How to Encrypt Email in Gmail: TLS, S/MIME, and End-to-End

To encrypt email in Gmail, start a message and click the Message security lock icon in the compose window. Workspace accounts on eligible plans can turn on “Additional encryption” (end-to-end) there or send with hosted S/MIME. A personal @gmail.com account has no end-to-end setting, so it needs a PGP browser extension such as Mailvelope.

The distinction that matters most: a personal @gmail.com account cannot send end-to-end encrypted mail using any Gmail setting. Messages move over an encrypted channel, but Google can read everything that lands in your inbox. S/MIME and Client-Side Encryption are Google Workspace features on specific paid tiers, and Confidential Mode is not encryption at all.

Which Level Can You Actually Use?

Read that last column carefully, because it is where the marketing and the mechanics part company. Hosted S/MIME is genuine encryption against everyone except Google, which holds the uploaded key. Only Client-Side Encryption and your own PGP keep Google out, and only CSE does it without you managing keys by hand.

How to Encrypt an Email in Gmail, Step by Step

On a computer or Android, the Message security panel in the compose window shows which level a draft will get before you send it.

Work or school account: turn on additional encryption

This is Gmail’s end-to-end option, built on Client-Side Encryption, and an administrator has to configure it first. Then, per Google’s instructions:

1. Click Compose.
2. In the top-right corner of the draft, click the Message security icon.
3. Under Additional encryption, click Turn on.
4. Add recipients, subject and body, then click Send.
5. If prompted, sign in to your organization’s identity provider.

Turn encryption on before you type: enabling it on an existing draft deletes that draft and opens a new one. The subject sits in the header, which CSE leaves unencrypted, so keep sensitive detail in the body. In the Gmail app for Android and iOS, tap the lock icon and select additional encryption, once an admin has enabled the mobile clients.

Work or school account: send with hosted S/MIME

Hosted S/MIME encrypts automatically once keys are exchanged, so the work is in the setup. Per Google’s admin instructions:

1. An admin opens Menu > Apps > Google Workspace > Gmail > User settings, ticks Enable S/MIME encryption for sending and receiving emails and saves. Changes can take up to 24 hours, and messages sent in that window are not encrypted.
2. If you supply your own certificate, upload it in PKCS #12 format under Settings > See all settings > Accounts > Send mail as > Edit info > Upload a personal certificate, then enter its password.
3. Exchange keys with each recipient once, by sending them a digitally signed message or receiving one from them.
4. Reload Gmail and compose as normal. A green lock means the message will go out with hosted S/MIME; gray means it is falling back to TLS.

Personal @gmail.com account: add OpenPGP with Mailvelope

Gmail gives personal accounts no end-to-end setting, so the encryption has to happen in your browser before Gmail sees the text. Mailvelope is free for private users and runs in Chrome, Firefox and Edge; a Gmail address inside a Workspace subscription needs its paid Business license instead.

1. Install the extension, click its icon, and generate a key pair with your name, Gmail address and a strong passphrase. Mailvelope cannot recover a lost passphrase.
2. Back up your keys from Key Management, since they are stored only in that browser, then open the “Verify your email address” message from the Mailvelope Key Server and click its link so others can find your public key.
3. Get your recipient’s public key. They do not need Mailvelope; any OpenPGP software, Thunderbird included, works.
4. In Gmail, click the Mailvelope button next to Compose and approve the one-time “Using the Gmail API” permission.
5. Enter the recipient: the address turns green if Mailvelope has their key and stays red if not. Write the message, attach files, and click Submit.

Mailvelope encrypts the body and attachments only. Addresses and subject lines are never encrypted, and mobile browsers are not supported. FlowCrypt, the usual alternative, supports Chrome, Firefox and Brave plus an Android app, and reaches people without PGP by relaying a password-protected message through its servers. Fingerprint checking, the step that stops a swapped key, is in the PGP setup guide.

Is There Basic End-to-End Encryption for Gmail?

No, Gmail has no setting called basic end-to-end encryption. Google’s own labels run standard, enhanced and additional: standard is TLS (gray lock), enhanced is hosted S/MIME (green lock), and additional is Client-Side Encryption (blue shield). Only additional encryption is end-to-end against Google, and it is limited to Enterprise Plus, Education Standard and Plus, and Frontline Plus.

For a personal account, the most basic working setup is a free OpenPGP extension plus one correspondent who also uses PGP; PGP and end-to-end email basics explains the key exchange behind it. A business that wants to reach outside recipients without a certificate exchange also needs the Assured Controls add-on (see below), and teams without that tier are often better served by a provider built around encryption.

