VPS GOAT / Guides / Account Keys vs Email Logins: How the Mullvad Model Works for VPS Hosting

Anonymity

Account Keys vs Email Logins: How the Mullvad Model Works for VPS Hosting

Anonymity · 8 min read

Quick answer: An account key login system replaces your email address and password with a single randomly generated string that authenticates you without asking who you are. Mullvad popularized this model for VPNs, and a growing number of privacy-first hosts apply the same logic to VPS accounts: no email required, no password reset tied to your identity, just a key you generate, hold, and are fully responsible for.

What an Account Key Actually Is

An account key is a long, randomly generated identifier, typically a string of digits or an alphanumeric token, that a service issues at signup instead of collecting a username, email address, or password. The account key model treats the credential itself as the identity: whoever holds the string owns the account, full stop.

The system verifies that a given string is a valid, active key rather than verifying a claimed identity. That distinction matters. A traditional signup form builds a profile around a real or invented identity, complete with an email, sometimes a name, sometimes security questions. An account key skips identity entirely and works as a pure bearer credential, similar to how a physical safe-deposit-box key works: anyone holding it gets access, and the box never asks who they are.

Generated server-side or client-side at signup, never derived from personal data
Functions as both username and password in a single string
Typically 12-16+ digits or a longer alphanumeric token, sized to resist brute-forcing
Stored by the provider only as a salted hash, never in plaintext

The Mullvad Model, Step by Step

Mullvad VPN, a Swedish provider, is usually credited with mainstreaming this approach among privacy tools starting around 2016. Its account number system works like this: a new user visits the site, clicks the signup button, and is immediately issued a 16-digit number. No form, no email field, no verification tied to a real inbox.

From that point, the account number is the entire relationship. To add service time, the user pays with cash, a prepaid voucher, or cryptocurrency, referencing only the number. To log in on a new device, they type the number. If they lose it, there is no password-reset flow, because there is no email address to send a reset link to. The number itself is the only recovery mechanism, and losing it means losing the account.

VPS hosts that borrow this model apply the same logic to server hosting: the account key authenticates the dashboard, the API, and billing, and it is the only thing tying a customer to their virtual machines. VPS GOAT uses this approach, issuing a single anonymous account key at signup rather than collecting an email address.

Visit the signup page and generate a key with one click, no form fields
Fund the account or a specific order using crypto (Monero, Bitcoin, USDT, Litecoin, Ethereum, or Tron via a processor like Paymento)
Use the key to log in on any device going forward
Store the key exactly as you would a password protecting your entire infrastructure, because that is what it is

Why Email-Based Signup Is a Privacy Liability

Email addresses feel neutral, but they are one of the strongest correlation handles a hosting provider can hold. An address is frequently reused across services, indexed by breach-aggregation sites, and logged by mail providers with IP metadata at every login. Once a hosting account is tied to an inbox, that inbox becomes the weakest link in the chain, regardless of how good the host's own security is.

Email is also usually the first thing named in a legal data request, because it is often the fastest path to a real identity through a mail provider, a domain registrar, or a linked account elsewhere. Removing email from the signup flow removes that entire branch of inquiry before it starts.

There is a secondary cost too: password-reset flows built on email are themselves an attack surface. An attacker who compromises the inbox, whether through phishing, a SIM-swapped recovery phone, or a mail provider breach, can often reset a hosting password without ever touching the host directly.

What You Gain, and What You Must Manage Yourself

The account key model shifts risk rather than eliminating it. The provider stops holding a piece of correlating personal data, which is a real and measurable privacy gain. In exchange, the user takes on full custody of a single opaque string with no fallback identity behind it.

This is the same tradeoff cryptocurrency wallets make with seed phrases. Removing a trusted third party's recovery capability removes a target for attackers and courts alike, but it also removes the safety net that identity-based systems build in by design. There is no support agent who can verify a driver's license and issue a replacement. Possession of the string is possession of the account, and that is the entire model.

