Basic End-to-End Encryption for Gmail: What Works in 2026

The most basic end-to-end encryption for Gmail on a personal account is Mailvelope, a free, open-source OpenPGP browser extension, because Gmail has no built-in end-to-end setting for personal addresses. Work and school accounts on Enterprise Plus, Education Standard or Plus, or Frontline Plus get Google’s own option instead, called additional encryption.

Gmail’s other protections are encryption Google can undo. Google’s help page lists three levels: standard (TLS, gray lock) on every account, enhanced (hosted S/MIME, green lock), where Google manages a copy of the key, and additional (client-side encryption, blue shield), where your organization holds the only key. Only additional encryption keeps Google out.

Who this setup is for

Use it if you want particular conversations, such as a custody dispute, medical results or a contract draft, sitting in Gmail as ciphertext that Google cannot scan, cannot decrypt in answer to a legal demand, and cannot leak as readable text in a breach. It also covers a common domestic threat: if an ex or housemate knows your Gmail password and signs in on their own device, Mailvelope-encrypted threads stay unreadable, because the private key lives in your browser, not your Google account.

It does not hide who you write to, when, or the subject line. Mailvelope’s FAQ says plainly that “email addresses and subject lines are never encrypted.” Nor does it stop malware on your computer, a phishing page that captures your passphrase, or a recipient who forwards the decrypted text. What email metadata leaks shows how much the envelope still reveals.

Skip it if your worry is a stranger on café Wi-Fi; Gmail’s default encryption in transit already handles that. Skip it too if your correspondents will not install anything, because OpenPGP needs keys at both ends. Do you actually need encrypted email helps you decide which camp you are in.

Which option matches your Gmail account?

For a personal Gmail account, use Mailvelope; the runner-up is Thunderbird, which has had OpenPGP built in since version 78. For Enterprise Plus, Education Standard or Plus, or Frontline Plus, ask IT to enable additional encryption. For an occasional message to someone else’s Gmail inbox, Proton Free’s password-protected email needs no setup on their end.

Mailvelope also appears on Privacy Guides’ list of recommended email clients. One wrinkle: a Gmail address inside a Google Workspace subscription needs Mailvelope’s paid Business license rather than the free version, per its setup guide. Proton’s password-protected messages expire after at most 28 days and allow up to five replies, so they suit a single exchange, not a running correspondence.

How to set up Mailvelope with Gmail

These steps follow Mailvelope’s Gmail guide and were written against Mailvelope 6.3.0, released in June 2026. Its release notes add a new onboarding flow and a redesigned key backup dialog, so your screens can differ from older tutorials.

1. Install Mailvelope from your browser’s add-on store. It runs in Chrome, Firefox and Edge, not on Android or iOS.
2. Click the Mailvelope toolbar icon and choose Generate key. Enter your name or a pseudonym, your Gmail address and a long passphrase. Mailvelope cannot recover a lost passphrase, so store it in your password manager.
3. Back up the key pair when prompted. The private key lives in that one browser profile; lose the profile without a backup and everything encrypted to the key becomes unreadable.
4. Leave the key-server upload switched on unless you prefer to share your public key by hand. Mailvelope then sends you an encrypted message titled “Verify your email address”. Open it in Gmail, enter your passphrase and click the link so other Mailvelope users can find your key.
5. Reload Gmail. A Mailvelope button appears next to Compose. The first time you use it, Google shows a “Using the Gmail API” security alert; sign in and grant the permissions.
6. Get your correspondent’s public key. They can use Mailvelope or any OpenPGP program. Type their address in the Mailvelope composer: it turns green when Mailvelope has their key and red when you need to import one.
7. Write the message, attach any files and click Submit. Keep the subject bland, because it is sent unencrypted.

To read a reply, click the sealed-envelope graphic over the message and enter your passphrase. The PGP email encryption setup guide goes deeper on key management, and PGP and end-to-end email basics explains why swapping public keys is enough.

How to verify it worked

Run these checks on your first encrypted message. They need nothing beyond Gmail, Mailvelope and a second device or browser profile.

