Mullvad Browser

Best for: people who already run a trustworthy VPN and want Tor Browser’s fingerprinting defenses without the Tor network’s latency — and who can live with frequent CAPTCHAs, broken logins, and no DRM video.

Pros

• Ships the Tor Project’s full anti-fingerprinting stack: Firefox’s fingerprint-resistance mode, letterboxing, canvas randomisation, a spoofed UTC timezone, disabled WebGL readback, and a deliberately narrow font set — all aimed at making every user look identical
• Private browsing is the only mode; no history, cache, or cross-session cookies, with third-party cookies isolated in per-domain jars during a session
• Zero telemetry — crash reporting and the update-ping component are stripped out at compile time, not just toggled off
• All DNS goes through Mullvad’s own DNS-over-HTTPS resolver with no fallback, and HTTPS-Only mode is forced in every window
• uBlock Origin and NoScript are built in and can’t be removed; no further extensions are bundled, on the theory that more add-ons make you more identifiable
• Fully open source, with signed builds and updates verified through the NSS library rather than the OS certificate store
• Free, with a stated business model of funding development from the VPN rather than the browser — no ads, no default-search deal, no venture backing

Cons

• Breaks a lot of everyday sites and triggers frequent CAPTCHA/Cloudflare walls — a direct consequence of the anti-fingerprinting design, and the main reason users keep it as a secondary browser
• No persistent logins by design: close the browser and you’re signed out of everything
• No DRM playback — Encrypted Media Extensions are disabled at build time, so Netflix, Spotify Web, and similar services won’t work
• Desktop only — no Android or iOS build, and none planned
• No sync of any kind; Firefox Sync is fully deactivated, so bookmarks and settings don’t move between machines
• English-only interface
• No built-in password manager (an intentional choice, but you’ll need a separate tool)
• WebRTC is left enabled — a difference from Tor Browser that slightly widens the exposure surface

Privacy Defaults

Out of the box, Mullvad Browser runs in permanent private-browsing mode: nothing is written to history or cache, and cookies set during a session are held in memory and dropped when the last window closes. Within a session, third-party cookies are isolated per-domain so a tracker present on two different sites can’t join them up. A one-click reset button wipes the current session without restarting the browser.

Network behaviour is tightly constrained too. Every DNS query goes to Mullvad’s DNS-over-HTTPS resolver with no fallback to the system resolver, HTTPS-Only mode is enforced in all windows, and Google’s “Deceptive Content and Dangerous Software Protection” is switched off specifically because it phones Google. On its own the browser makes only six kinds of outbound request — browser updates, extension updates, NoScript/uBlock filter-list updates, the Mullvad DoH lookups, certificate/OCSP checks, and remote-settings updates — and collects no usage data at all. uBlock Origin and NoScript are bundled and locked in place, with two extra uBlock lists enabled (AdGuard URL Tracking Protection and EasyList Cookie).

The one gap is inherent: the browser does nothing to hide your IP address on its own. Mullvad’s own guidance is to run it alongside a VPN, and without one your ISP and the sites you visit still see where you’re connecting from.

Anti-Fingerprinting

This is the browser’s whole reason to exist, and it inherits the Tor Project’s approach wholesale. Firefox’s fingerprint-resistance mode is on, along with a long list of related tweaks: the timezone is reported as UTC, the reported OS and browser version are pinned to a common value, keyboard layout and language are masked, webcam and microphone capabilities are disguised, and several hardware APIs (WebSpeech, gamepad, sensors, performance) are disabled outright. WebGL pixel readback is blocked because the Tor Project considers it one of the single largest fingerprinting vectors. Canvas reads return randomised data, which is why some pages render slightly blurry — a visible side effect of the protection working.

Window dimensions are handled with letterboxing: the content area is rounded to a multiple of 200×100 pixels and padded with grey margins so that resizing or maximising doesn’t leak a unique size. A “New Identity” button clears all state and starts fresh (though it explicitly does not change your IP — that’s the VPN’s job).

Independent testing backs the design up: EFF’s Cover Your Tracks and PrivacyTests.org report Mullvad Browser returning a non-unique fingerprint at roughly 12 bits of identifying information — close to Tor Browser, and far below what a mainstream browser leaks.

Transparency & Audits

Mullvad Browser is fully open source, built and signed by Mullvad, with updates verified through the NSS crypto library rather than the operating system’s certificate handling. The funding model is stated plainly and repeatedly across Mullvad’s site: development is paid for by the VPN subscription business, the Tor Project is a non-profit, and there is no default-search revenue deal or advertising in the browser.

On formal audits, the picture is one step removed. There is no separately published independent audit of Mullvad Browser itself. What exists is the audit trail of its codebase: Mullvad Browser is Tor Browser minus the Tor network patches, and Tor Browser was audited by Cure53 over 72 days between November 2022 and April 2023, with the full reports published and the two high-severity findings fixed. Mullvad also states that new Firefox features are only pulled into the browser after being reviewed upstream. That’s a reasonable inheritance, but it isn’t the same as a dedicated third-party review of Mullvad’s own modifications, and it’s the main thing keeping this category short of the top.

Usability & Compatibility

The trade-off for the fingerprinting defenses is real friction. Long-term users consistently report that sites break, that CAPTCHA and Cloudflare challenges come up far more often than in a mainstream browser, and that anything needing a persistent login is painful because the browser signs you out on close. DRM video doesn’t play at all — Encrypted Media Extensions are disabled at build time — so streaming services are out. The interface is English-only, there’s no built-in password manager, and Mullvad’s advice is not to install other extensions because each one narrows the crowd you’re hiding in.

Some of this is softened by design touches carried over from Tor Browser: the Security Level control (Standard/Safer/Safest) — implemented through the bundled NoScript extension — lets you dial JavaScript and media down for risky browsing, and the one-click reset is genuinely useful. But the honest framing is that this is a browser most people run alongside a normal one, reaching for it when a session needs to be unlinkable, not as an all-day default.

Cross-Platform & Sync

Builds are available for Windows 10 and later (64-bit only), macOS Sonoma 14 and later, and Linux — the Linux route is a signed Mullvad apt/dnf repository for Ubuntu, Debian, and Fedora, or a manual package, which is a cleaner supply chain than a bare download. There is no Android or iOS build and none is planned, so the browser simply doesn’t exist on mobile.

There is also no sync. Firefox Sync is fully deactivated, so bookmarks, history, and settings don’t move between installs — a deliberate anti-tracking choice, but in practice it means every machine is configured from scratch.

Our Rating

Category	Score
Privacy Defaults	9.5/10
Anti-Fingerprinting	9.5/10
Transparency	8.5/10
Usability & Compatibility	6/10
Cross-Platform & Sync	5.5/10
Overall	8.4/10

Weighted: Privacy Defaults 30% · Anti-Fingerprinting 25% · Transparency 20% · Usability & Compatibility 15% · Cross-Platform & Sync 10%.

Mullvad Browser does one thing and does it about as well as anything short of the Tor Browser: it makes you look like everyone else running it. Paired with a VPN, that’s a serious answer to fingerprinting and cross-site tracking. The cost is a browser that fights you on logins, streaming, and mobile — which is why it earns a high score as a privacy tool and a deliberately modest one on day-to-day usability. Treat it as a second browser for sessions that need to be unlinkable, not a full-time replacement.

Affiliate Disclosure

Mullvad has a written policy against affiliate programs, paid reviews, and paid influencer mentions, and the browser is free besides. This review carries no tracked link and earns PrivacyPick.com nothing — it’s here because it’s a legitimate, heavily scrutinised option built with the Tor Project.

Rating: 8.4/10