Mullvad VPN Review Australia 2026
Sourced personal VPN — flat euro prepaid rate, numbered accounts, public audit PDFs
Mullvad is for sale to Australians at a printed €5 per month including VAT, with advertised local city exits, a five-device cap, WireGuard-only apps, and a 14-day money-back window on some website payments. There is no cheaper 2-year teaser and no free plan. A$8.09 is an FX equivalent, not a billed AUD SKU. Australian GST was not printed. Public X41, Cure53 and Assured PDFs were read; they are point-in-time. Advertised Australian servers are not data residency. No independent speed, leak or streaming tests were run.
- Best for
- Australian personal-VPN buyers who can pay in euros or mail cash, want a numbered account without an email, accept a five-device cap, and will read billed euro totals plus dated public audit PDFs rather than a lab test.
- Not ideal for
- Anyone budgeting A$8.09 as a cancellable AUD monthly price, buyers who need confirmed Australian data residency or a printed GST-inclusive checkout, households that need more than five simultaneous devices, users who still need in-app OpenVPN, or organisations that need private-resource access.
SoftwareHQ does not currently have an affiliate arrangement with Mullvad VPN. The review is independent of commercial relationships. Affiliate disclosure
Overview
Mullvad VPN is a personal VPN. Ownership, logging claims and advertised exit locations are recorded separately. An Australian exit IP is not proof of Australian data residency.
Feature highlights
These highlights come from vendor documentation and editorial analysis of public sources. They are not firsthand test results or a claim that every listed capability was exercised in a trial.
- Flat €5/month — the yearly card is not cheaper
On 12 Sep 2026 the 1-month, 1-year and 1-decade cards all printed €5 per month including VAT. A 1-year top-up is €60 (12 × €5), not a discounted teaser. A$8.09 is an FX equivalent of €5, not a cancellable AUD monthly price.
- Numbered account, no email required
Signup generates a random account number. No username, password or email is required on the website. Time is prepaid. Generating an account does not add time and is not a free plan.
- Five devices, not unlimited
Pricing FAQ and terms: one account on up to five devices. A sixth login must log another device out. A router uses one of those five. Not a measured throughput claim.
- Advertised Australian city exits, rented RAM-disk boxes
The public list on 12 Sep 2026 named Adelaide, Brisbane, Melbourne, Perth and Sydney. API: 22 AU WireGuard relays plus one Sydney bridge, all rented, all stboot. That is not Australian account data residency.
- WireGuard only in the current apps
OpenVPN was removed from the desktop app in 2025.14 and OpenVPN servers were due to be taken down by 15 January 2026. Anti-censorship is WireGuard wrapped in QUIC, LWO, Shadowsocks or UDP-over-TCP. This is not an independent speed test.
- Public audit PDFs you can actually open
X41’s 2024 app PDF, Cure53’s 2024 relay PDF, X41’s 2026 API PDF and Assured’s 2026 GotaTun PDF were downloaded and read. They are point-in-time. A no-logs policy is not zero retained payment data.
Ownership and jurisdiction
Legal entity and jurisdiction are not the exit-server map.
- Legal entity
- Mullvad VPN AB
- Jurisdiction
- Sweden
- Parent company
- Amagicom AB (Swedish parent; 100% founder-owned per Mullvad’s trustworthy-VPN page)
- Five Eyes
- No
Terms and privacy: Mullvad VPN AB, reg. no. 559238-4001, PO Box 53049, 400 14 Gothenburg, Sweden. Governing law Sweden; Gothenburg district court / ARN. About and trustworthy-VPN pages: parent Amagicom AB, also incorporated in Sweden. Sweden is not a Five Eyes member. Jurisdiction here is the legal entity, not the exit-server map.
- https://mullvad.net/en/help/terms-service/ · checked 2026-09-12
- https://mullvad.net/en/help/privacy-policy · checked 2026-09-12
- https://mullvad.net/en/about · checked 2026-09-12
- https://mullvad.net/en/vpn/trustworthy-vpn · checked 2026-09-12
Logging and retained data
A vendor no-logs claim is not proof of zero retained account or payment data.
