Mullvad VPN’s exit IPs are not randomized per session; they are deterministically assigned based on your WireGuard key. This key rotates every 1 to 30 days, meaning your perceived public IP address can remain stable for weeks. This behavior creates a potential vector for cross-session user identification and fingerprinting, a significant limitation for those relying on the service for robust anonymity.
TL;DR
- Deterministic IP Assignment: Your Mullvad exit IP is derived from your public WireGuard key.
- Limited Key Rotation: Keys refresh every 1–30 days, creating a multi-day correlation window.
- Third-Party Clients Worsen Risk: Some WireGuard clients may not rotate keys at all.
- Not Session-Based: IPs don’t change per connection, unlike more privacy-preserving VPNs.
- Manual Server Switch Doesn’t Help: Overriding a server IP does not change your deterministic exit IP.
- Core Privacy Risk: Persistent exit IPs can be used to fingerprint and track users over time.
Key takeaways
- Mullvad’s deterministic exit IP assignment creates predictable, stable identifiers for days or weeks.
- This architecture allows for potential user fingerprinting and cross-session tracking by websites or services that log IP addresses.
- To mitigate risk, use Mullvad’s official client and reconnect frequently to force key rotation.
- For high-stakes anonymity, consider VPNs that offer true session-based IP rotation.
What are exit IPs and why do they matter?
Your exit IP is the public-facing internet address that websites and online services see when you connect through a VPN. In an ideal privacy model, this address should change frequently and unpredictably to prevent any single entity from linking different browsing sessions—or your overall online footprint—back to you. Mullvad VPN has cultivated a strong reputation for technical privacy, but its handling of exit IPs presents a deviation from the expectations of many users seeking robust anonymity.
Why this matters right now
This is not a theoretical concern. As of mid-2026, active technical discussions are unfolding on platforms like Hacker News and privacy forums, scrutinizing Mullvad’s architectural decisions. Users and security researchers are raising concrete concerns that could influence operational security for journalists, researchers, and anyone in adversarial environments. If you depend on a VPN for sensitive tasks, understanding this behavior is critical to evaluating your true risk exposure.
How Mullvad’s exit IP assignment works
Mullvad uses the WireGuard protocol, which relies on cryptographic keypairs for authentication.
The core issue is deterministic assignment: your permanent exit IP is algorithmically derived from your public WireGuard key. Same key, same IP.
- Key-Based Assignment: Your public WireGuard key hashes to a specific, consistent exit IP address from Mullvad’s pool.
- Infrequent Rotation: Keys typically rotate on a schedule ranging from 1 to 30 days.
- Third-Party Client Risk: If you use a third-party WireGuard client (common on Linux), it may not implement automatic key rotation, leaving you with a static key—and therefore a static exit IP—indefinitely.
- Server Switching Is Ineffective: Manually selecting a different Mullvad server does not change your deterministic exit IP. Only generating a new WireGuard key triggers a change.
This architecture means your VPN exit point is not ephemeral but a semi-permanent identifier linked directly to your client configuration.
Real-world examples of the risk
Consider scenarios where a stable exit IP undermines operational security:
- Investigative Researchers: A researcher monitoring state-affiliated websites or platforms could be profiled and flagged based on a persistent exit IP appearing across multiple visits.
- Journalists & Sources: Communication over time between a journalist and a source, if conducted via services logging IPs, could be correlated, revealing the connection.
- Everyday Privacy: Services that track users for advertising or analytics can build a profile linked to your Mullvad exit IP over weeks, defeating a core purpose of using a VPN.
These are not edge cases but realistic threats for anyone using a VPN for more than casual geo-spoofing.
How Mullvad compares to other VPNs
| Feature | Mullvad VPN | Ideal Privacy-First Behavior |
|---|---|---|
| Exit IP Randomness | Deterministic (key-based) | Random per session or connection |
| Key / IP Rotation Frequency | Every 1–30 days | Every connection or periodically (e.g., hourly) |
| IP Change on Server Switch | No | Yes |
| Third-Party Client Support | Limited; may disable rotation | Full rotation support maintained |
Many other VPN providers—particularly those using OpenVPN or custom protocols—allocate exit IPs from a shared pool per session, making user-level correlation far more difficult. Mullvad’s deterministic, key-linked approach is an outlier in this context.
