Disclosure: VPNFin is reader-supported. If you buy a VPN through links on this page, we may earn a commission at no extra cost to you. This never affects our ratings — here’s our full disclosure.
Mullvad WireGuard is now the whole service: Mullvad removed OpenVPN on 15 January 2026 and runs only WireGuard. Its apps build on it with DAITA against traffic analysis, multihop, quantum-resistant tunnels and obfuscation for blocked networks, and a new Rust engine, GotaTun, reached Android first and was due on desktop and iOS during 2026, Tom’s Guide reported. You can also use plain WireGuard files from Mullvad’s configuration generator.
This guide covers the app’s WireGuard features, obfuscation, the configuration generator, settings worth knowing and limits.
WireGuard Only Since January 2026
Mullvad first announced the end of OpenVPN in November 2024 and removed it from servers and apps on 15 January 2026, its blog records. It had explained its focus on WireGuard as far back as 2017.
Its newest features, DAITA, multihop and quantum-resistant tunnels, all run only over WireGuard. Routers and third-party clients that relied on OpenVPN had to switch. Our Mullvad OpenVPN guide covers the transition.
GotaTun, the New Engine
Mullvad previously used wireguard-go and maintained its own fork of it for multihop and DAITA, Tom’s Guide reported. On Android, over 85% of app crashes reported through Google Play came from wireguard-go.
GotaTun, written in Rust, replaced it on Android first, with desktop and iOS due in 2026. Users should notice fewer crashes and better performance rather than any new setting to change. Updates arrive through the usual app channels.
DAITA, Multihop and Quantum Resistance
DAITA adds noise and padding to resist AI-guided traffic analysis. Multihop routes through an entry and an exit server; new multihop modes, When needed and Always, arrived on iOS first in 2026. Quantum-resistant tunnels add a post-quantum key exchange, on by default on Android since 2025, Mullvad’s changelog shows.
Each adds some overhead and battery use, Mullvad’s Android guide notes. Our post-quantum VPN guide explains the key exchange.
Getting Past Blocked Networks
Because WireGuard alone is easy to spot, Mullvad wraps it for restrictive networks. It added QUIC obfuscation on desktop in September 2025 and on mobile in October, and LWO for desktop and Android in November 2025, alternativeto reported. Shadowsocks and UDP-over-TCP are options too.
Try obfuscation only when a network blocks the plain connection, since each layer adds overhead. The app’s anti-censorship settings let you pick a method or leave it automatic. Our obfuscation guide explains how these methods differ.
Plain WireGuard Configurations
Mullvad’s configuration generator creates WireGuard files for routers and third-party apps: sign in, generate a key for the device and choose a location. Each key uses one of your five device slots.
Plain configurations lack DAITA, multihop modes and the app’s obfuscation, so use them only where the app cannot run, such as routers and the Steam Deck. Our Mullvad router guide walks through a router setup.
Keys and Devices
Each device or router uses one WireGuard key, and an account allows five at a time. Remove keys for devices you no longer use in your account page before adding new ones. The app manages its own key, so you rarely touch it.
A router counts as one key but covers every device behind it, which helps households. Our Mullvad cost guide covers what one account buys.
Speed and Battery
WireGuard is efficient: TheBestVPN’s 2026 test found it used about 2% of battery over two hours of streaming, against about 7% for OpenVPN over TCP. Mullvad’s switch to WireGuard only removed the slower option.
Extra layers such as DAITA and quantum-resistant tunnels cost some of that efficiency back, Mullvad’s Android guide warns, so turn them on where they matter most.
Settings Worth Knowing
Mullvad’s app uses an MTU of 1380 by default and tests it when connecting, its guide says; if a connection stops working, set it to 1280. DNS content blockers filter adverts, trackers and malware inside the tunnel.
On Android, Mullvad’s kill switch relies on the system’s Always-on VPN and Block connections without VPN settings. Our Mullvad Android guide covers them.
Checking the Connection
Mullvad’s browser extension checks your connection and verifies there are no IP, WebRTC or DNS leaks, its download page lists. It works with Firefox and Firefox-based browsers, and Mullvad Browser ships with it built in. Our guide to Mullvad on Synology NAS covers DSM cannot run WireGuard, so use a container.
Elsewhere, run our DNS leak guide after connecting, especially with a plain WireGuard file, where DNS settings depend on your client.
Mullvad WireGuard vs Other Providers
Most providers offer WireGuard alongside OpenVPN; Mullvad is unusual in offering nothing else. Proton also dropped OpenVPN from its Apple apps, our tables record, though it keeps it elsewhere. ExpressVPN added WireGuard on Windows, iOS and Android in 2025 while keeping Lightway as its default, our tables record. Our guide to Mullvad and IKEv2 covers why there is no IKEv2, and what WireGuard covers instead.
Our WireGuard vs OpenVPN guide explains why providers are moving to WireGuard.
How We Research
This page draws on Mullvad’s help guides and OpenVPN removal posts, Tom’s Guide on GotaTun, alternativeto’s 2025 reports on QUIC and LWO, ip-trackers’ 2026 Mullvad review and our Mullvad tables. We cross-checked these sources against each other, and where they conflict or something can’t be verified, we say so in the text rather than guessing. We checked time-sensitive figures, including prices in US dollars, on 8 October 2026. The main source we relied on is Mullvad’s app guide. Our full approach lives on the About Us page.
Mullvad WireGuard FAQ
Yes, since it removed OpenVPN on 15 January 2026.
Mullvad’s new Rust WireGuard engine, on Android first.
Yes, with files from Mullvad’s configuration generator.
With QUIC, LWO, Shadowsocks and UDP-over-TCP options.
1380 by default; try 1280 if connections fail.
The Verdict
Mullvad WireGuard is the whole service now, strengthened by DAITA, multihop, quantum resistance and obfuscation. Use the app for those features, and plain configs only where it cannot run.