Mullvad VPN: privacy is a universal right

This is the app for Mullvad, a paid VPN service. Two things set it apart. The account: Mullvad’s policy says “we do not ask for any personal information – no username, no password, no email address. Instead, a random account number is generated”. And the price: €5 a month, with no discounts for longer periods, payable even in cash by post. The app itself is open source; the service it connects to is paid, which is why F-Droid marks it “NonFreeNet”.

What it does

• WireGuard connections to Mullvad’s servers in many countries. Mullvad dropped OpenVPN support in January 2026.
• Quantum-resistant tunnels, on by default: “an extra key exchange using a quantum safe algorithm”, which costs about 500 KiB of traffic per new connection.
• DAITA (off by default) “hides patterns in your encrypted VPN traffic” by adding noise and making packets the same size, against traffic analysis.
• Multihop “routes your traffic into one WireGuard server and out another”; by default it is set to automatic, used only when needed.
• Split tunnelling to leave chosen apps outside the VPN, and DNS content blockers for ads, trackers, malware, gambling, adult content and social media, all off by default.
• Anti-censorship options when WireGuard is blocked: UDP over TCP, Shadowsocks and QUIC.
• Kill switch: Mullvad says the app “has a built in kill switch which blocks the Internet if the connection is lost”. For a full lock-down, turn on Android’s Always-on VPN and “Block connections without VPN” for it; Mullvad notes that this also blocks split-tunnelled apps and local network connections.

What it connects to

Nothing until you accept the privacy notice on first start. After that, the app talks to Mullvad’s API (api.mullvad.net) for your account, the server list and version checks; the notice says this “sends the app version and Android system version to Mullvad servers”. While connected, your traffic goes through Mullvad’s servers, except for apps you exclude with split tunnelling and, if you turn on Local network sharing (off by default), traffic to devices on your local network, which the app then lets bypass the tunnel. The app also looks up your apparent location from Mullvad’s own service (am.i.mullvad.net) when you connect and disconnect, to show it in the app. Problem reports with logs are sent only when you write one; Mullvad says logs are “never sent automatically”. Our scan found no trackers.

The permissions it asks for

Mullvad VPN declares 8 permissions. The notable one is query all packages, which the manifest explains: “we need access to all packages to allow the user to select apps for split tunneling”. Starting at boot is used only if you turn on “Connect on device start-up”.

About this file

• This is F-Droid’s build of version 2026.12, compiled from the source code and signed with F-Droid’s key. It is the open-source variant without Google Play billing; Mullvad also publishes its own APK and a Google Play version. Mullvad’s guide warns: “When upgrading from a previous version you must download it from the same place that you made the first installation, or you have to uninstall the currently installed version first.”
• Version 2026.12 itself only fixes empty Arabic and Persian translations.
• The 39.0 MB file runs on ARM and x86, 32- and 64-bit, and needs Android 9 or later.
• The screenshots are Mullvad’s promotional images and show an older version of the interface.
• The app is licensed under the GPL-3.0 or later.

For ad blocking without a VPN subscription, see how to block ads on Android without root.

Flagged by F-Droid:

• NonFreeNet: Relies on or promotes a proprietary network service.

CPU types in this build: arm64-v8a (64-bit ARM, almost every phone since 2017); armeabi-v7a (32-bit ARM, older and budget phones); x86 (32-bit Intel, emulators); x86_64 (64-bit Intel, emulators and Chromebooks).

Versions currently kept in the F-Droid repository. We host and check only the newest one. Full changelog.