Mullvad Browser is a free, open-source (MPL-2.0) desktop browser for Linux, macOS and Windows, built by the Tor Project's engineers and distributed by Mullvad VPN AB (Gothenburg, Sweden; owned by Amagicom AB, which is 100% owned by its two named founders). It is Tor Browser with the Tor network removed: the same anti-fingerprinting stack (uniform fingerprint, letterboxing, permanent private mode, bundled uBlock Origin and NoScript), Firefox telemetry removed, and Mullvad's FAQ states it collects no data and publishes the full list of default outgoing connections. Caveats: it is desktop-only, offers no anonymity without a VPN, checks for updates against Mullvad, uses Mullvad's DNS-over-HTTPS resolver by default so a Mullvad server sees DNS lookups unless changed, and is positioned by Mullvad as a complement to its paid VPN. Mullvad publishes a first-party annual ESR transition audit and has no bug bounty; no independent named-firm audit of the browser itself and no incident involving it were found.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
14 ON FILE
COLLECTION
Mullvad's browser help FAQ answers "What data does the Mullvad Browser collect?" with a single word — "None" — and separately publishes the full list of outgoing connections the browser makes by default: browser update and extension update checks to Mullvad, DNS-over-HTTPS queries to Mullvad, NoScript/uBlock Origin and certificate/domain updates from Mozilla, and uBlock Origin filter-list downloads from various list hosts. No account, sign-in, or telemetry endpoint appears in that list.
Mullvad's product page states that the telemetry Firefox normally collects to improve performance has been removed from Mullvad Browser, that private mode is enabled by default so no cookies are saved between sessions, and that the browser is available only for Linux, macOS and Windows.
Mullvad's About page publishes the full ownership chain: Mullvad VPN AB is owned by parent company Amagicom AB, and both companies are 100% owned by founders Fredrik Strömberg and Daniel Berntsson, who are described as actively involved in the company. The page also lists the team by first name and dates the browser's release to April 2023 in collaboration with the Tor Project.
The Mullvad Browser GitHub README states the browser is developed in a collaboration between Mullvad VPN and the Tor Project, is licensed under the Mozilla Public License v2, is signed by the Tor Browser Developers signing key, and that the source code lives on specific branches/tags and in the Tor Project GitLab (the GitHub main branch holds only the README).
Mullvad's 2023-04-03 launch announcement states the browser is developed by the Tor Project's engineers, is free of charge, open source, and can be used without Mullvad VPN; the product page's FAQ frames the browser's funding plainly — Mullvad earns nothing from it, its income comes from the VPN service, and the browser is a complement to that paid service.
Mullvad's privacy policy identifies the data controller as Mullvad VPN AB, Swedish company registration number 559238-4001, Box 53049, 400 14 Gothenburg, Sweden — a registered company traceable in the Swedish companies register, and subject to complaint to the Swedish Authority for Privacy Protection (IMY).
Mullvad's browser FAQ lists the third parties the browser contacts by default beyond Mullvad itself: Mozilla (for NoScript/uBlock Origin extension updates and certificate and domain updates) and the various hosts of uBlock Origin filter lists. No advertising network, analytics vendor, or data partner appears in the list, and the FAQ states the browser earns Mullvad no money — its income comes from the VPN service.
Mullvad VPN AB's company-wide privacy policy (last updated July 10, 2025) has no browser-specific section — consistent with the browser requiring no account — and states that personal data is shared only with suppliers performing services on Mullvad's behalf (e-mail and payment providers), that no transfer is made to a third country, and that no automated decision-making or profiling takes place.
Mullvad's encrypted-DNS guide states that Mullvad Browser uses the Mullvad DNS service by default (without content blockers). Because the browser has no Tor network, this means that unless the user turns DoH off or is inside a VPN tunnel, every domain lookup is sent to a resolver operated by Mullvad VPN AB — a first-party operator dependency, but not a third-party disclosure.
Mullvad's 14.0 release post (2024-11-19) describes an annual ESR transition audit in which the team reviews Firefox's changelog for changes that could harm Mullvad Browser users' privacy or security and disables problematic patches, with final reports published in the tor-browser-spec repository on the Tor Project GitLab. This is a published first-party review, not an independent third-party audit; no named-firm security audit of Mullvad Browser itself was found in this research (Mullvad's published Cure53, Assured, X41 and NCC audits cover its VPN app, infrastructure and web services).
Mullvad's vulnerability-reporting policy (last updated 2025-09-19) states the company currently has no bug bounty program, accepts PGP-encrypted reports, and commits not to pursue legal action against security researchers who report bugs. No breach, regulatory action, or trust incident involving Mullvad Browser was found in this research.
Privacy Guides lists Mullvad Browser on its Desktop Browsers recommendation page as the option for users focused on strong privacy protections and anti-fingerprinting out of the box, describing it as a version of Tor Browser with the Tor network integrations removed; the same page notes it ships uBlock Origin, NoScript and the Mullvad Browser Extension pre-installed and runs in permanent private browsing mode.
Mullvad's browser FAQ documents further anti-fingerprinting choices and their trade-offs: uBlock Origin and NoScript are bundled and cannot be removed because they are integral to the fingerprinting defence, the time zone is spoofed, letterboxing pads the window size, canvas protection can blur some elements, sessions cannot persist logins, and Google's Safe Browsing ("Deceptive Content and Dangerous Software Protection") is disabled because it is controlled by Google.
The Tor Project's launch post describes Mullvad Browser as Tor Browser without the Tor network: it applies a hide-in-the-crowd approach by giving all users a similar fingerprint, masks fonts, rendered content and several hardware APIs out of the box, enables private mode by default, and blocks third-party trackers and cookies — techniques engineered to defeat tracking rather than perform it.