Gmail doesn't have built-in encryption, but you can use Google's confidential mode or add encryption through third-party tools
Gmail itself does not encrypt individual messages the way some email services do. However, Google offers confidential mode, which lets you set an expiration date on messages and prevent recipients from forwarding, copying, or downloading them. For stronger encryption where only the recipient can read the message content, you'll need to use a third-party encryption tool that works alongside Gmail.
The choice between confidential mode and full encryption depends on what you're protecting. Confidential mode works well if you want to control how long a message stays readable or prevent someone from sharing it further. True encryption is better if you're sending sensitive information like passwords, financial details, or medical records, because it scrambles the message so Gmail itself cannot read it.
Key Takeaways
- Gmail's confidential mode lets you set expiration dates and block forwarding, copying, and downloading, but Gmail can still read the message content.
- Third-party encryption tools like ProtonMail Bridge, Virtru, or Tresorit add true end-to-end encryption to Gmail, making messages unreadable even to Google.
- Confidential mode works on desktop and mobile Gmail, but the recipient must have a Google account or a valid email address to open it.
- Encrypted messages sent through third-party tools may require the recipient to use the same tool or enter a password to decrypt them.
How to use Gmail's confidential mode
Confidential mode is built into Gmail and requires no setup. Open Gmail on your desktop, click Compose to start a new message, and look for a clock icon with a lock next to it at the bottom of the compose window. Click that icon to turn on confidential mode.
Once confidential mode is on, you'll see two options: set an expiration date and time, and choose whether to require a passcode. The expiration date can be as short as one hour or as long as five years. If you require a passcode, the recipient will need to enter a code you provide separately (usually by phone or a different message) to open the email. After the expiration time passes, the message disappears from the recipient's inbox and cannot be opened.
On mobile Gmail, open a message you're composing, tap the three-dot menu at the top, and select Confidential mode. The process is the same: set the expiration and passcode options, then send. Recipients without a Google account will receive a link to view the message in a browser instead of seeing it in their email client.
Third-party encryption tools that work with Gmail
Virtru is a browser extension and mobile app that adds encryption to Gmail messages. After you install it, a lock icon appears in your Gmail compose window. Click it to encrypt the message, and you can set an expiration date, revoke access after sending, and require a password. The recipient receives a link and can open the encrypted message in a browser. Virtru offers a free tier with basic encryption and a paid version with more control options.
ProtonMail Bridge connects your Gmail account to ProtonMail's encryption system. You download the Bridge software to your computer, connect your Gmail account, and then use an email client like Outlook or Thunderbird to send encrypted messages. This method is more technical than browser extensions and works best if you already use a desktop email program. Messages are encrypted end-to-end, meaning only the recipient can decrypt them.
Tresorit Send is a file and message encryption service that integrates with Gmail through a browser extension. You compose your message in Gmail, click the Tresorit icon, and the message is encrypted before sending. Recipients get a link to open the encrypted message in a browser. Tresorit offers a free tier with limited monthly sends and a paid plan for more frequent use.
Each tool has different pricing, ease of use, and recipient experience. Some require the recipient to have the same tool installed; others let anyone open an encrypted message through a browser link. Test with a trusted contact first to see how the recipient experiences the process.
Differences between confidential mode and true encryption
| Feature | Confidential Mode | Third-Party Encryption |
|---|---|---|
| Gmail can read the message | Yes | No |
| Recipient can forward or copy | No | Depends on the tool |
| Message expires automatically | Yes | Only if the tool offers it |
| Recipient needs special software | No | Usually no (browser link works) |
| Setup time | Seconds | Minutes to hours (install extension or software) |
Confidential mode is faster and simpler, but it does not hide message content from Google or from anyone with access to Google's servers. True encryption scrambles the message so thoroughly that only the person with the decryption key can read it. If you're sending information that must remain private from all parties including Google, use a third-party encryption tool.
When to use each method
Use confidential mode when you want to control how long a message stays readable or prevent a recipient from forwarding it to others. This works well for time-sensitive information, draft feedback you don't want shared, or messages you want to disappear after a set period. Confidential mode is also the right choice if your recipients are not tech-savvy, because they don't need to install anything or understand encryption.
Use third-party encryption when you're sending passwords, financial account numbers, medical information, or anything else that should remain unreadable even if intercepted or accessed by a server. Encryption is also necessary if you're sending information to someone outside your organization and you need to prove the message was encrypted in transit. Some industries like healthcare and finance have rules that require encryption for certain types of data.
If you're unsure which to use, ask yourself: would it be a problem if Google could read this message? If yes, use encryption. If no, confidential mode is usually enough.
Common issues and how to fix them
If a recipient says they cannot open a confidential message, check that you entered their email address correctly and that they have access to the email account you sent it to. Confidential messages require the recipient to sign in to their email or click a link, so they cannot be read by forwarding to another address. If you set a passcode, make sure the recipient has the code — it must be shared separately from the email.
If you're using a third-party encryption tool and the recipient cannot open the message, the tool may not be working correctly with your browser or email account. Try sending a test message to yourself first to see if the encryption process completes. If the extension or app is not appearing in your Gmail compose window, try refreshing the page, clearing your browser cache, or reinstalling the extension.
If you need to revoke access to a message you've already sent, confidential mode lets you do this before the expiration date. Open the message in your Gmail sent folder, click the three-dot menu, and select Turn off confidential mode. Some third-party tools like Virtru also offer message recall, but this only works if the recipient has not yet opened the message.
Frequently Asked Questions
Can I encrypt messages to people who don't use Gmail?
Yes. Confidential mode works with any email address, though non-Gmail recipients will see a link instead of the message in their inbox. Third-party encryption tools also work with any email address — recipients typically receive a link and can open the encrypted message in a browser without needing the same tool installed.
Does confidential mode work on mobile?
Yes, confidential mode is available in the Gmail app on iPhone and Android. Open a new message, tap the three-dot menu, select Confidential mode, set your expiration and passcode options, and send. The experience is the same as on desktop.
What happens if I set a message to expire but the recipient hasn't read it yet?
Once the expiration time passes, the message disappears from the recipient's inbox and cannot be opened, whether they read it or not. They will see that the message is no longer available. This is why it's important to give recipients enough time to read the message before setting a short expiration window.
Is Gmail's confidential mode the same as encryption?
No. Confidential mode prevents the recipient from forwarding or copying the message and sets an expiration date, but it does not encrypt the message content. Google can still read the message, and it travels across the internet unencrypted. True encryption scrambles the message so only the recipient can read it.
Do I need to pay for encryption?
Confidential mode is free. Most third-party encryption tools offer a free tier with limits on how many messages you can send per month, and paid plans for unlimited use. Check the pricing page of each tool to see what fits your needs.