Mullvad’s exit-IP fingerprinting: why switching VPN servers may not break the link
Mullvad disclosed that a website could guess that two connections from different servers came from the same person. Here is how it worked, what Mullvad advises, and who needs to care.
By OwnYourStack Admin · Published
When you switch from one VPN server to another, you expect websites to see an unrelated address. Mullvad published a post on 20 May 2026 explaining that, for its service, this was not always as clean as it looked. It learned of the problem on 15 May. The post is Mullvad’s own account, and it is worth reading if you change servers specifically to keep your activity apart.
What the problem was
According to Mullvad, each server has a range of several exit IP addresses, and many users share each one. Each device has its own WireGuard key and an internal tunnel address, which usually, but not always, matches that key. The catch: if you connected to two servers with the same internal tunnel address, you tended to be given an exit address at the same relative position in each server’s range. If it was about 40% of the way into one range, it was about 40% of the way into the other.
Because many people share an exit address, this gives no certainty. But a website, or several cooperating websites, could often make good guesses that a visitor from one server was the same person who had earlier come from another. Mullvad stresses that this does not reveal who you are. It only suggests that the same someone connected from both places, for both IPv4 and IPv6.
Who should care
| Your habit | Does it matter? |
|---|---|
| You use a VPN to hide your home IP address from websites | Not really. Your real address is not exposed. |
| You switch servers to stream from another country | Not really. |
| You switch servers to keep two activities, or two identities, from being linked | Yes. This is the case Mullvad describes. |
What Mullvad advises
- If you switch servers to prevent linking, log out of the Mullvad app and log back in each time you change server. That regenerates your WireGuard key and changes your internal IP address.
- Mullvad said it was testing a new method of assigning exit IPs, designed so that an exit address reveals nothing about the address used on another server, or about other users on a server. It planned to roll this out to servers “in the coming weeks”, with progress on a Mullvad help page.
We could not confirm from Mullvad’s pages that the rollout has finished, so check the help page before you rely on it, and keep the log-out habit until you have.
A wider lesson
A VPN changes the address a website sees; it does not make separate sessions unlinkable by itself. If separation really matters, use separate browser profiles or devices, not just a different server. For other recent Mullvad findings, see the Android leak and the new Multihop modes.
Source: Mullvad blog, “Exit IP fingerprinting between VPN servers”, 20 May 2026.
