Gmail's built-in encryption is limited, but you have working options

Gmail does not offer native end-to-end encryption for regular email. Google can read the content of your messages, and so can anyone who gains access to your account. However, you can encrypt sensitive emails using Gmail's Confidential Mode, which adds a layer of protection for less sensitive information, or you can use PGP encryption with a browser extension if you need true end-to-end encryption that even Google cannot read.

Confidential Mode is the easier path for most people. It lets you set an expiration date on emails, disable forwarding and copying, and optionally require a passcode to open the message. The recipient still needs a Gmail or Google account to read it, and Google still stores the encrypted message on its servers — but the message will disappear after your chosen date, and the recipient cannot easily save or share it.

PGP encryption is stronger but requires more setup. You and the recipient both need encryption keys, and you need a browser extension like Mailvelope or FlowCrypt to handle the encryption and decryption. This method means Google cannot read your message, even if someone breaks into your account.

Key Takeaways

  • Confidential Mode hides message content from forwarding and copying, sets an expiration date, and optionally requires a passcode — but Google can still read the message.
  • PGP encryption with a browser extension like Mailvelope or FlowCrypt prevents Google and most others from reading your message, but both you and the recipient need encryption keys.
  • Confidential Mode works with any Gmail recipient; PGP encryption only works if the recipient has set up PGP keys and is using a compatible extension.
  • Neither method prevents the recipient from taking a screenshot or photograph of the decrypted message on their screen.

How to use Gmail's Confidential Mode

Open Gmail and click Compose to start a new email. Type your message as usual. At the bottom of the compose window, look for a clock icon with a lock — that is the Confidential Mode button. Click it.

A panel will appear asking you to set an expiration date and time. Choose when you want the message to disappear — options range from one day to five years. You can also toggle on Require passcode if you want the recipient to enter a code (which you will send separately, not in the email) before they can read it. Once you set these options, click Save.

Send the email normally. The recipient will see a message saying it is confidential and will expire on your chosen date. After that date, they cannot open it, and the message disappears from both inboxes. The recipient also cannot forward, copy, download, or print the message — though they can still take a screenshot.

Setting up PGP encryption with Mailvelope

Mailvelope is a free browser extension that works with Gmail in Chrome, Firefox, Edge, and Opera. Go to the Mailvelope website, find your browser, and install the extension. Once installed, open Gmail and you will see a new icon in the compose window.

Before you can send an encrypted email, you need to generate a key pair — a public key that you share with others and a private key that stays on your computer. Open the Mailvelope extension (usually a small icon in your browser toolbar), click Key management, and then Generate key. Fill in your name and email address, create a strong passphrase, and let it generate. This takes a minute or two.

Share your public key with anyone you want to receive encrypted emails from. You can do this by exporting your key from Mailvelope and sending it to them, or by uploading it to a public key server. The recipient does the same — they send you their public key. Once you have their key, you can encrypt messages to them.

Sending an encrypted email with Mailvelope

Open Gmail and start composing. Click the Mailvelope icon in the compose area. A window will open where you type your message. When you are done, click Encrypt. Mailvelope will ask you to select the recipient's public key from your keyring. Choose it and confirm.

The encrypted message will appear as a block of scrambled text in your Gmail compose window. Send it as usual. The recipient opens the email, sees the encrypted block, clicks it, enters their passphrase, and reads the decrypted message. Only someone with the recipient's private key can decrypt it — not Google, not your email provider, not an attacker who intercepts the message in transit.

Why Confidential Mode is not true encryption

Confidential Mode prevents the recipient from forwarding or copying your message, and it deletes the message after a set time. But Google stores the message on its servers in a form it can read. If Google receives a government request, or if your Gmail account is compromised, the message is not protected. Confidential Mode is useful for keeping casual recipients from sharing sensitive information, but it is not encryption in the cryptographic sense.

PGP encryption is different. The message is encrypted on your computer before it leaves Gmail, and only the recipient's private key can decrypt it. Google cannot read it, law enforcement cannot read it without the key, and an attacker who intercepts it cannot read it. The tradeoff is complexity — both you and the recipient need to set up keys and use a compatible tool.

Common problems and how to fix them

If you use Mailvelope and the recipient says they cannot decrypt your message, the most common cause is that you encrypted it with the wrong key. Make sure you have their current public key — if they generated a new key, you need the new one. Ask them to send you their key again and import it into Mailvelope before trying again.

If Confidential Mode is not appearing in your Gmail compose window, you may be using an older browser or an unsupported version of Gmail. Try refreshing the page or switching to a newer browser. Confidential Mode works best in Chrome, Firefox, Safari, and Edge on desktop, and in the Gmail app on Android and iOS.

If you forget your Mailvelope passphrase, you cannot decrypt messages encrypted with that key. There is no recovery option — write down your passphrase somewhere safe when you first create your key. If you lose it, you will need to generate a new key pair and ask all your contacts to update your public key in their systems.

When to use each method

Use Confidential Mode when you are sending sensitive information to someone you mostly trust — a password reset link, a medical appointment time, a temporary access code. The recipient cannot easily share it, and it disappears on its own. This is enough for most everyday situations.

Use PGP encryption when you are sending information that must stay secret even if your Gmail account is breached, or when you are communicating with someone who handles classified or highly sensitive material. The setup takes longer, but the protection is much stronger. Use it for financial records, legal documents, or anything you would not want a government agency or a criminal to read.

Frequently Asked Questions

Can I encrypt an email I already sent?

No. Confidential Mode and PGP encryption both work only on new emails. If you need to protect an old email, you can forward it as a new confidential or encrypted message, but the original is not protected.

What happens if I set a Confidential Mode expiration and the recipient has not read it yet?

The message disappears from both inboxes on the date you set, whether the recipient opened it or not. They will see a notification that the message has expired, but they cannot access it. If they need the information, you will have to send it again.

Do I need to pay for Mailvelope or FlowCrypt?

Both offer free versions that work with Gmail. Mailvelope is entirely free. FlowCrypt has a free tier and a paid tier with extra features like key backup and team management, but basic encryption is free.

Can the recipient forward a Confidential Mode email?

No. Confidential Mode disables forwarding, copying, and downloading. The recipient can read it on screen, but they cannot send it to someone else or save a copy.

What if my recipient does not have PGP set up?

They cannot read a PGP-encrypted email without setting up their own key and installing a compatible extension. Before you send encrypted email to someone, confirm they have the tools to decrypt it. If they do not, you can use Confidential Mode instead, or send the information through a different secure channel.