Gmail's Built-In Encryption and What It Actually Does
Gmail encrypts messages between your device and Google's servers automatically — that part happens whether you do anything or not. But that encryption only protects the message while it's traveling. Once it arrives in someone else's inbox, they can read it as plain text, and so can anyone who gains access to their account.
If you want the message itself to be unreadable to everyone except the intended recipient, you need Gmail's confidential mode or a separate encryption tool. Confidential mode is built into Gmail and requires no setup. It lets you set an expiration date on messages and remove the ability to forward, copy, or download them — but it does not encrypt the text itself, so Google can still read it.
True encryption, where the message is scrambled so that only the recipient can unscramble it, requires either a third-party tool or the recipient to use a matching encryption method. Gmail does not offer built-in end-to-end encryption for regular email, though some Google Workspace accounts have access to Client-side encryption (a separate feature for organizations).
Key Takeaways
- Gmail's confidential mode prevents forwarding and sets expiration dates, but does not encrypt the message text itself.
- True encryption requires a tool like ProtonMail, Tutanota, or PGP, because Gmail's standard email cannot be encrypted end-to-end.
- If both you and the recipient use the same encrypted email service, messages are scrambled automatically with no extra steps.
- Confidential mode works with any Gmail recipient and takes seconds to enable, but offers privacy through restrictions rather than encryption.
Using Gmail's Confidential Mode
Confidential mode is the fastest option if you want to prevent a recipient from keeping or sharing your message. Open Gmail, click Compose, write your message, then look for the lock icon with a clock next to the send button. Click it, set an expiration date (anywhere from one hour to five years), and choose whether to require a passcode. The recipient will see the message in their inbox but cannot forward it, copy the text, or download attachments.
The recipient does not need to do anything special to read it — they open the email normally. If you set a passcode, they receive a prompt asking for it before they can view the message. Once the expiration date passes, the message disappears from their inbox and becomes unreadable.
Confidential mode works with any email provider, including Outlook and Yahoo. The downside is that Google can still read the message content, and so can anyone with access to the recipient's Gmail account or recovery email. It is useful for preventing accidental forwarding or keeping a message from sitting in someone's inbox forever, but it is not encryption in the technical sense.
Switching to an Encrypted Email Service
If you need actual encryption — where the message text is scrambled and unreadable to everyone except the recipient — you need to use a different email service or add encryption software to Gmail. ProtonMail and Tutanota are the most common encrypted email providers. Both encrypt messages automatically when you send to another user on the same service, and both offer free accounts with limited storage.
With ProtonMail, you create an account at protonmail.com, and any message you send to another ProtonMail user is encrypted by default. If you send to someone on a different email service (like Gmail or Outlook), they receive a link to read the message on ProtonMail's website, and you set a password they must enter. Tutanota works the same way. Both services encrypt your inbox as well, so even Tutanota or ProtonMail staff cannot read your stored messages.
The trade-off is that you have to switch email addresses or maintain two accounts — one encrypted service for sensitive messages and Gmail for everything else. Some people use an encrypted service as their primary email and forward important messages there, while others keep both open in separate browser tabs.
Adding Encryption to Gmail with PGP
PGP (Pretty Good Privacy) is an older encryption standard that works with Gmail through browser extensions. The most common free option is Mailvelope, which you install as a Chrome or Firefox extension. Once installed, you generate a key pair (a public key that others use to encrypt messages to you, and a private key that only you have to decrypt them).
To send an encrypted message, you compose in Gmail normally, but click the Mailvelope icon to encrypt the text before sending. The recipient needs Mailvelope installed and your public key to read it. This method works with any email provider, but it requires both people to set up the extension and exchange keys first, which makes it less practical for casual use.
PGP is most useful if you are already part of a group that uses it — journalists, activists, or security-focused communities often share keys and expect encrypted mail. For most people, switching to ProtonMail or using confidential mode is simpler.
What Encryption Does and Does Not Protect
Encryption scrambles the message text so that only someone with the right key can read it. It does not hide who you are emailing, when you sent it, or the subject line (unless you use a service that encrypts those too). Someone looking at your email metadata — the record of who emailed whom and when — can still see that you contacted someone, even if they cannot read what you said.
Encryption also does not protect you if your device is compromised. If malware is installed on your computer, it can read messages before they are encrypted or after they are decrypted. And if you forget your encryption password or lose your private key, you cannot read old messages — there is no "forgot password" recovery for encrypted email the way there is for Gmail.
Confidential mode, by contrast, does not encrypt anything, but it does prevent the recipient from keeping the message permanently or sharing it with others. It is a different kind of protection — useful if you are worried about someone forwarding your message or saving it, but not if you are worried about Gmail or the recipient's email provider reading it.
Comparing Your Options
| Method | Encryption | Works with Any Email | Setup Time | Best For |
|---|---|---|---|---|
| Gmail Confidential Mode | No | Yes | Seconds | Preventing forwarding and setting expiration dates |
| ProtonMail or Tutanota | Yes (with same service) | Partial (links for others) | Minutes to create account | Sensitive messages, if both people use the service |
| Mailvelope (PGP) | Yes | Yes | Hours (key exchange) | Groups already using PGP |
Frequently Asked Questions
Can I encrypt a message I already sent in Gmail?
No. Encryption must happen before you send. If you need to prevent someone from keeping a message, you can delete it from your sent folder, but that does not remove it from their inbox. Confidential mode is the only Gmail feature that lets you control a message after sending — you can shorten its expiration date or revoke access entirely.
Does confidential mode work on mobile?
Yes. Open Gmail on your phone, compose a message, tap the three dots, and select "Confidential mode." Set the expiration and passcode the same way you would on a computer. The recipient receives it normally on any device.
If I use ProtonMail, can I still receive regular Gmail?
Yes. ProtonMail is a separate email address, so you can have both. You can set up forwarding from Gmail to ProtonMail if you want all mail in one place, but forwarded messages are not encrypted — only messages sent directly to your ProtonMail address are encrypted by default.
What happens if the recipient loses their encryption password?
If they lose the password to their encrypted email account, they cannot read any messages, including yours. There is no recovery option. This is why encrypted email services usually ask you to save a recovery code when you set up the account.
Is Gmail confidential mode secure enough for passwords or financial information?
Confidential mode prevents forwarding and sets an expiration date, but Google can still read the content. For passwords or financial details, true encryption (ProtonMail, Tutanota, or PGP) is safer because the message text itself is scrambled. Never send passwords or account numbers in any unencrypted email, including confidential mode.