The Mullvad Blog

So-called age verification for social media is spreading across the world, framed as an effort to create a safer internet for children. In reality, age verification lays the foundation for a fully government controlled internet. Read more

Our Android app has for the second time passed MASA, a standardized security assessment, conducted by Leviathan Security Group. Read more

On Friday the 15th of May, we became aware of a fingerprinting issue affecting Mullvad users. Read more

A recently discovered bug in Android 16 allows any app to leak traffic outside the VPN tunnel. Read more

A year ago, we wrote about how bugs in Apple's networking stack are preventing the iOS app from being as secure as possible. The bugs are still there, but we have secured our app anyway. Read more

Starting with 16.0a1 alpha release, Mullvad Browser Alpha is based on the Firefox Rapid Release channel rather than the Extended Support Release (ESR). The alpha release is now available on Linux ARM. Read more

In December we wrote about our new WireGuard implementation GotaTun, which is currently used in our Android app. An independent audit by Assured Security Consultants is now available. Read more

As a way to improve the options our users have for payments and transaction fees, we have added new currencies when paying with a credit card! Read more

Late last year X41 D‑Sec GmbH performed a white‑box source‑code audit of the Mullvad payment and account API and its supporting backend services. Read more

2025 has been a year of campaigns, audits and improvements to our suite of obfuscation methods. Read more