What Gmail Encrypts by Default

Every message you send from Gmail travels over Transport Layer Security (TLS), which encrypts the connection between mail servers. When a recipient’s mail provider also supports TLS, your message is protected in transit. Gmail shows a gray lock icon in the compose window when this is active.

TLS has a hard limit: it secures the pipe, not the message. Once your email arrives at Google’s servers — or the recipient’s — it is decrypted and stored in plaintext (from Google’s perspective). If your threat model is a passive wiretapper on a public Wi-Fi network, TLS is sufficient. If your threat model includes Google itself, a subpoena to Google, or a breach of Google’s infrastructure, TLS does not help you.

A red open-lock icon in Gmail’s compose window means the recipient’s server does not support TLS at all. On a message you have already received, Show original reveals which hops used TLS (how to read email headers).

TLS in email is also opportunistic: standard mail transport negotiates encryption when both ends support it and silently falls back to plaintext when they do not. Google publishes the resulting coverage in its Transparency Report on email encryption in transit, and while the share has climbed for years it has never reached 100 percent, because it depends entirely on the other party’s server. When you see the red icon, treat that message as a postcard.

Encryption at Rest: Real, but Google Holds the Keys

Stored Gmail data is encrypted on Google’s infrastructure. That matters more than people credit: it defeats an attacker who walks off with physical storage media, and it is a baseline for the compliance regimes Google sells into. What it does not defeat is Google. Because Google manages the keys, Google’s systems can decrypt your mailbox on demand, and so can anyone who compels Google to. Any time a service says “your data is encrypted” without saying who holds the key, the sentence carries much less than it appears to.

Are Gmail-to-Gmail Emails Encrypted?

The intuition behind this common question is half right. When you email one Gmail account from another, the message never crosses the public internet, so there is no server-to-server hop to intercept and the TLS question does not arise. In network terms it is the safest possible path for a Gmail message. It changes nothing about who can read it: both copies sit in Google’s storage under Google’s keys. Gmail-to-Gmail removes the third-party network risk and leaves the provider risk exactly where it was.

Does Google Read Your Email?

Automated systems do, constantly and necessarily. Spam classification, phishing and malware detection, search indexing, threading and the smart features you can toggle all require processing message content. The specific practice people remember, scanning consumer mail to personalise ads, ended: in 2017 Google announced that consumer Gmail content would no longer be used for ads personalisation. Ads still appear in the free interface; they are no longer targeted using what is inside your messages. Human access is narrower: Google restricts and logs employee access to content, and discloses content to governments under legal process. The capability exists either way, so your confidentiality rests on Google’s policy rather than on mathematics.

The “Type SECURE in the Subject” Myth

A surprising number of people search for whether writing secure in a Gmail subject line encrypts the message. On a personal @gmail.com account, it does not: there is no keyword trigger, no magic word, no hidden setting behind one. The memory is real, and it comes from managed corporate mail. Banks, insurers, medical practices and law firms often run an email gateway that an administrator can configure to act on subject-line keywords, routing a message through a secure-message portal or forcing an encrypted connection. Google Workspace administrators can set comparable rules, including requiring a secure TLS connection to particular domains. So on a personal account no keyword does anything; on a work account, a keyword someone told you to use is about your employer’s gateway and is worth confirming with your IT team.

Confidential Mode Is Not Encryption

Gmail’s Confidential Mode is frequently marketed alongside encryption, but it is not encryption in any meaningful sense. When you send a confidential message, Gmail removes the email body and replaces it with a link to content stored on Google’s servers. The recipient clicks through to read it; they cannot forward, print, copy, or download it, though Google notes they can still take screenshots or photos.

The limitations matter. Google still has full access to the content. The protection Confidential Mode offers is against the recipient sharing your message, not against Google or a third party reading it. It also adds SMS passcode verification as an optional step, which is useful for confirming a recipient’s phone number but is not a cryptographic guarantee.

S/MIME: Real Encryption for Workspace Accounts

S/MIME (Secure/Multipurpose Internet Mail Extensions) is the first option that encrypts the message itself; in its hosted form Google holds the key, so it is not end-to-end against Google. With S/MIME enabled, your message is encrypted using the recipient’s public key, and only the corresponding private key can decrypt it — so the message is opaque to everyone handling it in between, including the recipient’s mail provider. The word doing the work is hosted: your key pair is uploaded to Google in PKCS#12 form so Gmail can sign and decrypt for you, which means Google is inside the trust boundary even though nobody else is.