- Logging policy
- Vendor no-logs claim
- Retained service data
- Documented retained service data
No-logging policy: no logging of traffic, DNS requests, connections (including timestamps), IP addresses, user bandwidth, or account activity except the live simultaneous-connection count held in temporary memory. Numbered accounts store an account number and expiry date; WireGuard configs store pubkey and tunnel address.
- numbered account identifier and expiry date
- WireGuard public key and tunnel address when WireGuard is used
- payment records (amount, currency, truncated timestamp; method-specific ids such as Stripe charge id, PayPal transaction id, bank-wire transaction id) retained as required for 14-day refunds and Swedish accounting (up to seven years)
- cash payment token (unused cash tokens stored up to 120 days)
- cryptocurrency receiving address / tx hash (Bitcoin/BCH addresses removed after 20 days; Monero tx_hash kept longer to prevent double-crediting)
- support emails and in-app problem reports (erased after 70 days)
- app version-check counters (app and OS version; not stored as identifying records)
- Nginx access logs without IPs for up to 5 minutes, then aggregated counts
A no-logs claim is not proof of zero retained data. Card, PayPal, Swish and bank-wire payments go through Stripe, PayPal or SEB, which log. Privacy policy: personal data is stored and processed within the EU/EEA. Cash can be sent with no identity; cash is not refundable.
Account data is described as processed in the EU/EEA, not Australia. Live connection limits are enforced in temporary memory on VPN servers talking to a central service. This is not a numeric privacy score.
- https://mullvad.net/en/help/no-logging-data-policy · checked 2026-09-12
- https://mullvad.net/en/help/privacy-policy · checked 2026-09-12
Locations and hosting
Advertised exit countries, physical-versus-virtual evidence, control-plane hosting and account data residency are separate. An Australian exit IP is not Australian data residency.
- Advertised exits
- AU
- Australian exit
- Advertised — not proof of Australian data residency
- Exit location evidence
- Advertised
- Physical vs virtual
- Physical
- Control-plane hosting
- Overseas
- Account data residency
- Unknown
- Legacy data_hosting field
- Unknown
mullvad.net/en/servers and api.mullvad.net/www/relays/all/ on 12 Sep 2026 advertised Australian WireGuard exits in Adelaide, Brisbane, Melbourne, Perth and Sydney (22 WireGuard + 1 Sydney bridge; all rented; all stboot/RAM). Server-list help: dedicated owned or rented machines, no virtual servers or virtual locations, listed city is the physical city. That is vendor documentation, not a site visit. An Australian exit IP is not Australian data residency. Privacy policy: personal data stored and processed in the EU/EEA — not Australia. 563 relays / 50 countries / 91 cities on the same day.
- https://mullvad.net/en/servers · checked 2026-09-12
- https://mullvad.net/en/help/server-list · checked 2026-09-12
- https://api.mullvad.net/www/relays/all/ · checked 2026-09-12
- https://mullvad.net/en/help/privacy-policy · checked 2026-09-12
Per-platform features
Protocol, kill switch and split tunnel are recorded per platform. Missing documentation stays unknown or not tested.
| Platform | Protocols | Kill switch | Split tunnel |
|---|---|---|---|
| Windows | WireGuard, Other | Yes | Yes |
| macOS | WireGuard, Other | Yes | Yes |
| iOS | WireGuard, Other | Yes | No |
| Android | WireGuard, Other | Yes | Yes |
| Linux | WireGuard, Other | Yes | Yes |
Windows: Desktop app (12 Sep 2026): WireGuard only in-app after OpenVPN was removed in 2025.14. Anti-censorship wraps (QUIC, LWO, Shadowsocks, UDP-over-TCP) stored as other. Kill switch always on while connected; optional Lockdown mode also blocks after Disconnect/Quit. Split tunneling exclude-apps. Default tunnel is WireGuardNT; GotaTun is used when DAITA or multihop is on. Not leak-tested.
macOS: WireGuard default (GotaTun). Same anti-censorship wraps as other desktop apps (other). Kill switch always on while connected. Documented early-boot leak: the app cannot start before other apps send traffic. Split tunneling on macOS 13+ only; Safari/WebKit cannot be excluded; Full Disk Access can drop off. Lockdown mode has the same early-boot caveat.
iOS: iOS 17+. WireGuard (wireguard-go; GotaTun planned). On-demand VPN acts as the kill switch while connected; version 2026.2 added Force all apps (includeAllNetworks). Documented Apple caveats: some Apple-service traffic can bypass; pre-connect sockets; cellular-bypass apps; TunnelCrack LocalNet; leaks while switching servers. Split tunneling is documented as not possible on iOS/iPadOS. App Store in-app 30-day time is a separate price (help screenshot €5.49) and is not the website €5 SKU.
