Anonymous offshore VPS and dedicated servers in seven jurisdictions — zero personal data, 16-char token auth, 14 crypto rails (BTC, XMR, USDC) and a public agent-purchasable API (MCP, REST, x402-light) for AI clients.
Pros and cons +5 −3
- ✓ 16-digit account number only — no email, name or phone ever collected
- ✓ Monero, Bitcoin, Lightning and cash by mail with a 10 % crypto discount
- ✓ 2023 Swedish police raid produced zero customer data — empirical no-logs proof
- ✓ Full client open-source under GPLv3; continuous audit log public on GitHub
- ✓ DAITA traffic-analysis defence shipped on every platform since October 2024
- ✕ Port forwarding removed in July 2023 — no seed-box or self-host use cases
- ✕ Flat €5/month pricing — no multi-year discount
- ✕ Recurring subscriptions abolished; manual top-ups required
Quick facts
At a glance 10/10
✓
Bitcoin (BTC)
✓
Accepts Monero (XMR)
✓
Cash
✓
Non-custodial
✓
Open source
✓
Tor (.onion) available
✓
Lightning Network
✓
Mobile app
✓
Web app
✓
Available worldwide
Full review
Mullvad is a privacy-first VPN operated by Amagicom AB in Gothenburg, Sweden, live since 2009. It popularised the account-number-only sign-up model years before regulators and mainstream VPNs started paying attention, and in April 2023 it became one of the very few providers whose no-logs policy was stress-tested by an actual police raid — the Swedish NOA left empty-handed because no customer data existed to seize.
How it works
Sign-up produces a random 16-digit account number and nothing else — no email, no name, no phone. Payment options include Monero, Bitcoin, Bitcoin Cash, Lightning, cash by mail, bank wire, cards and PayPal, with a 10 % discount on crypto. In June 2022 Mullvad removed recurring subscriptions entirely: all plans are now pay-as-you-go at a flat €5 / month regardless of commit length, specifically to minimise stored payment metadata.
KYC & privacy
No identifying information is collected at sign-up or at renewal. The no-logs claim has been independently verified multiple times, most recently through a fourth Cure53 infrastructure audit in June 2024 and an Assured AB web-app audit in 2025 that found zero critical, high or medium issues. A continuous audit log is published at github.com/mullvad/mullvadvpn-app/tree/main/audits. Mullvad operates a Tor onion mirror at o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion.
Strengths and limits
The full client is open-source under GPLv3 on GitHub. WireGuard is default; OpenVPN remains supported. DAITA (Defense Against AI-guided Traffic Analysis), launched May 2024 and extended to every platform by October 2024, injects defensive noise to resist correlation attacks — a feature no mainstream competitor ships. The flip side: port forwarding was removed on 1 July 2023 after it triggered blacklists and legal pressure, so seed-box and self-hosted use cases are not supported; the flat tier is also less flexible than IVPN's multiple tiers.
Verdict
At 9.4/10 with KYC rated anonymous (L1), Mullvad is the reference implementation of a privacy VPN. The 2023 police raid provided empirical evidence that a no-logs architecture is not just a policy claim; combined with the open-source stack, the DAITA traffic-analysis defence, the onion mirror and 17 years of operation, it sets the bar that other privacy VPNs are measured against.
Alternatives & related
PR
Proxy4G
Real mobile 4G and 5G proxies across 18 countries and 41 carriers — dedicated or shared, HTTP, HTTPS and SOCKS5 — crypto-only checkout with a single email field and no KYC.
Virtual phone numbers for SMS verification AND long-term rental — 190+ countries × 1000+ services, seed-phrase auth, 14 crypto rails (BTC, XMR, USDC...) and a public agent-purchasable API (MCP, REST) for AI clients.
Gibraltar-based VPN with anonymous account numbers — no email, no KYC — accepting Monero, Bitcoin and cash by mail, with six consecutive Cure53 no-logs audits and fully open-source apps.
XM
XmrBazaar
Peer-to-peer Monero marketplace for goods and services — non-custodial with optional 2-of-3 multisig escrow, no email or ID required, born out of the Monero Talk podcast community.
Free disposable email addresses on three shared domains, readable in the browser or through a keyless REST API and an MCP server for AI agents — no account, no payment, and every message deleted after five days.
Spotted an outdated detail?
Policies change. Help us keep this listing accurate by sending a quick note.