S/MIME is only available on the Google Workspace tiers in the table, not on personal @gmail.com accounts, and an administrator must enable it in the Admin console first, as the steps above show.

There is a practical friction point: S/MIME only works when both sender and recipient have exchanged digital certificates. Sending an S/MIME-encrypted email to someone without a certificate falls back to TLS or plaintext. This is manageable inside an organization where IT provisions certificates centrally; it is awkward for cross-organization communication.

Client-Side Encryption: True End-to-End (Enterprise and Education)

Gmail Client-Side Encryption (CSE) is the highest encryption tier available in Gmail. Encryption happens in the browser before anything reaches Google’s servers, and the keys are controlled by your organization, not Google. Even if Google’s infrastructure were compromised, the message body, inline images, and attachments remain encrypted.

CSE is available on Enterprise Plus, Education Plus, Education Standard, and Frontline Plus plans. Enterprise Plus customers with the Assured Controls add-on can send CSE-encrypted messages to any recipient — including those on non-Gmail providers — without requiring the recipient to have S/MIME certificates.

Several features are disabled when using CSE: Google AI products and smart features for Gmail (such as Smart Compose), delegated accounts, Confidential Mode, and email signatures. Attachments are capped at 5 MB.

In April 2025, Google announced a significant simplification: organizations no longer need complex certificate exchange infrastructure to send end-to-end encrypted email, even to non-Gmail recipients. This addressed the long-standing barrier that made enterprise E2EE impractical for most teams. Sending to any inbox became generally available in October 2025; it is off by default for admins, who can enable it per organizational unit or group, and outside recipients read the message through a guest account in a restricted version of Gmail. By April 2026, CSE support extended to Gmail mobile on both Android and iOS.

Which Level Do You Actually Need?

The right answer depends on your threat model, not on which option sounds most secure. If you have not framed that yet, do you actually need encrypted email walks through the cases where the upgrade is worth the disruption and the cases where it is not.

TLS is adequate against passive interception when the recipient’s server supports it, which covers most everyday email. Confidential Mode suits limiting forwarding inside an organization, never confidentiality from Google. S/MIME fits regulated fields such as healthcare, legal and finance, where both parties can manage certificates. Client-Side Encryption is for organizations that need a guarantee that even a subpoena to Google cannot expose message content: government, defense contractors, newsrooms protecting sources.

Personal accounts get neither S/MIME nor CSE, so the practical alternatives are moving to a dedicated encrypted email provider, which the Proton Mail vs Tuta comparison works through, or keeping Gmail and layering PGP on top of it through a browser extension, which the PGP email encryption setup guide covers step by step. If you decide to move, migrating from Gmail without losing your mail is the sequence that avoids locking yourself out of accounts. Moving to Proton specifically? Migrate from Gmail to Proton Mail safely.

One caveat that applies at every level above: none of them hide the envelope. Sender, recipient, timestamps, the routing path and — in most implementations — the subject line travel in clear text regardless of how the body is encrypted. What email metadata leaks sets out how much of a conversation survives encryption. The part of the envelope you can control is the address you hand out in the first place: a forwarding service puts a disposable address on the sender line instead of your real one, and the email aliases guide covers how that works.

If you would rather answer a few questions than weigh five options, the find-your-setup wizard turns your constraints into a provider and alias plan.

FAQ

is gmail encrypted end to end?

Not on a personal account. Gmail encrypts messages in transit with TLS when the receiving server supports it and stores them encrypted, but Google holds the keys, so it can read the content. End-to-end encryption exists only as Client-Side Encryption on Workspace Enterprise Plus, Education Standard and Plus, and Frontline Plus.

can i encrypt a gmail email for free?

Yes, with a browser extension rather than a Gmail setting. Mailvelope is free for private users and adds OpenPGP encryption to Gmail in Chrome, Firefox and Edge. Your recipient needs OpenPGP software and you need their public key first. Gmail’s built-in end-to-end option is limited to paid Workspace editions.

can i send an encrypted email from the gmail app on my phone?

Only on an eligible work account, unless you add a third-party app. Since April 2026, Enterprise Plus users with an Assured Controls add-on can compose and read encrypted mail in Gmail for Android and iOS once an admin enables the mobile clients. Mailvelope does not support mobile browsers; FlowCrypt has an Android app.

can someone without gmail read an encrypted gmail message?

Yes. With Gmail’s additional encryption under Assured Controls, recipients on other providers get a notification and read the message through a guest account in a restricted version of Gmail. Hosted S/MIME needs a certificate exchange first, after which recipients use their own mail app. PGP needs OpenPGP software on their side.