Mullvad VPN

Name: Mullvad VPN
Author: Mullvad VPN

by Mullvad VPN · GPL-3.0

Mullvad is an open-source commercial virtual private network service based in Sweden.

Record

These URLs are the ones Mullvad VPN declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.

nullsoftmachine scopegithub.com · known platform

nullsoftmachine scopegithub.com · known platform

Run this against the file on disk. If the output does not match the hash below, the file is not what Mullvad VPN published. Delete it.

Windows · PowerShell

Get-FileHash "MullvadVPN-2026.3_x64.exe" -Algorithm SHA256

macOS · Linux

shasum -a 256 "MullvadVPN-2026.3_x64.exe"

Expected output

e335507b948083100b54f8000ef5bb733e3ee959f8df6a573e9404c506cb139a

Version on Homebrew: 2026.3
Download URL: https://cdn.mullvad.net/app/desktop/releases/2026.3/MullvadVPN-2026.3.pkg
SHA-256: 662dc67e42eaa915b594c0e68d3e84927f72f784d5a07c9a84e996ca358bf62c
Install with Homebrew: brew install --cask mullvad-vpn@beta

Signal	Finding	Points
SHA-256 hash published	2 of 2 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built.	30 / 30
Binary provenance	2 on a recognised distribution platformThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for.	29.8 / 35
Served over HTTPS	2 of 2 over HTTPSAn installer fetched over plain HTTP can be modified in transit.	15 / 15
Release recency	last release about 2 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities.	15 / 15
Licence declared	GPL-3.0A declared licence tells you what you are actually allowed to do with the software.	5 / 5

Every version with a published manifest, newest first. Useful when you need an older build for compatibility.

Windows manifest: github.com/microsoft/winget-pkgs/tree/master/manifests/m/MullvadVPN/MullvadVPN/2026.3
macOS cask: formulae.brew.sh/cask/mullvad-vpn@beta