPN providers to log traffic, and Mullvad’s business model — flat pricing, anonymous accounts, cash and crypto payment — leaves it with structurally less to log even if compelled.