The three ways to encrypt emails, and which one actually works
Email encryption comes in three forms: built-in encryption from your email provider, end-to-end encryption through a separate service, and encrypting attachments before you send them. The first is the easiest but only protects your email in transit to the provider's servers. The second requires both you and the recipient to use the same service. The third works with any email account but only protects files, not the message itself.
Most people use their email provider's built-in encryption because it requires no setup. Gmail, Outlook, and Yahoo all encrypt emails between you and their servers automatically. But this does not stop the provider from reading your message, and it does not protect the email once it arrives in the recipient's inbox. If you need the recipient to be the only person who can read your message — including the email provider — you need end-to-end encryption or encrypted attachments.
Key Takeaways
- Gmail's Confidential Mode and Outlook's Encrypt option let you set expiration dates and disable forwarding, but the provider can still read the message.
- ProtonMail and Tutanota offer true end-to-end encryption where only you and the recipient hold the decryption key, but both of you must use their service or follow a special process.
- You can encrypt a file with 7-Zip or Windows built-in encryption before attaching it, which works with any email account but requires the recipient to decrypt the file separately.
- If the recipient does not use your encryption service, most providers offer a link-based method where they read the message on a web page instead of in their inbox.
Gmail's Confidential Mode: easiest, but not truly private
Gmail's Confidential Mode lets you set an expiration date on an email and prevent the recipient from forwarding, copying, or downloading it. To use it, open a new message, click the lock icon at the bottom, toggle on Confidential Mode, set when the message expires, and send. The recipient sees the message in their inbox but cannot save it after the expiration date passes.
This is useful if you want to prevent someone from keeping a record of sensitive information, but it does not encrypt the message. Google can still read it, and so can anyone with access to the recipient's account. The recipient also cannot print the message, which sometimes frustrates people who need a paper copy. If the recipient takes a screenshot before the expiration date, they keep the information forever.
Outlook's Encrypt option: similar to Gmail, with a password choice
Outlook offers encryption through the Encrypt button in the ribbon when you compose a message. Click Encrypt, choose whether to require a password, and send. If you set a password, the recipient receives an email with a link and must enter the password to read the message on a web page. If you do not set a password, Outlook sends the message encrypted but the recipient reads it in their inbox as usual.
Like Gmail's Confidential Mode, this does not prevent Outlook from reading your message. It does add a password layer if you choose one, which stops someone who intercepts the email from reading it without that password. The recipient cannot forward the encrypted message to someone else, and you can revoke access after sending, which removes the message from their view.
ProtonMail and Tutanota: true end-to-end encryption, but both users must participate
ProtonMail and Tutanota are email services built around end-to-end encryption. When you send a message to another ProtonMail user, only you and that person hold the key to decrypt it. ProtonMail cannot read your messages, and neither can anyone who intercepts them. You create an account at protonmail.com, choose a password, and send emails like normal.
The catch is that the recipient must also use ProtonMail (or Tutanota must use Tutanota). If you send a message to someone with a Gmail or Outlook account, ProtonMail offers a workaround: the recipient receives a link, enters a password you share with them separately, and reads the message on a web page. This adds a step but works across email providers.
Switching to ProtonMail means using a new email address, which requires telling your contacts and updating accounts that send you messages. Some people keep ProtonMail as a second account just for sensitive correspondence. Tutanota works the same way but is less widely known. Both offer free plans with limited storage and paid plans starting around $5 per month.
Encrypting attachments before you send them
If you only need to protect a file, not the message itself, you can encrypt the attachment before you send it. On Windows, right-click a file, select Send To, and choose Compressed (Zipped) Folder. Right-click the resulting .zip file, select Properties, click Advanced, check Encrypt Contents, and click OK. The file is now encrypted and requires a password to open.
On Mac, right-click the file, select Compress, then open the resulting .zip file in Archive Utility (which opens automatically). The file is encrypted by default. On any system, you can also use 7-Zip, a free program that creates encrypted .7z files. Download 7-Zip, right-click your file, select 7-Zip, then Add to Archive, set a password, and click OK.
Once the file is encrypted, attach it to an email and send it through any email service. The recipient downloads the file, enters the password you provide (through a phone call or separate message, not in the email itself), and opens it. This method works with any email account and any recipient, but the recipient must know how to decrypt the file type you used.
Comparing the methods: what each one protects
| Method | Protects message from provider | Protects message in transit | Works with any email account | Setup time |
|---|---|---|---|---|
| Gmail Confidential Mode | No | Yes | Yes (recipient needs Gmail) | 30 seconds |
| Outlook Encrypt | No | Yes | Yes (with password link) | 30 seconds |
| ProtonMail | Yes | Yes | Yes (with password link) | 10 minutes (account creation) |
| Tutanota | Yes | Yes | Yes (with password link) | 10 minutes (account creation) |
| Encrypted attachment | Yes (file only) | Yes | Yes | 2 minutes |
Which method to use for different situations
Use Gmail Confidential Mode or Outlook Encrypt if you want to prevent the recipient from forwarding or keeping a permanent copy, but you do not mind that the provider can read the message. This works for internal company emails or sensitive information you want to expire after a set time.
Use ProtonMail or Tutanota if you need true privacy and the recipient is willing to use the same service or follow a password-link process. This is the right choice for lawyers, journalists, doctors, or anyone whose messages must stay private from the provider itself.
Use encrypted attachments if you only need to protect a file, not the entire message, or if you want a method that works with any email account without asking the recipient to sign up for a new service. This is practical for sending financial documents, contracts, or medical records.
Frequently Asked Questions
Can I encrypt emails in Gmail without switching to ProtonMail?
Yes. Gmail's Confidential Mode encrypts the message in transit and prevents forwarding, but Google can still read it. If you need Google to be unable to read the message, you must use ProtonMail, Tutanota, or encrypt an attachment before sending. For most people, Confidential Mode is enough.
What happens if I encrypt an email and then change my mind?
With Gmail Confidential Mode and Outlook Encrypt, you can revoke access before the recipient opens the message, which removes it from their view. With ProtonMail, you cannot unsend a message, but you can ask the recipient to delete it. Encrypted attachments cannot be recalled once sent.
Do I need to pay for email encryption?
No. Gmail and Outlook offer encryption for free. ProtonMail and Tutanota offer free accounts with limited storage. Encrypting attachments with Windows or 7-Zip costs nothing. You only pay if you want extra storage or features from ProtonMail or Tutanota.
Can the recipient forward an encrypted email?
It depends on the method. Gmail Confidential Mode and Outlook Encrypt prevent forwarding. ProtonMail and Tutanota allow forwarding but the recipient must share the decryption key separately. Encrypted attachments can be forwarded, but the recipient must share the password to decrypt them.
Is encrypting emails the same as using a VPN?
No. A VPN encrypts all your internet traffic, including emails, but the email provider can still read the message once it arrives. Email encryption protects the message itself, so only the recipient can read it. You can use both at the same time for extra protection.