Proton vs Mullvad. Which is actually anonymous in 2026?

This comparison exists because the question is legitimate. Both are serious. Both have been audited. Both have real track records. The choice between them depends on your threat model, not on which review site gave a higher score.

The fundamental difference

Proton requires an account with an email address. That email can be a Proton Mail address with no real identity attached, but an account exists and is linked to an email. The full review sits in the Proton VPN review for 2026. Audited, tested under Swiss legal pressure, and shipping the obfuscation that matters in restrictive countries. Proton knows that email address.

Mullvad requires nothing. A 16-digit random number, funded anonymously. No email. No name. No linkable identity at any stage. The full picture is in the Mullvad VPN review for 2026. No email, no name, payment by cash. The architecture is the product.

If account creation itself is part of your threat surface, the choice is made before you evaluate any other feature. The exercise that defines that threat surface is in how to build your threat model in twenty minutes. Without that exercise, the comparison is decoration.

Verification: what’s actually been tested

Proton: multiple independent audits published with findings and remediation. Swiss court cases documented in transparency reports. No connection logs handed over because no connection logs exist.

Mullvad: physical police visit to servers in 2023. No data found. Cure53 audits published. Swedish jurisdiction. No connection logs handed over because no connection logs exist.

Both have been tested under real adversarial conditions. Both held. The difference is in the identity layer.

What audits do not test is the long-tail of operational decisions a user makes with the tool. A perfectly audited VPN used on a device that is logged into a personal Google account leaks the user identity at the application layer, not the network layer. The audit covers the network layer. The user covers the rest. Both providers state this clearly in their own documentation. Most users skip both.

Jurisdiction

Proton: Switzerland. Not in the EU, not in 14 Eyes. Requires formal Swiss legal process for any disclosure.

Mullvad: Sweden. In the EU, subject to EU data retention directives, but Swedish courts have historically been protective of privacy. The 2023 police visit is the strongest evidence available for any VPN provider.

The practical question is not which jurisdiction looks better on paper but which adversary you are facing. A US prosecutor with an MLAT request to Switzerland faces a long, formal, often unproductive process. A European agency cooperating with another European agency under EU instruments faces a much shorter path. The right jurisdiction depends on who is asking, not on a generic ranking.

The actual decision framework

Does your threat model include the risk of account creation being traced back to you? If yes: Mullvad.

Do you need a VPN that works in countries with active VPN blocking? If yes: Proton, for the Stealth protocol. Test it before you arrive, not after.

Do you want a single provider for your privacy stack? If yes: Proton. The ecosystem exists. Mullvad is a VPN and nothing else. The VPNs that still work in China, Iran, and Russia documents which providers ship the stealth protocols that survive active blocking.

Is operational anonymity the primary requirement? If yes: Mullvad. Cash by post, 16-digit account number, no email, no identity.

Frequently asked questions

Which is better, Proton VPN or Mullvad?

Neither is categorically better. Proton is better for users who want an ecosystem and need obfuscation for restrictive countries. Mullvad is better for users where account creation anonymity is itself part of the threat model.

Can I pay for Mullvad in cash safely?

Yes. Mullvad accepts cash by post. The user mails their 16-digit account number with the cash payment to a Swedish PO box. No name on the envelope. No return address required. The account number is the only identifier the provider holds, and it is generated locally without any account creation step. For users where the act of payment must not link to identity, this is the only mainstream VPN that supports the workflow.

Does Proton VPN work in China, Iran, or Russia?

Proton ships a Stealth protocol designed to defeat protocol-level VPN blocking. It works in most of the restrictive jurisdictions most of the time. The state of play changes from week to week, and the only reliable way to know is to test from inside the network before depending on it. Mullvad does not ship an equivalent obfuscation by default, which is the main reason it is not recommended for travel into actively-blocking countries.

Are there situations where neither Proton nor Mullvad is the right choice?

Yes. Any threat model where the adversary controls the device or has installed monitoring software at the OS level. A VPN protects what is in transit between the device and the VPN server. It does not protect against keyloggers, screen capture, or compromised endpoints. For those threat profiles the answer is not a different VPN. The answer is to start by treating the device itself as untrusted.

The question isn’t which is better. It’s which threat model you’re protecting against. Proton for the ecosystem. Mullvad for the anonymity.

The choice between Proton and Mullvad is not a ranking. It is a question of which threat surface matters more for the work you do, and that question has a different answer for a journalist in a restrictive country than for an investor with a US discovery process to worry about.

Proton Unlimited is the tool we recommend for encrypted email, VPN and secure storage. It’s what we’d use ourselves.

---

There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.