We recently laid out why, after evaluating 211 VPN providers, we ship the three we do. That post answered “which, and why.” This one goes under the hood. If you are the kind of person who wants to know what actually makes Mullvad different from IVPN, why Tailscale is not really the same category at all, and how to prove any of it is working, this is for you.

And there is a fourth tool in Bazaar that belongs in this conversation even though it is not a VPN: PCAPdroid, the app that lets you watch your own traffic and verify everything the others claim. Trust is good. Verify is better. We ship both halves.

Mullvad: engineered so there is nothing to hand over

Mullvad’s whole design answers one question: what if we simply never collected the thing a government could ask for?

It starts at signup. You do not give Mullvad an email, a name, or a phone number. You click a button and get a random 16-digit account number. That number is your entire identity. You can top it up with a card, with cryptocurrency including Monero and Bitcoin, or with actual cash mailed in an envelope, precisely so there is no payment trail linking the account to a person. Most VPNs know exactly who you are. Mullvad went out of its way not to.

Underneath, the infrastructure matches the philosophy. Every Mullvad server runs entirely in RAM, with nothing written to disk, so a seized server yields no persistent data because there is no persistent data. Mullvad owns its servers rather than renting rack space from third parties. And the no-logs claim is not just a policy page: Mullvad has commissioned something like eighteen independent audits over the years, the most recent in early 2026, from firms like Cure53 and Assured. More convincingly than any audit, in 2023 Swedish police executed a search warrant at Mullvad’s offices looking for customer data and left with nothing, because there was nothing to take. That is the difference between a promise and a proof.

On protocol, Mullvad is WireGuard-first (with OpenVPN and Shadowsocks available), and it ships two features almost no one else does. DAITA, Defence Against AI-guided Traffic Analysis, injects padding and cover traffic to defeat the pattern-recognition attacks that can fingerprint you by packet size and timing even when the contents are encrypted. And it protects WireGuard with post-quantum key exchange, guarding against the harvest-now-decrypt-later game where an adversary stores your encrypted traffic today hoping to crack it with a future quantum computer.

The honest caveats: Mullvad is Swedish, which puts it inside the 14 Eyes intelligence-sharing bloc, a fact that only matters as much as the data it holds, which is close to none. Its server fleet is small by marketing standards, a few hundred servers rather than thousands, because it prioritizes owning them over inflating the count. And it is genuinely bad at unblocking streaming services, on purpose. Mullvad is a privacy instrument, not a Netflix key.

IVPN: the same ethics, stated even louder

IVPN comes from the same worldview and is, if anything, more openly ideological about it. You can create an account with no personal information at all, an account ID and nothing else, and pay anonymously the same way. It has been independently audited, it publishes transparency reports on government requests, and it is based in a jurisdiction chosen for privacy rather than convenience.

Where IVPN distinguishes itself is stance. The people who run it are explicitly hostile to the surveillance-advertising economy and have built the product to collect as little as technically possible, not as a marketing bullet but as a stated mission. It supports WireGuard and OpenVPN, offers multi-hop routing so your entry and exit servers sit in different jurisdictions, and has repeatedly made choices that cost them money in the name of not becoming another data broker with a padlock logo.

We ship Mullvad and IVPN together on purpose. They occupy the same category, hide my traffic from my ISP, hide my IP from the sites I visit, and ask you to trust the fewest possible parties. Running two audited, no-logs, anonymous providers from different jurisdictions means you are not betting your privacy on a single company staying principled forever. If one ever slips, you have somewhere honest to go.

Tailscale: a different category entirely

Here is the thing people get wrong. Tailscale is in Bazaar, but it is not competing with Mullvad and IVPN, and using it as if it were will disappoint you. Mullvad and IVPN answer “how do I hide from my ISP?” Tailscale answers “how do I connect my own devices into a private network only I can reach?”

Technically, Tailscale is a WireGuard mesh. Every device runs the WireGuard data plane and talks directly to every other device, peer to peer. What makes it effortless is the coordination server, which handles authentication, key exchange, peer discovery, and access-control policy, but critically never carries your actual traffic. Your data flows straight between your devices, encrypted end to end with WireGuard. When two devices cannot punch a direct hole through NAT, Tailscale falls back to DERP relay servers, which forward the still-encrypted packets over HTTPS and cannot read a byte of them.

