Gmail's built-in encryption is limited, but it works for basic protection

Gmail does not offer end-to-end encryption by default the way some other email services do. What Gmail does offer is encryption in transit — your email is scrambled while traveling between your device and Google's servers, and while sitting in Google's data centers. This protects your message from being read by someone on your wifi network or intercepting it mid-journey, but Google can still read it, and so can anyone with a warrant or subpoena.

If you need stronger protection — where even Google cannot read your messages — you have two routes: use Gmail's confidential mode for basic controls, or use a separate encryption tool that works alongside Gmail. Neither is as straightforward as flipping a switch, but both are manageable without technical informed.

Key Takeaways

  • Gmail's standard encryption protects messages in transit and at rest on Google's servers, but Google retains the ability to read your email.
  • Confidential mode lets you set an expiration date on messages and disable forwarding, printing, and downloading, but does not encrypt the message itself.
  • To send truly encrypted email through Gmail, you need a third-party tool like ProtonMail, Tutanota, or a PGP setup, which requires the recipient to have compatible software.
  • Confidential mode works with any Gmail recipient and requires no setup from them, making it the easiest option for basic privacy controls.
  • No encryption method prevents Google from seeing your message before it is encrypted, so your subject line and metadata remain visible to Google.

How to use Gmail's confidential mode

Confidential mode is Gmail's built-in feature for controlling what happens to your message after you send it. It does not encrypt the message itself, but it does prevent the recipient from forwarding, copying, printing, or downloading it. You can also set an expiration date — after that date, the recipient cannot read the message anymore, even if they received it earlier.

To send a confidential message in Gmail on the web: click the pencil icon to start a new email, then look for the lock icon with a clock next to it at the bottom of the compose window. Click it, set your expiration date (options range from one day to five years), and choose whether to require the recipient to enter a passcode. If you require a passcode, you send it to them separately — not in the email itself. Then send the message normally.

On the Gmail mobile app, open a new message, tap the three-dot menu at the top, and select "Confidential mode". Set your expiration and passcode options the same way. The recipient will see a notice that the message is confidential and will lose access after the expiration date.

Confidential mode has real limits. The recipient can still take a screenshot, photograph the screen, or write down the contents by hand. Google can still read the message. And if the recipient's email account is compromised, the attacker can read it too. But it does prevent casual forwarding and creates a paper trail if someone tries to share it.

What happens when you send to someone outside Gmail

If you send a confidential message to a non-Gmail address — someone with Outlook, Yahoo, or a work email — the experience is slightly different. The recipient gets a notification email with a link. They click the link, and Gmail shows them the message in a browser window rather than in their own email client. The same rules explore: they cannot forward, copy, or print it, and it expires on your schedule.

This actually makes confidential mode more find for non-Gmail recipients in one way: the message never lands in their email inbox, so it is not stored on their email provider's servers. But it also means they have to click a link every time they want to read it, and they cannot access it offline.

Using third-party encryption tools with Gmail

If you need actual encryption — where the message is unreadable to Google, your email provider, and anyone without the decryption key — you need a tool outside Gmail itself. The most common options are ProtonMail, Tutanota, and PGP (Pretty Good Privacy), each with different trade-offs.

ProtonMail is a separate email service with built-in encryption. You create a ProtonMail account, and all messages between ProtonMail users are automatically encrypted end-to-end. If you send to a non-ProtonMail address, the recipient gets a link to read the message in a browser, similar to Gmail's confidential mode. The downside: you have to check ProtonMail separately from Gmail, and you cannot use your Gmail address.

Tutanota works the same way — it is a separate encrypted email service. Messages between Tutanota users are encrypted automatically. Messages to outside addresses use a link-based system. Like ProtonMail, it requires you to switch email services or manage two inboxes.

PGP encryption lets you stay in Gmail but requires more setup. You generate a public key and a private key on your computer. You share your public key with people you want to receive encrypted mail from. They use that key to encrypt messages to you. You use your private key to decrypt them. This works with Gmail, Outlook, or any email client, but both you and the recipient need PGP software installed. Common tools include Thunderbird with Enigmail, or browser extensions like Mailvelope. The learning curve is steeper, and if you lose your private key, you cannot decrypt old messages.

The trade-off between convenience and encryption strength

Confidential mode is the easiest option because it works with any Gmail recipient and requires nothing from them. But it does not encrypt the message, so Google can read it, and the recipient can still screenshot it.

ProtonMail and Tutanota offer true encryption, but you have to leave Gmail and manage a separate email account. They work well if you are sending to other ProtonMail or Tutanota users, but messages to regular email addresses still use a link-based system that is not much stronger than confidential mode.

PGP offers the strongest encryption and lets you stay in Gmail, but it requires both you and the recipient to install software and manage keys. It is the right choice if you are regularly exchanging sensitive information with someone who is also willing to set it up, but it is overkill for most daily email.

What encryption does not protect

No matter which method you choose, encryption does not hide your subject line, the recipient's address, or the time you sent the message. Google can see all of that. If someone has access to your Gmail account — through a weak password, a phishing attack, or a data breach — they can read your messages before they are encrypted and sent out.

Encryption also does not prevent the recipient from sharing the contents with someone else by other means. If you send an encrypted message to someone you do not fully trust, they can still copy the text, read it aloud, or forward the decryption key to someone else.

And if you are sending to a work email address, your employer's email system may have policies that override encryption. Some organizations intercept and scan all outgoing mail, encrypted or not, for compliance reasons. Check your employee handbook or ask your IT department before assuming encryption will keep a message private from your employer.

Frequently Asked Questions

Can I encrypt Gmail messages on my phone?

Confidential mode works on the Gmail mobile app — tap the three-dot menu and select "Confidential mode". For PGP or other third-party encryption, you need an app that supports it; Tutanota and ProtonMail both have mobile apps. Standard Gmail encryption (in transit) happens automatically on all devices.

What if I forget to turn on confidential mode before sending?

You cannot encrypt a message after you send it in Gmail. If you used confidential mode, the recipient will see the expiration notice. If you did not, the message is sent as a regular email and cannot be recalled or made confidential retroactively. Always set confidential mode before you click send.

Does the recipient need to do anything special to read an encrypted message?

For confidential mode, no — they just read it in their email or click the link. For ProtonMail or Tutanota, they click a link if they are not a user of that service. For PGP, they need PGP software installed and your public key. The setup requirement depends entirely on which encryption method you use.

Is Gmail's standard encryption enough for sensitive information?

It depends on your threat model. Standard encryption protects against someone reading your email off an unsecured wifi network. It does not protect against Google, law enforcement with a warrant, or a hacker who breaks into your Gmail account. For truly sensitive information, use confidential mode at minimum, or a third-party encryption tool if you need protection from Google itself.

Can I use confidential mode with attachments?

Yes. Attachments are included in confidential mode and are subject to the same expiration date and read restrictions as the message itself. The recipient cannot read the attachment after the message expires.