Gmail's built-in encryption only works with other Gmail users
Gmail does not have a simple "encrypt this email" button for all recipients. Instead, Google offers Confidential Mode, which adds password protection and expiration dates to messages — but only if you send to another Gmail address. If you send to someone with a different email provider (Outlook, Yahoo, corporate email), Confidential Mode does not work.
For true encryption that works across any email provider, you need a separate tool. The most common free option is ProtonMail, which encrypts messages by default and lets you send encrypted emails to non-ProtonMail users through a secure link. Other options include Tutanota and Mailvelope (a browser extension that works with Gmail). Each has different trade-offs in ease of use and who can read your messages.
The choice depends on who you are emailing and how much friction you are willing to accept. Confidential Mode is fastest if everyone uses Gmail. A separate encrypted email service is more secure but requires setup or asks recipients to click a link.
Key Takeaways
- Gmail's Confidential Mode adds a password and expiration date to emails sent to other Gmail users, but does not encrypt messages sent to non-Gmail addresses.
- To encrypt emails to anyone regardless of their email provider, you need a separate tool like ProtonMail, Tutanota, or Mailvelope.
- Confidential Mode is the fastest option if you only email other Gmail users, but it does not prevent Gmail from reading your message content.
- True encryption means only you and the recipient can read the message — not even the email service can see it.
How to use Gmail's Confidential Mode
Open Gmail and start composing a new message. At the bottom of the compose window, you will see a clock icon with a lock next to it. Click that icon to turn on Confidential Mode. A panel will appear asking you to set an expiration date (from one day to five years) and whether to require a passcode.
If you choose to require a passcode, Gmail will send the recipient an email asking them to enter a code that you provide separately — not in the email itself. This adds a layer of security because even if someone intercepts the email, they cannot read it without the passcode. Without a passcode, the recipient simply needs their Gmail password to open the message.
Once the expiration date passes, the recipient cannot open the message anymore, even if they saved it. They also cannot forward, copy, print, or download the message while Confidential Mode is active. Keep in mind that Confidential Mode only works when you send to a Gmail address — if you send to anyone else, the feature will not activate and you will get a warning.
Why Confidential Mode is not true encryption
Confidential Mode protects your message from being forwarded or printed, and it adds an expiration date. But Google can still read the content of your email. If a government agency or hacker gains access to Google's servers, they could see what you wrote. Confidential Mode is useful for preventing accidental sharing or keeping a message from living forever in someone's inbox, but it is not the same as encryption that only you and the recipient can decrypt.
This matters if you are sending sensitive information like passwords, financial details, or medical information. For those cases, you need actual encryption where the message is scrambled in a way that only the recipient's private key can unscramble it.
Using ProtonMail for encrypted emails to anyone
ProtonMail is a free encrypted email service based in Switzerland. You create a ProtonMail account and send emails from there instead of Gmail. All messages between ProtonMail users are automatically encrypted end-to-end, meaning ProtonMail itself cannot read them.
If you send an encrypted email to someone who does not have ProtonMail, they receive a link instead of the message in their inbox. They click the link, enter a password you share with them separately, and read the message in a web browser. The message is encrypted on ProtonMail's servers and only decrypts when they enter the password. This works with any email address — Gmail, Outlook, corporate email, anything.
The trade-off is that non-ProtonMail users have to click a link and enter a password each time, which adds friction. But it guarantees that only people with the password can read your message, and ProtonMail cannot read it either.
Using Mailvelope to encrypt Gmail without switching services
If you want to keep using Gmail but add encryption, Mailvelope is a browser extension that works with Gmail, Outlook, and other webmail services. You install it in Chrome, Firefox, or Edge, and it adds an encryption button to your compose window.
Mailvelope uses the same encryption standard as ProtonMail (called OpenPGP). When you send an encrypted email, the recipient receives an encrypted message that they can only read if they have your public key or if you share a password with them. If the recipient also uses Mailvelope, they can decrypt it automatically. If they do not, they click a link and enter a password, similar to ProtonMail.
Mailvelope requires more setup than Confidential Mode — you have to generate encryption keys and manage them — but it gives you encryption without leaving Gmail. It is a good middle ground if you want to stay in Gmail but need real encryption for sensitive messages.
Comparing your encryption options
| Option | Works with non-Gmail users | True encryption | Recipient friction | Cost |
|---|---|---|---|---|
| Gmail Confidential Mode | No | No | None | Free |
| ProtonMail | Yes | Yes | Click link, enter password | Free (basic) |
| Mailvelope | Yes | Yes | Click link, enter password | Free |
| Tutanota | Yes | Yes | Click link, enter password | Free (basic) |
What to do if you need encryption but your recipient will not cooperate
Sometimes you need to send sensitive information to someone who will not use an encrypted email service or enter a password. In that case, consider encrypting the file itself before you attach it to an email. Most operating systems have built-in encryption: Windows has BitLocker, macOS has FileVault, and Linux has LUKS. You can also use free tools like 7-Zip (Windows) or VeraCrypt (Windows, Mac, Linux) to create an encrypted archive of the file.
Encrypt the file, attach it to a regular email, and send the password through a separate channel — a phone call, text message, or in-person conversation. This way, even if someone intercepts the email, they cannot open the attachment without the password. It is not as seamless as encrypted email, but it works when the recipient will not use a special service.
Frequently Asked Questions
Can someone read my Gmail if I do not use Confidential Mode?
Yes. Without Confidential Mode or encryption, your email is stored on Google's servers in plain text. Google employees cannot read it under normal circumstances, but law enforcement with a warrant can, and so can hackers if they breach Google's security. Encryption is the only way to prevent that.
Does Confidential Mode prevent Gmail from reading my emails?
No. Confidential Mode prevents the recipient from forwarding or printing the message and sets an expiration date, but Google can still read the content. It is useful for preventing accidental sharing, not for hiding content from Google or law enforcement.
What happens if I send a Confidential Mode email to a non-Gmail address?
Gmail will warn you that Confidential Mode does not work for non-Gmail addresses and ask if you want to proceed. If you send it anyway, the recipient will receive a regular unencrypted email without any of the Confidential Mode protections.
Is ProtonMail free?
ProtonMail's basic plan is free and includes encrypted email to anyone. The paid plans add more storage and features, but you do not need them for basic encrypted messaging. Tutanota also offers a free tier with similar features.
Can I use Mailvelope with Gmail on my phone?
Mailvelope works on desktop browsers (Chrome, Firefox, Edge) but not on mobile apps. If you need encryption on your phone, ProtonMail or Tutanota have mobile apps that encrypt by default. Gmail's mobile app does not support Confidential Mode.