How to Encrypt Email

The easiest way to encrypt email depends on your service. Gmail has Confidential Mode, but it is not end-to-end encryption. Outlook may have Encrypt or Do Not Forward. For end-to-end encrypted messages to normal email addresses, Proton Mail or Tuta can use password-protected messages.

There is no single universal “encrypt email” button that works the same way everywhere.

Some email services offer built-in tools that add extra protection or restrictions to a message. Some services are built around end-to-end encryption, which means the message content is locked so only the sender and recipient can read it. Some work or school accounts also have stronger organisation-managed encryption features.

The right method depends on what email service you use and what you need the message to do.

Which method should you use?

If you only want to make one Gmail message harder to forward, copy, print, download, or keep open forever, Gmail Confidential Mode may be enough. It is simple, but it is not end-to-end encryption.

If you already use Outlook or Microsoft 365, check whether your account has Encrypt or Do Not Forward. These options can be useful, but they are not available on every Outlook account.

If you want the message content to be end-to-end encrypted for someone using a normal email address, a password-protected message from an encrypted email provider is usually the clearer route. The recipient opens a link and enters a password you share separately.

If you send sensitive email regularly, adding protection one message at a time can become awkward. In that case, it is reasonable to look into a privacy-focused email provider, because encryption is part of the normal workflow rather than something you add each time.

How to send a more protected email in Gmail

Gmail’s simple built-in option is Confidential Mode.

Gmail Confidential Mode is not end-to-end encryption. It is an access-restriction feature. That means it can limit what the recipient can do with the message, but it does not make the message end-to-end encrypted or hidden from Google in the way client-side encryption is designed to do.

With Confidential Mode, you can set an expiry date, add a passcode, remove access early, and stop the recipient using the normal Gmail options to forward, copy, print, or download the message and attachments. Google also says Confidential Mode does not stop a recipient taking a screenshot, taking a photo, or using malicious software to copy the message.

To use Gmail Confidential Mode on a computer:

1. Open Gmail.
2. Select Compose.
3. In the bottom-right area of the compose window, select the Confidential mode icon. It looks like a small lock with a clock.
4. Choose an expiry date.
5. Choose whether to use a passcode.
6. Select Save.
7. Write the message and send it.

If you choose No SMS passcode, Gmail users can usually open the message directly, while non-Gmail recipients receive a passcode by email. If you choose SMS passcode, the recipient receives a passcode by text message, and you need to enter the recipient’s phone number.

To remove access early, open Gmail, go to Sent, open the confidential email, and select Remove access.

Gmail Workspace encryption and S/MIME are different

Google also has stronger encryption options for some work or school accounts.

Client-side encryption means the message is encrypted before it is transmitted or stored in Google’s cloud systems. Google lists Gmail client-side encryption for specific Google Workspace editions, including Enterprise Plus, Education Plus, Education Standard, and Frontline Plus. It is not a normal free personal Gmail feature.

Gmail also supports S/MIME for work or school Gmail accounts. S/MIME is a workplace-style encryption method that uses digital certificates, which are files used to prove identity and help unlock encrypted messages. This setup is usually managed by an organisation, so it is not the beginner route for a personal Gmail user.

How to encrypt email in Outlook

Some Outlook and Microsoft 365 accounts have built-in encryption options.

The two names beginners are most likely to see are Encrypt and Do Not Forward. Encrypt keeps the message protected within the Microsoft 365 flow. Do Not Forward adds restrictions so the message cannot be copied or forwarded in supported Microsoft apps and services. Microsoft also notes that some attachments behave differently depending on file type.

Not every Outlook user will see these options. Availability depends on the account, subscription, app version, and organisation settings. Microsoft’s personal and family guidance is for Microsoft 365 Personal or Microsoft 365 Family subscriptions, while work accounts may use Microsoft Purview or S/MIME depending on business licensing and setup.

To send an encrypted message in Outlook, if your account supports it:

1. Start a new email.
2. Select Options in the ribbon or message toolbar.
3. Select Encrypt.
4. Choose Encrypt or Do Not Forward, depending on what appears.
5. Finish the email and send it.

If you do not see Encrypt, it may not be available for that account or version of Outlook.

How to send an encrypted email with Proton Mail

Proton Mail works differently from Gmail Confidential Mode.