Android: WireGuard via GotaTun. Built-in kill switch while connected; Always-on VPN / Block connections without VPN is an Android 8+ system setting (not Android TV). Split tunneling exclude-apps; excluded apps fail if Block connections without VPN is on. Mullvad blog 10 Sep 2026 describes an Android OS keep-alive UDP leak that can bypass Block connections without VPN — that is an OS issue, not a lab test by this site.
Linux: WireGuard (kernel by default; GotaTun when DAITA/multihop). Kill switch via nftables, always on while connected. Split tunneling via the app or mullvad-exclude / CLI. OpenVPN is no longer an in-app protocol.
Device limits and free tier
- Devices
- 5
- Concurrent connections
- 5
- Free tier
- No free tier
- Free-tier data cap
- Unknown
No free plan on mullvad.net. Pricing FAQ: Mullvad does not operate a free VPN. Generating a numbered account does not add time. 14-day money-back is a paid-purchase refund window, not a free tier. Port forwarding is not supported.
Audit register
X41 D-Sec GmbH
White-box penetration test and source-code audit of the Mullvad VPN applications on Linux, macOS, Windows, Android and iOS. Versions named on the public PDF dashboard: Android 2024.8-beta1, iOS 2024.8, Desktop 2024.6. 30 person-days, 23 Oct–28 Nov 2024. Public 39-page PDF dated 10 Dec 2024.
- Report date
- 2024-12-10
- Availability
- Full report published
- Inspection
- Independently inspected
PDF downloaded and read on 12 Sep 2026. Six vulnerabilities (0 critical, 3 high, 2 medium, 1 low) plus three informational notes. Quote: applications appear to have a high security level. Point-in-time client review, not operating-effectiveness evidence after 10 Dec 2024, not a no-logs proof, and not a numeric security score.
Cure53
White-box penetration test and source-code audit of Mullvad WireGuard and OpenVPN relay infrastructure in a staging environment (3–14 Jun 2024). SSH to staging relays plus Ansible. Public 13-page PDF dated 27 Jun 2024.
- Report date
- 2024-06-27
- Availability
- Full report published
- Inspection
- Independently inspected
PDF downloaded and read on 12 Sep 2026. Two vulnerabilities (1 medium, 1 low) plus three info notes; none remote. Quote: no issues found that would compromise VPN traffic anonymity or integrity. Staging servers were virtual on hardware Mullvad owns — not a production-fleet census. OpenVPN relays in this 2024 scope have since been retired. Point-in-time; not a numeric security score.
X41 D-Sec GmbH
White-box source-code audit of the public API and connected services for authentication, device provisioning, payment processing and WireGuard key distribution. 24 person-days, 13–31 Oct 2025. Public redacted 43-page PDF dated 20 Jan 2026.
- Report date
- 2026-01-20
- Availability
- Full report published
- Inspection
- Independently inspected
PDF downloaded and read on 12 Sep 2026. Five vulnerabilities (0 critical/high, 3 medium, 2 low) plus 15 informational notes. Most notable public finding: voucher race that could credit multiple accounts. Four findings redacted as availability issues. This is not a VPN-server no-logs audit and not a numeric security score.
Assured Security Consultants (Johanna Abrahamsson, Emilie Barse, Joachim Strömbergson)
Code review of GotaTun v0.2.0, Mullvad’s userspace WireGuard implementation, 19 Jan–15 Feb 2026. DAITA, the GotaTun CLI and external dependencies were out of scope. Public PDF dated 17 Feb 2026.
- Report date
- 2026-02-17
- Availability
- Full report published
- Inspection
- Independently inspected
PDF downloaded and read on 12 Sep 2026. 0 critical/high/medium, 2 low, 9 notes. Quote: no major vulnerabilities; deviations from the WireGuard spec (session identifiers, padding) were a concern and were patched before publication. GotaTun is the Android tunnel and is used on desktop when DAITA/multihop is on. Point-in-time; not a numeric security score.