Gain: no email, IP, or name correlation stored by the host at signup
Gain: nothing to phish through a password-reset email
Gain: fewer fields exposed in any future breach or data request
Cost: losing the key usually means losing the account, permanently
Cost: the key must be stored as carefully as a password manager entry or a crypto seed phrase

Account Keys in VPS Hosting vs VPN

Mullvad's model works cleanly for a VPN because the account holds little beyond a subscription expiry date. VPS hosting raises the stakes: an account key can gate access to running servers, snapshots, API tokens, and billing history, so a lost or leaked key carries heavier consequences than a lapsed VPN connection.

Providers that extend the account key model to VPS hosting generally add a layer the VPN use case does not need: scoped API keys under the account, a secondary control-panel secret, and sometimes an optional encrypted contact channel for support that still avoids linking an email inbox to the account by default. VPS GOAT follows this pattern, one account key drives signup, billing through Paymento, and the server dashboard, while server-level security such as SSH keys and firewall rules is layered independently on top.

The takeaway is that an account key replaces identity-based login, not operational security. Strong SSH key management, firewall discipline, and encrypted backups on the server itself are still entirely the operator's responsibility; the account key only protects the front door to the control plane.

Best Practices for Storing and Rotating an Account Key

Treat an account key exactly like a root password with no recovery contact behind it: generate it, record it in a password manager or an encrypted offline note, and never paste it into chat logs, ticket systems, or screenshots shared for support.

Some providers allow generating a secondary or replacement key while logged in, which is the closest equivalent to a password rotation. Where that option exists, use it periodically the same way you would rotate an SSH key pair, and update the record in your password manager immediately, not later.

Store the key in a password manager entry, not a plaintext file or note app
Keep an offline backup, such as an encrypted USB drive, for high-value accounts
Never send the key over unencrypted channels, including support tickets, unless the provider explicitly supports secure submission
Rotate the key if you ever suspect it was exposed, using the provider's key-change feature if one exists
Treat the key with the same seriousness as a crypto wallet seed phrase

Account Key vs Email and Password Login
Aspect	Account Key Model	Email and Password Model
Personal data collected at signup	None	Email address, sometimes name or phone
Correlation risk	Low, key is not linked to identity elsewhere	High, email is often reused across services
Password reset flow	None, by design	Email link, vulnerable to inbox compromise
Breach exposure	Hashed key only, no personal data to leak	Email plus password hash, a phishing target
Recovery if lost	Usually none, by design	Email-based reset, but ties account to inbox
Legal request surface	Payment trail only	Email, IP logs, and linked accounts
Typically paired with	Crypto payment (Monero, Bitcoin, and others)	Card or bank billing

FAQ

What happens if I lose my account key?+

In most account-key systems, including Mullvad's, there is no identity-based recovery, so losing the key generally means losing access to the account and anything billed to it, permanently. This is why providers using this model consistently recommend password-manager storage plus an offline backup.

Is an account key login actually more secure than an email and password?+

It depends on what secure means. An account key removes email as an attack surface and correlation point, which improves privacy and removes phishing-via-reset-link risk, but it also removes any identity-based recovery path, so the security burden shifts entirely onto how carefully the key is stored.

Can a provider still identify me if I only use an account key?+

A provider using this model has no email, name, or password tied to the account key itself, so identification, if it happens at all, would have to come from other metadata such as a payment trail or connection logs, which is exactly why account-key providers pair the model with crypto payment and minimal logging.

Do account keys work with two-factor authentication?+

Yes, an account key can be paired with a secondary control-panel secret or hardware key the same way a password can, since the key simply replaces the who-are-you step of login rather than the prove-you-still-hold-this-session step.

Why don't more hosting providers use the account key model?+

Most hosting providers are built around billing systems, support tooling, and compliance assumptions that expect an email address and a legal identity from day one, so switching to an anonymous key means redesigning signup, billing, and support around crypto payment and a custody model few mainstream hosts have reason to adopt.

Ready to go offshore?

No KYC, no email — just an anonymous key and crypto. Deploy in ~55 seconds.

Configure your VPS →