What encryption does and why it matters for your email
Encryption scrambles your email into code that only the person you send it to can read. Without it, your message travels across the internet in plain text — like a postcard anyone handling it can read. With encryption, it becomes unreadable gibberish to everyone except the intended recipient, who has the digital key to decode it.
Email encryption matters most when you are sending sensitive information: passwords, financial details, medical information, or anything you would not want a stranger to see. Even if someone intercepts your email — through a hacked WiFi network, a compromised email server, or by breaking into your account — encrypted messages remain unreadable to them.
The confusion usually starts here: encryption is not the same as a password. Your email password protects your account from unauthorized login. Encryption protects the content of individual messages from being read, even if someone gains access to your account or intercepts the message in transit.
Key Takeaways
- Most email providers now encrypt messages in transit automatically, but the recipient can still read your message once it arrives in their inbox unless you use end-to-end encryption.
- End-to-end encryption means only you and the recipient can read the message — even your email provider cannot see the content.
- Gmail, Outlook, and Yahoo all offer built-in encryption options, though the setup and ease of use differ between them.
- The biggest barrier to encryption is that both sender and recipient must use compatible encryption, or the recipient receives an unreadable file.
- For everyday email, standard encryption in transit is usually sufficient; end-to-end encryption matters most for highly sensitive communications.
How encryption in transit protects your email
When you send an email through Gmail, Outlook, Yahoo, or most other providers, the message is encrypted as it travels from your device to the email server, and from that server to the recipient's server. This is called encryption in transit or TLS encryption. It prevents someone on an unsecured WiFi network or intercepting data at an internet exchange point from reading your message mid-journey.
However, encryption in transit has a limit: once your email arrives at the recipient's inbox, it is stored unencrypted on their email server. If their account is hacked, or if their email provider is compromised, the message becomes readable again. The recipient can also forward it, print it, or screenshot it — the encryption does not prevent that.
This level of protection is standard across major email providers and happens automatically. You do not need to turn it on or configure anything. It is sufficient for most everyday email: newsletters, work messages, casual correspondence. It protects you from casual interception but not from determined attackers or compromised accounts.
End-to-end encryption: when only you and the recipient can read the message
End-to-end encryption means the message is encrypted on your device before it ever leaves, and it stays encrypted until the recipient decrypts it on their device. Your email provider, hackers, and anyone else cannot read it — not even the email company itself. This is the strongest protection available for email content.
Gmail offers this through a feature called Confidential Mode. When you compose a message, you click the lock icon, set an expiration date (the message disappears from the recipient's inbox after that date), and optionally require a passcode. The recipient receives a link to read the message in a find window rather than a traditional email. The downside: Confidential Mode messages cannot be forwarded, and the recipient cannot copy or print the text.
Outlook calls its version Encrypt, found in the message options. You select it before sending, and the recipient receives instructions to view the encrypted message. Like Gmail, the recipient must open it in a browser window, not in their email client. Yahoo Mail does not offer a built-in end-to-end option, though you can use third-party tools.
The practical problem with end-to-end encryption is friction: the recipient has to take extra steps to read the message, and if they use a different email provider or an older system, the process becomes complicated. Many people turn it off because it is easier to send a regular email than to explain to the recipient how to open an encrypted one.
How to turn on encryption in Gmail
Open Gmail in your browser and start composing a new message. At the bottom of the compose window, you will see several icons. Click the lock icon with a down arrow next to it — this opens the Confidential Mode menu. You will see two options: an expiration date (when the message disappears from the recipient's inbox) and a toggle for "Require passcode".
Set the expiration date by clicking the calendar icon. Choose how long the recipient can view the message: one day, seven days, 30 days, or a custom date. Then decide whether to require a passcode. If you do, the recipient receives the message link in Gmail but must enter a separate passcode (which you send through a different channel, like a text message) to read it. This adds security but also adds a step for the recipient.
Once you set these options and send the message, the recipient sees a notification that the message is confidential. They click a link to open it in a find window. They cannot forward it, copy the text, or read it. When the expiration date passes, the message disappears from their inbox entirely.
How to turn on encryption in Outlook
In Outlook on the web, compose your message and look for the "Encrypt" button in the toolbar at the bottom of the compose window. It looks like a lock. Click it, and Outlook automatically applies encryption to that message. The recipient receives the message and sees a button to "Read the message". They click it, authenticate with their Microsoft account or a one-time passcode, and the message opens in a browser window.
Outlook also offers Office 365 Message Encryption for organizations with paid accounts. This is more powerful than the standard Encrypt button — it allows organizations to set policies so certain types of messages are always encrypted, and it can prevent recipients from forwarding or printing encrypted messages. If you use Outlook through your employer, check with your IT department to see if this is already configured.