When this was checked
Status as of (page snapshot) against a 90-day review target. Checked dates are not updated when the site is rebuilt.
Editorial article date: . That is not proof that pricing, hosting, or compliance was re-checked.
- PricingVerified
Verified — checked 12 September 2026.
AU session. Flat €5/month including VAT for 1 month / 1 year / 1 decade. FX equivalent A$8.09. 1-year billed total recorded as 12×€5=€60; decade 120×€5=€600. Checkout not started.
- HostingUnknown
Unknown — checked date 12 September 2026 is not field-level evidence on its own.
Advertised AU city exits only. Personal data is described as stored and processed in the EU/EEA — not Australia. Unknown is not AU.
Subscription pricing
Prices below are in EUR, not AUD. GST unknown. An effective monthly equivalent is not a cancellable monthly price. Verified — checked 12 September 2026. Source: mullvad.net/pricing.
Pricing page 12 Sep 2026: €5 per month including VAT. Same rate as 1 year and 1 decade. A$8.09 printed as an equivalent of €5, not a billed AUD SKU. Terms: one month equals €5 when purchased directly from mullvad.net; App Store and reseller prices may differ. Prepaid time-bank (subscriptions removed 2022), not an auto-renewing intro. 5 devices. Checkout was not started.
- Introductory billed total
- 5.00 EUR
- Term
- 1 month
- Bonus months
- None
- Effective monthly equivalent
- 5.00 EUR effective monthly equivalent — not a cancellable monthly price
- Renewal
- 5.00 EUR / 1 month
- Month-to-month option
- 5.00 EUR
Checked 2026-09-12
Printed 1-year card is still €5 per month, not a discounted teaser. 12 × €5 = €60 billed for 12 months of prepaid time (hand check 6000/12=500). Paid in full as a top-up, not monthly instalments. After time runs out, another top-up is the same €5/month — there is no higher renewal list. Checkout was not started.
- Introductory billed total
- 60.00 EUR
- Term
- 12 months
- Bonus months
- None
- Effective monthly equivalent
- 5.00 EUR effective monthly equivalent — not a cancellable monthly price
- Renewal
- 60.00 EUR / 12 months
- Month-to-month option
- 5.00 EUR
Checked 2026-09-12
Printed 1-decade card is still €5 per month. 120 × €5 = €600 billed for 120 months of prepaid time (hand check 60000/120=500). Checkout was not started, so this total is the printed monthly rate times ten years, not a receipt. Cryptocurrency is discounted 10% on the pricing FAQ; that is not this listed euro rate.
- Introductory billed total
- 600.00 EUR
- Term
- 120 months
- Bonus months
- None
- Effective monthly equivalent
- 5.00 EUR effective monthly equivalent — not a cancellable monthly price
- Renewal
- 600.00 EUR / 120 months
- Month-to-month option
- 5.00 EUR
Checked 2026-09-12
Compare Mullvad VPN subscription cash outlay
Observed price changes
Recorded when a listed price changed. This is not a complete vendor timeline.
- First AU-locale capture from mullvad.net/en/pricing. Flat €5/month including VAT for 1 month, 1 year and 1 decade. FX equivalents printed including A$8.09. No sales. No free plan. Checkout not started.
