Mullvad VPN

Yet another Android leak enabling malicious apps to send traffic outside the VPN tunnel has recently been discovered.

Read more here: https://mullvad.net/blog/another-way-to-leak-traffic-on-android-has-been-discovered

On November 2nd 2026 our public Encrypted DNS servers will be shut down.

This does not impact customers of our VPN if DNS content blockers are used.

Read more here: https://mullvad.net/blog/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead

We’ve updated the Multihop feature with different modes, to make it more flexible and easier to use.

Read more here: https://mullvad.net/blog/introducing-multihop-modes

We would like to address the recent controversy about one of the owners of Mullvad making a donation to a Swedish political party.

https://mullvad.net/blog/donation-controversy

“The instrument (the telescreen, it was called) could be dimmed, but there was no way of shutting it off completely.” George Orwell, Nineteen Eighty-Four.

Two months left before the UK government requires all content on British citizens' mobile devices to be scanned.

Piccadilly Circus, London: Nineteen Eighty-Four was supposed to be a warning, not an instruction manual.

London Underground. VPN restrictions are still on the table in the UK. Much of it depends on the next Prime Minister. Hopefully, that question mark won't turn into a full stop.

Piccadilly Circus. The London Councils didn’t like our campaign against the upcoming state spyware in the UK. So, first the word ”government” was blacked out. Then the whole message was scrapped. On the other side of the road, though: alive and kicking.

Chat Control 1 is back. By a margin of 314-276, the EU Parliament voted to reject the legislation. However, since it was an urgent procedure, an absolute majority of 361 votes was required. As a result, the majority lost and Chat Control 1 passed. The urgent procedure was a dirty tactic by the Council and parts of the Parliament – it’s a procedure not meant to be used for legislation already rejected by the Parliament.

On Thursday, the European Parliament votes on Chat Control 1 (the voluntary scanning, not the mandatory scanning, called Chat Control 2). Again.

The Parliament has already voted against Chat Control 1. Two times. But the Council of Ministers and the Parliament President refuse to accept it.

The President of the European Parliament has sided with the Council against her own chamber. For context, this is the EP President, Roberta Metsola:

https://x.com/EP_President/status/1637823787264618497

Piccadilly Circus, London. Keir Starmer now demands state spyware on every mobile device, always watching the screen, scanning everything, looking for things the government disapproves of.

Some politicians in the UK think it is a good idea to introduce identity verification for using VPN services.

It could be that these politicians do not understand what they are proposing. The alternative, that they do understand, would be even worse.

1/2

So-called age verification for social media is spreading across the world, framed as an effort to create a safer internet for children. In reality, age verification lays the foundation for a fully controlled internet.

The age verification rush must be slowed down, and politicians need to recognize the consequences of different types of legislation and systems.

Read more on https://mullvad.net/blog/age-verification-for-social-media-the-beginning-of-the-end-for-a-free-internet

The EU age verification app is presented as “completely anonymous”. The idea is to use Zero-Knowledge Proof (ZKP) cryptography.

But currently, the EU app does not have ZKP functionality. More importantly, the app is designed to always function without ZKP. Even if fully developed ZKP technology could be implemented in the future, it would remain an optional feature that countries may choose to disable and that the EU could remove at any time.

More details on https://mullvad.net/blog/age-verification-for-social-media-the-beginning-of-the-end-for-a-free-internet

Our Android app has for the second time passed MASA, a standardized security assessment, conducted by Leviathan Security Group.

Read more: https://mullvad.net/blog/2026-security-assessment-of-our-android-app

On Friday the 15th of May, we became aware of a fingerprinting issue affecting Mullvad users.

We have a method which changes this behaviour currently being tested, with plans to begin rolling it out to our VPN servers in the coming weeks.

Read more here: https://mullvad.net/blog/exit-ip-fingerprinting-between-vpn-servers

A new VPN leak that allows any app to leak traffic outside the VPN tunnel has recently been discovered by Yusuf (https://x.com/cybaqkebm)

Read more here: https://mullvad.net/blog/any-app-on-recent-android-versions-can-leak-certain-traffic

It’s absurd that American authorities can purchase personal data – that they’re not allowed to gather themselves without a warrant – directly from data brokers. This violates the Fourth Amendment, and it’s time to close the data broker loophole.

Today, the Surveillance Accountability Act was introduced. It requires warrants based on probable cause for all government surveillance and data access.

You can read more about it here: https://www.surveillanceaccountability.com/

Apple's networking stack is preventing the iOS app from being as secure as possible, we have now secured our app to mitigate this despite the rough edges around the update procedure.

Read more here: https://mullvad.net/blog/force-all-app-traffic-into-the-tunnel

This is Senate House in London. When George Orwell wrote 1984, the building served as the model for the headquarters of the Ministry of Truth (the propaganda ministry). The Ministry of Truth decided what was true, for example that 2+2=5. It was responsible for censorship and rewriting history, and it banned the word “free” in the sense of freedom.

Chat Control 1 is dead. Let’s end Chat Control 2.

Members of The European Parliament: stand firm in your position – no mass surveillance whatsoever!

Starting with 16.0a1 alpha release, Mullvad Browser Alpha is based on the Firefox Rapid Release channel rather than the Extended Support Release (ESR). The alpha release is now available on Linux ARM.

Read more here: https://mullvad.net/blog/mullvad-browser-alpha-moves-to-firefox-rapid-release-and-adds-linux-arm-support

The only way we want our ads to come down. When people take them home.

a) Keep them. b) Send them to Ashton Kutcher. c) Put them outside 10 Downing Street.

Looking to be a star on CCTV?

Mass surveillance and censorship are escalating in many countries right now. There is a global attack on secure encrypted communication. Often, authorities, politicians, and tech companies work together to push for new laws. One example: when Ashton Kutcher (yes, the actor), through his tech company Thorn, tried to introduce total surveillance of all EU citizens through undemocratic and corrupt methods.

Our WireGuard implementation, GotaTun was recently audited by Assured Security Consultants. Two identified low severity issues were fixed prior to the completion of the audit.

No major vulnerabilities were found.

Read more here: https://mullvad.net/blog/a-security-audit-of-gotatun-is-now-available

That's the spirit.

Hear, hear. NO MORE AND THEN!

What do you do when you get banned on British TV?

The Mullvad night shift at work. Stay tuned.

Amazing, this one is up. For now.

Today, the final negotiations on Chat Control 2.0 begin.

We hope the European Parliament stands firm against any wording that paves the way for mass surveillance and censorship. Cyprus, currently holding the Presidency of the Council of the EU, aims to conclude the negotiations by June.

A reminder of the corrupt backstory behind the Chat Control proposal and the involvement of Ashton Kutcher and his company Thorn: https://mullvad.net/why-privacy-matters/going-dark

Today, we hit the streets with a major "And Then?" campaign in the UK, despite having faced strong opposition.

First, our TV ad "And Then?" was banned on British television.

And then, the outdoor ad campaign meant to criticise the TV ban was largely halted.

Here, you can watch the banned ads and explore the entire campaign.

https://mullvad.net/and-then/uk

God save the Mullvad ads. This one got banned too, by The City of London.

Mullvad was banned on British TV. And then? And then this underground ad got banned by the government body Transport For London.

The argument was clear: you cannot encourage people to engage with a banned TV commercial.