On top of that base it layers the features that make a mesh genuinely useful: exit nodes to route internet traffic through a device you choose, subnet routers to reach an entire LAN through one node, MagicDNS for stable hostnames instead of memorizing IPs, and tag-based access-control lists that turn it from a convenient tunnel into a real zero-trust access tool.

The trust question with Tailscale is not your data, that stays peer to peer, but your metadata: by default, Tailscale’s cloud coordination server knows which of your devices exist and when they connect to each other. For most people that is a fine trade for the convenience. For people who want none of it, there is Headscale, an open-source reimplementation of the coordination server that you host yourself. You keep the official Tailscale apps, point them at your server instead of Tailscale’s cloud, and now the node list, the keys, and the policies live on infrastructure you own. That is the same principle we apply to everything: where you can own the control plane, own it. Headscale is also, frankly, the sane version of “just run your own WireGuard,” you get the mesh, MagicDNS, exit nodes, and subnet routing without hand-maintaining a pile of config files.

So Tailscale is the tool for reaching the server in your office from a hotel, running a closed and isolated team network, or stitching field devices into one private fabric. Different job, different tool, same phone.

PCAPdroid: the one that lets you verify all of it

Everything above asks you to trust something, a provider’s no-logs claim, a mesh’s encryption, an app’s good behavior. PCAPdroid is the tool that lets you stop trusting and start checking. It is not a VPN in the privacy sense at all. It is a no-root network monitor, and it is one of the most quietly empowering apps you can put on a phone.

Here is the clever part. To capture traffic without root, PCAPdroid uses Android’s VpnService API to route your device’s traffic through itself, locally. There is no remote server, nothing leaves the device, the “VPN” is a local loop that exists purely so the app can see the packets. Everything is processed on the phone.

What that gives you is x-ray vision into your own device. PCAPdroid logs every connection made by every app, user and system, and shows you the domain (SNI), the DNS queries, the URLs, and the remote IP for each one, with an offline lookup for the country and network operator on the other end. You can inspect HTTP requests and responses, dump raw payloads, and with the companion mitm addon (powered by mitmproxy) even decrypt HTTPS to see inside TLS. You can export a standard PCAP file and open it in Wireshark, or stream it live to a desktop for real-time analysis. Its paid tier adds a real per-app firewall and malware-blacklist detection.

Why does this belong next to three VPNs? Because it is how you audit the whole stack:

• Prove your VPN is not leaking. Turn on Mullvad, then watch in PCAPdroid to confirm every connection is going where it should and nothing is escaping the tunnel. Leak tests you run yourself beat leak claims you read.
• Catch the app that phones home. Install something new and watch what it actually talks to. The “free” flashlight contacting a dozen ad and analytics domains stops being a rumor and becomes a list on your screen.
• Understand your own noise. Most people have no idea how much their phone chatters when they are not touching it. PCAPdroid shows you, and once you can see it, you can decide what to cut.

One important, practical caveat we will state plainly, because it trips people up. On a non-rooted phone, Android only allows one VPN at a time, and PCAPdroid uses that single slot to do its local capture. That means you generally cannot run PCAPdroid and Mullvad at the same moment on a stock device. The normal workflow is to use PCAPdroid to audit, learn what your apps do, confirm behavior, spot leaks, and then run your real VPN for daily use. On a rooted device, PCAPdroid can capture even while another VPN is active. It is a diagnostic and inspection tool, and used that way it is superb.

The stack, in one breath

Mullvad and IVPN hide your traffic from the network you are on, asking you to trust the fewest, most-audited parties in the business. Tailscale connects your own devices into a private mesh you can fully self-host. And PCAPdroid lets you see, with your own eyes, exactly what your phone is doing on the wire, so none of the above has to be taken on faith. Protect, connect, and verify, three of them for the traffic and one to keep them all honest.

That is why all four are in Bazaar. If you want help deciding which combination fits how you actually work, or you have a stranger requirement than any of these cover, we are glad to talk it through. Email hello@spicycorp.com, or book a call.