Pros & Cons
Pros
- Public pricing grid loaded from Australia on 12 Sep 2026 and printed a single €5/month rate for 1 month, 1 year and 1 decade
- No cheaper long-term teaser: 1-year top-up is 12 × €5 = €60; decade is 120 × €5 = €600
- Numbered account with no email required on the website
- Up to 5 simultaneous devices (vendor pricing FAQ and terms)
- Advertised Australian exits: Adelaide, Brisbane, Melbourne, Perth, Sydney
- Vendor documentation: no virtual locations; AU boxes on the 12 Sep 2026 list are rented RAM-disk (stboot) servers
- WireGuard documented on Windows, macOS, iOS, Android and Linux
- Kill switch documented on those five listed platforms (always on while connected on desktop)
- X41 2024 app, Cure53 2024 relay, X41 2026 API and Assured 2026 GotaTun PDFs were downloaded and read
Cons
- A$8.09 on the pricing page is an FX equivalent of €5, not a billed AUD SKU
- Australian GST is not printed; “Including VAT” is on the euro rate; gst_basis unknown
- No free plan; generating an account does not add time
- Five-device cap; a router consumes one of those five
- 14-day refund excludes cash, cryptocurrency, vouchers and App Store purchases; bank-wire refunds are SEPA/Europe only
- OpenVPN is gone from the current apps; last OpenVPN servers were due down 15 Jan 2026
- iOS has no split tunnel; macOS split tunneling needs 13+ and cannot exclude Safari; Android split tunneling conflicts with Block connections without VPN
- macOS early-boot leak is documented; iOS documents Apple-service bypass and server-switch leaks; Android OS keep-alive UDP leak disclosed 10 Sep 2026
- Support is weekday CET email, not 24/7 and not an Australian phone. No independent speed, leak-test or streaming-unblocking results
How this review was made
Reviews separate vendor documentation, editorial analysis and firsthand records. They are not interchangeable.
- Vendor documentation — Public pages from Mullvad VPN and other sites. Recorded HTTP(S) URLs are listed under Sources. A source URL is a document we recorded, not a claim that every sentence on this page was checked against that URL.
- Editorial analysis — SoftwareHQ's written verdict and scores for Australian buyers. The header score is an editorial assessment, not a user-review average, not a lab result, and not a number derived from how many evidence records exist.
- Firsthand records — This review has no firsthand observation records, trial walkthroughs, or screenshots from a logged-in SoftwareHQ account. Missing tests stay not tested.
This page does not rank products by speed or security from documentation or from evidence count.
Checked by SoftwareHQ Editorial Team. There is no named author profile for this page; attribution stays with the SoftwareHQ editorial team. How we test and the editorial policy for scoring, independence and affiliate rules.
Sources
Public pages recorded when this review was compiled. They are not a checklist that every claim was verified, and they are not evidence of hands-on product testing.
- Mullvad pricing
- Mullvad En
- Mullvad privacy policy
- Mullvad No Logging Data Policy
- Mullvad Terms Service
- Mullvad Refunds
- Mullvad Servers
- Mullvad Server List
- Api All
- Mullvad Why Mullvad Vpn
- Mullvad Using Mullvad Vpn App
- Mullvad Using Mullvad Vpn On Android
- Mullvad Using Mullvad App On Ios
- Mullvad Split Tunneling With The Mullvad App
- Mullvad Why Wireguard
- Mullvad Removing Openvpn From The Mullvad Vpn App
- Mullvad Audits
- Mullvad The Report For The 2024 Security Audit Of The App Is Now Available
- Mullvad New Security Audit Of Account And Payment Services
- Mullvad A Security Audit Of Gotatun Is Now Available
- Mullvad Fourth Infrastructure Audit Completed By Cure53
- Mullvad Policy Brand Rights
- Mullvad about
- Mullvad Trustworthy Vpn
- Mullvad Swedish Legislation
- Mullvad Press
- X41 Dsec X41 Mullvad Audit Public Report 2024 12 10.pdf
- X41 Dsec X41 Mullvad Audit Public Report 2026 01 20.pdf
- Cure53 Pentest Report Mullvad 2024 V1.pdf
- Assured Assured Mullvad Gotatun Code Review 2026.pdf
Mullvad VPN Alternatives
If Mullvad VPN doesn’t quite fit your needs, consider these alternatives for Australian businesses:
- NordVPN — Personal VPN with prepaid intros, advertised AU exits, login-walled audit.
- Surfshark — Unlimited-device VPN with prepaid AUD intros and a public Deloitte report.
- ExpressVPN — USD prepaid VPN, advertised AU exits, inspectable KPMG report.
- Proton VPN — Swiss-jurisdiction VPN with a restricted free plan and public Securitum PDFs.
- IVPN — Gibraltar-registered numbered-account VPN billed in USD, public Cure53 PDFs. From $6/mo.
Buyer guide
Source-based VPN guides for Mullvad VPN: what a VPN encrypts, billed-term cash, free versus paid caps, how intro differs from renewal, how to read audits, how kill switch, split tunnel and protocols vary by OS, and when a consumer exit is the wrong product for company resources. Not a ranking.