Messages between Proton Mail users are automatically end-to-end encrypted. That means the message content is designed to be readable only by the sender and recipient. But Proton does not make every email end-to-end encrypted in every situation.

If you use Proton Mail and want to send an encrypted message to someone who does not use Proton Mail, you can use a password-protected email. The recipient opens a link and enters a password that you have shared separately. Proton says you should share that password in a separate, secure format.

To send a password-protected email in Proton Mail:

1. Compose a new email.
2. Enter the recipient’s email address.
3. Select the External encryption button in the toolbar. It is shown as a lock icon.
4. Enter a message password.
5. Add a password hint if you want to.
6. Select Set encryption, or Save on mobile.
7. Check that the lock icon next to the recipient’s address turns blue.
8. Send the email.

The recipient opens the notification email, selects Unlock message, enters the password, and reads the message in the browser.

One important detail: Proton says that once the recipient replies to your password-protected email, your reply to that email is not end-to-end encrypted by default. You need to re-enable encryption for each reply.

How to send an encrypted email with Tuta

Tuta-to-Tuta messages are end-to-end encrypted by default. In simple terms, if both people use Tuta, the message content is protected automatically between them.

Tuta also lets you send an encrypted message to an external recipient, such as someone using Gmail or Outlook, through a shared password. The exact steps can change between app versions, so it is worth checking Tuta’s current guidance as you go.

To send an encrypted message to an external recipient in Tuta:

1. Open Tuta.
2. Select New email.
3. Enter the external recipient’s email address.
4. Create the shared password when prompted.
5. Share the password with the recipient through a separate secure channel.
6. Write the email.
7. Send the message.

The recipient then opens the notification email, follows the link, enters the shared password, and reads the message.

Advanced methods: PGP and S/MIME

PGP and S/MIME are two older, more technical ways to encrypt email.

PGP, or Pretty Good Privacy, uses encryption keys. A key is a digital item used to lock or unlock a message. In simple terms, the sender needs the recipient’s public key to lock the message, and the recipient uses their private key to open it.

S/MIME, or Secure/Multipurpose Internet Mail Extensions, uses digital certificates. A certificate is a digital file that helps prove identity and allows encrypted messages to be sent between compatible email systems.

These are real email encryption methods, but they are not usually the easiest option for a complete beginner. They can involve setting up keys or certificates, using compatible email apps, and making sure the recipient has the right setup too. In many workplaces, S/MIME is managed by an administrator rather than set up by the user.

For most beginners, built-in provider tools or an encrypted email provider are simpler starting points. PGP and S/MIME matter, but they are better treated as advanced options rather than the main route for sending one protected email.

What encrypted email still does not protect

Encrypted email can protect the message content, but it does not protect everything.

It may not hide metadata. Metadata means information about the message, such as who sent it, who received it, and when it was sent.

Subject lines may not always be protected in the same way as the message body. This depends on the service and method used.

Encryption also does not control what the recipient does after opening the message. They may still copy the information, take a screenshot, photograph the screen, forward the details, or share what they read.

Password-protected messages also depend on the recipient getting the password safely. If the password is sent through the same unsafe route as the message, the protection is weaker.

Encrypted email does not make phishing safe. A phishing email is a fake message designed to trick you, and it is still phishing even if it is encrypted.

It also does not replace account security. A strong password and two-step verification, which means using a second check as well as your password, still matter. Email privacy is broader than encryption because it also includes account security, metadata, and what the recipient does with the message. The wider question of whether email is private is a separate topic.

If email privacy is a regular concern

Gmail and Outlook have useful built-in options, but they are not the same as using an email service built around end-to-end encryption. The built-in tools add protection to individual messages, while an encrypted email provider makes protection part of how the service works.

If email content privacy is something you think about regularly, rather than only for the occasional message, it is worth understanding how privacy-focused email providers work. Services such as Proton Mail and Tuta are built around encryption, which can be easier than adding protection one message at a time, especially when both people use the same encrypted service.

That does not mean everyone needs to change email provider. Many people are fine using built-in tools when they occasionally need them. But if privacy is a regular priority, understanding private email providers is a sensible next step, so you can decide what suits how you actually use email.

The best method depends on your email service and the level of protection you need. Gmail Confidential Mode can add useful restrictions, but it is not end-to-end encryption. Outlook has encryption options for some accounts. Proton Mail and Tuta are examples of services built around encrypted email.