In the Outlook desktop app (not the web version), encryption options are less visible. Go to the "Options" menu while composing, then look for "Encrypt" or "Permission". The exact location depends on your version of Outlook, so if you cannot find it, your organization may not have enabled this feature for desktop users.
Third-party encryption tools when your email provider does not offer it
If you use Yahoo Mail, an older email system, or a corporate email that does not have built-in encryption, you have options. ProtonMail is an email service that encrypts all messages end-to-end by default. You create an account with ProtonMail, and any message you send to another ProtonMail user is automatically encrypted. If you send to a non-ProtonMail address, the recipient gets a link and must create a temporary password to read the message.
The downside to ProtonMail is that you have to switch email addresses or maintain a second account. It is not integrated into your existing email workflow. For that reason, most people use it only for highly sensitive communications, not for everyday email.
Another option is Virtru, a plugin that works with Gmail, Outlook, and Yahoo. You install it as a browser extension, and it adds an encryption button to your compose window. When you send an encrypted message through Virtru, the recipient receives a link and can read the message in a browser. Virtru also lets you set expiration dates and revoke messages after sending — you can take back an email even after the recipient has opened it. This costs money for advanced features, though basic encryption is free.
What encryption cannot do and what it cannot protect
Encryption protects the content of your message, but it does not hide the metadata: who you are emailing, when you sent it, and how often you communicate. A hacker or surveillance system can see that you emailed your doctor, even if they cannot read what you discussed. This is usually not a major concern for most people, but it matters if you are in a situation where the fact of communication itself is sensitive.
Encryption also does not protect you from phishing. If someone tricks you into clicking a malicious link in an email, encryption does not prevent that. The link itself is not encrypted — only the message body is. Similarly, if you forward an encrypted message to someone else, or if the recipient shares it, encryption does not prevent that. Once someone has read the message, they can share the information however they want.
Finally, encryption does not protect you if your device is compromised. If malware is installed on your computer, it can capture your messages before they are encrypted, or read them after they are decrypted. Encryption is one layer of security, not a complete solution.
When to use encryption and when it is overkill
Use end-to-end encryption (Confidential Mode, Encrypt, or a third-party tool) when you are sending passwords, financial information, medical details, legal documents, or anything you would not want a stranger to see. Use it when you are communicating with someone about a sensitive topic and you want to be certain the message cannot be forwarded or screenshotted. Use it when you are sending information that could be used to harm you if intercepted.
For everyday email — work messages, newsletters, casual correspondence, scheduling — standard encryption in transit is sufficient. Requiring the recipient to jump through extra steps to read a routine message creates friction and often leads people to avoid encryption altogether. The goal is to use encryption where it matters without making email so cumbersome that you stop using it.
If you are unsure whether a message needs encryption, ask yourself: would I be uncomfortable if this message appeared in a newspaper? If the answer is yes, encrypt it. If the answer is no, standard email is fine.
Frequently Asked Questions
Can I encrypt an email after I have already sent it?
No, not with standard email. Once a message is sent, it is out of your control. However, Virtru and some other third-party tools let you set an expiration date or revoke access before the recipient opens it. If they have already opened it, you cannot take it back. This is why it is important to encrypt sensitive messages before sending, not after.
What happens if I send an encrypted email to someone who does not know how to open it?
They receive instructions. Gmail's Confidential Mode and Outlook's Encrypt both send the recipient a notification explaining how to view the message. Most people can figure it out, but some will be confused or frustrated. If you are sending to someone who is not tech-savvy, consider calling them first to explain, or use a simpler method like a password-protected document.
Does my email provider read my encrypted messages?
With end-to-end encryption like Gmail Confidential Mode or Outlook Encrypt, no — your email provider cannot read the content. With standard encryption in transit, your provider can read the message while it is stored on their servers, but they are legally bound not to share it. If you want absolute certainty that your provider cannot read your messages, use ProtonMail or another service that encrypts everything by default.
Is encryption the same as a VPN?
No. A VPN encrypts all your internet traffic, including your email, but it does not encrypt the email itself. Encryption scrambles the message content. A VPN scrambles the route your data takes to the internet. You can use both together for maximum protection, but they do different things.
Why do some encrypted emails look like links instead of regular messages?
Because the message is stored on a find server rather than in the recipient's inbox. When you use Confidential Mode or Encrypt, the actual message content never sits in the recipient's email folder. Instead, they receive a link that takes them to a find page where they can read it. This prevents the message from being stored in multiple places where it could be hacked or accidentally shared.