1. Inspect what Google stored. Open the sent message, click the three-dot More menu beside Reply and choose Show original. Press Ctrl+F (Cmd+F on a Mac) and search for an unusual word from your message body. It should not appear anywhere; the body should be a block of encoded characters, often marked “BEGIN PGP MESSAGE”. The subject and addresses will be readable, which is the metadata limit in plain view. How to read email headers explains the rest of that window.
2. Open it without the key. View the same message in the Gmail app on your phone, or in a browser profile without Mailvelope. You should see scrambled text or an unreadable attachment, not your words. That is roughly what Google, a breach, or someone signed into your account elsewhere would see.
3. Compare fingerprints. In Mailvelope’s key management, open your correspondent’s key and read its fingerprint to them over a different channel, such as a phone call or Signal. If it does not match what their software shows, delete the key: you have the wrong one, possibly an impostor’s.
4. On a Workspace account, check the Message security icon before sending. A blue shield means additional encryption is on; a gray lock means standard TLS only, which Google can read.

What about Gmail’s built-in end-to-end encryption?

Gmail’s built-in end-to-end encryption exists only for paid work and school accounts. Called additional encryption and built on client-side encryption, it encrypts the body, inline images and attachments on your device with keys your organization holds outside Google. The subject, timestamps and recipient list stay readable, per Google’s support page.

Eligible editions are Enterprise Plus, Education Plus, Education Standard and Frontline Plus, and an admin has to set it up first. You turn it on per message from Message security in the compose window. It disables Google AI and smart features, signatures, emojis, Confidential mode, delegated accounts and printing, and caps attachments and inline images at 5 MB.

Google announced in April 2025 that enterprise users would be able to send these messages to any inbox without exchanging S/MIME certificates. That reached general availability in October 2025 for Enterprise Plus with the Assured Controls add-on, switched off until an admin enables it. Outside recipients sign in with a Google or guest account and read the message in a restricted version of Gmail. Since April 2026, users can also send from the Gmail apps for Android and iOS. The full guide to encrypting email in Gmail covers hosted S/MIME too, and teams below these tiers should weigh encrypted email built for small business.

The catch

Mailvelope is only as safe as the browser it lives in. Its FAQ says the private key is stored as a file in the browser’s local folder by default, so malware on your computer or a malicious extension in the same browser is the realistic way to lose it. That risk has been demonstrated: a 2017 Cure53 audit for Posteo showed that Firefox’s add-on architecture at the time could, in extreme cases, expose a Mailvelope user’s private key to a malicious add-on, and Mailvelope advised a separate Firefox profile until Firefox’s new add-on architecture shipped. The project lists ten independent audits since 2013, seven of them by Cure53. The latest, by 0xche against version 6.0.1, found one high-severity clickjacking flaw, fixed in 6.1.0. A dedicated browser profile with no other extensions is still good practice.

OpenPGP also lacks forward secrecy, as Privacy Guides points out: whoever later obtains your private key and passphrase can read every stored message encrypted to it.

Gmail’s own option has a different catch. It needs Google’s top Workspace tiers, plus Assured Controls to reach outside inboxes, and Google still sees every sender, recipient, subject and timestamp.

If you end up encrypting most of what you send, the basic setup has stopped being basic. A provider that encrypts by default, compared in Proton Mail vs Tuta, carries less daily friction, and migrating from Gmail to encrypted email sets out the order of operations.

FAQ

is there a free way to get end-to-end encryption in gmail?

Yes, for personal accounts it comes from free add-on software rather than a Gmail setting. Mailvelope is free for private users and adds OpenPGP encryption to Gmail in Chrome, Firefox and Edge. Thunderbird, connected to your Gmail account, has had OpenPGP built in since version 78. Either way, your recipient needs OpenPGP software too.

does gmail use end-to-end encryption by default?

No. By default Gmail uses TLS, which encrypts messages between mail servers when both sides support it, shown as a gray lock. Google can still read the content on its servers. End-to-end protection against Google exists only as additional encryption on eligible paid Workspace editions, or through OpenPGP tools you add yourself.

can i use mailvelope in the gmail app on my phone?

No. Mailvelope’s FAQ states that using it on Android or iOS “isn’t possible at the moment,” and it does not run inside the Gmail app. Encrypted messages will appear as ciphertext on your phone. If you need encrypted mail on mobile with a personal account, an encrypted provider’s app is the more practical route.

does the person i email need mailvelope to read it?

No, they need any OpenPGP software and their own key pair, and you need their public key before you can encrypt to them. Mailvelope works with other OpenPGP tools such as Thunderbird. If they will not set anything up, a Proton password-protected message or a move to an encrypted provider is the simpler path.

does end-to-end encryption hide the subject line in gmail?

No. Neither Mailvelope nor Gmail’s additional encryption encrypts the subject. Google’s documentation says the header, including subject, timestamps and recipients, does not get additional encryption, and Mailvelope says subject lines and addresses are never encrypted. Write a neutral subject such as “Documents” and keep the details in the encrypted body.