What you can do today
If you currently use Mullvad, take these steps to reduce your identification risk:
- Force More Frequent Key Rotation: Use Mullvad’s official desktop or mobile client and manually reconnect frequently to trigger new key generation.
- Avoid Third-Party WireGuard Clients: For standard use, stick to Mullvad’s app to ensure the built-in rotation schedule is active.
- Supplement with Tor for High Sensitivity: For maximum anonymity, consider routing your traffic through the Tor network after connecting to Mullvad.
- Evaluate Alternatives: Investigate VPNs known for aggressive IP rotation, such as IVPN or ProtonVPN, especially if your threat model requires high anonymity.
Costs, ROI, and career upside
Choosing a VPN involves practical trade-offs beyond monthly fees.
- Cost: Premium privacy-focused VPNs typically range from $5–10/month. Mullvad is competitively priced at €5/month.
- ROI: For at-risk users, the return on investment is avoiding profiling, tracking, or exposure—a value that can be immeasurable.
- Career Leverage: Deeply understanding VPN internals, protocol behaviors, and privacy trade-offs is a valuable skill in cybersecurity, threat intelligence, and privacy engineering roles.
Myths vs. Facts
- Myth: “All reputable VPNs hide your IP equally effectively.”
Fact: Exit IP assignment strategies vary wildly. Mullvad’s deterministic method is less private than true session-based rotation used by others. - Myth: “Mullvad provides complete anonymity.”
Fact: No single tool guarantees perfect anonymity. Mullvad’s exit IP strategy is one part of a larger system that includes potential identification risks users must acknowledge. - Myth: “Switching Mullvad servers gives you a new exit IP.”
Fact: It does not. Your exit IP is tied to your WireGuard key, not your chosen server entry point. Only key rotation changes it.
FAQ
How does deterministic IP assignment work technically?
Mullvad’s infrastructure hashes your public WireGuard key to select a specific exit IP from their pool. This algorithm ensures the same key always maps to the same IP until the key is changed.
Can websites really track me with this?
Yes. Any service that logs IP addresses can observe that the same Mullvad exit IP is accessing their site over days or weeks, allowing them to correlate that activity as likely belonging to a single user.
Has Mullvad publicly addressed this behavior?
As of May 2026, Mullvad has not made an official public statement on this specific deterministic assignment mechanism. The understanding comes from community technical analysis and reverse-engineering.
Are other VPNs definitively better for this?
Many competitor VPNs offer per-session or frequent IP rotation, which provides a stronger anonymity guarantee against IP-based correlation. It’s a key differentiator when evaluating services.
Should I immediately stop using Mullvad?
Not necessarily. Mullvad remains a strong VPN with other privacy-positive features (like no logging). However, you must understand this limitation and adjust your usage patterns—or switch services—if your threat model cannot tolerate a stable exit IP.
Glossary
- Exit IP: The public IP address assigned to a user’s traffic as it exits the VPN network, visible to the wider internet.
- WireGuard: A modern, high-performance VPN protocol that uses cryptographic keypairs for authentication and encryption.
- Deterministic: A process where the same input always produces the same output. In this context, a specific WireGuard key always yields the same exit IP.
- Fingerprinting: The technique of identifying or tracking a user or device based on a unique combination of characteristics, such as a persistent IP address, browser settings, or system configurations.
- Key Rotation: The process of periodically generating new cryptographic keys to limit the window of time during which a key (and any associated identifiers) is valid.
References
- tmctmt (2026). Technical analysis of Mullvad’s WireGuard implementation and exit IP assignment.
- Privacy Guides Community Discussion (2026). User testing and discussion on Mullvad exit IP behavior. discuss.privacyguides.net
- Mullvad.net (2026). Official documentation regarding server connections and WireGuard.
- Hacker News Thread (2026). Community discussion on VPN privacy and identification risks. news.ycombinator.com
- WireGuard Protocol Documentation. Official specification and explanation of the WireGuard protocol. wireguard.com
- Electronic Frontier Foundation (EFF). Surveillance Self-Defense: Choosing a VPN. ssd.eff.org
