How to Send Encrypted Email in Gmail (2026): Personal and Work

Every Gmail message is already encrypted in transit with TLS when the other side supports it. To encrypt the message itself, you need a paid Google Workspace edition with hosted S/MIME or client-side encryption, turned on by your admin. From a personal @gmail.com address, use a PGP extension such as FlowCrypt or Mailvelope, or send a password-protected file and share the password separately.

Usually the question comes up with a specific file open: a tax return, a scanned ID, a contract with bank details on page three. Gmail has a lock icon, a confidential mode and a security menu, and none of them is labeled in a way that tells you whether your recipient is the only one who can read it. Below I go through what each option actually protects, which account gets which, the steps for each, and the workarounds for an account that has none of the real ones.

Is Gmail encrypted?

Yes, but only on the way between mail servers by default. Google's help page says all Gmail messages use TLS automatically, which Google calls standard encryption, and it works only when the recipient's email service supports TLS too. TLS protects the connection. Once the message lands in a mailbox, it's readable by anyone who can get into that mailbox, and by the provider.

Gmail shows which kind of protection a message has with an icon. On a computer or Android device, Google says you can check it while you write by selecting the Message security icon, and on mail you've received by opening the recipient details.

The red open lock is the one worth stopping for. The one time I saw it beside a recipient, a small supplier I was paying, I sent the bank details as a locked PDF instead of in the body. Google also suggests telling that sender their mail isn't encrypted, which is a kind thing to do.

Which Gmail encryption option fits your account?

Your account type decides almost everything. Personal @gmail.com addresses get TLS and confidential mode only; S/MIME and client-side encryption exist only on certain paid Google Workspace editions, and only after an admin turns them on.

If you're on a personal account and only need to send one sensitive document, jump ahead to the personal Gmail options. The Workspace options below are worth the setup only for people you exchange private mail with often, or when your organization's plan includes them anyway.

How to send an encrypted email in Gmail with S/MIME

S/MIME in Gmail encrypts each message with a certificate, and personal Gmail addresses can't use it. Google lists hosted S/MIME on Frontline Plus, Enterprise Plus and the Education Fundamentals, Standard and Plus editions. Both you and the person you're writing to need certificates, and Gmail only encrypts once it has the other person's public key.

Step 1: Your admin turns it on

1. Sign in to the Admin console and open Menu > Apps > Google Workspace > Gmail > User settings.
2. Select the domain or top-level organization on the left.
3. Check Enable S/MIME encryption for sending and receiving emails.
4. To let people add their own certificates, also check Allow users to upload their own certificates, then click Save.

Google allows as long as a day for the setting to reach everyone. Admins can also upload certificates for everyone through the Gmail S/MIME API, which Google recommends, so ask before buying one yourself.

Step 2: Upload your certificate

The certificate has to be a PKCS #12 file (usually .p12 or .pfx) that meets Google's current cryptographic standards. Uploading works on Gmail on the web only, not in the app.

1. From a computer, sign in to Gmail and choose Settings > See all settings.
2. Open the Accounts tab.
3. Next to Send mail as, click Edit info.
4. Click Upload a personal certificate, choose the file and click Open.
5. Enter the certificate's password, click Add certificate, then Save changes.

Each extra address under Send mail as needs its own certificate. It doesn't inherit the one on your main address.

Step 3: Swap keys, then send

Gmail stores a contact's public key when they send you an S/MIME-signed message, and from then on messages you send them are encrypted with S/MIME. So the first message is a handshake: send them a signed email, ask them to reply with one of theirs, then write the real message. Before you click Send, select the Message security icon and check for the green lock.

When I set up S/MIME with someone I email every week, the first message said nothing more than "Checking our encryption works, reply when you get this." Do that a day before the contract is due, not an hour before.

How to turn on additional encryption in Gmail

Additional encryption is Gmail's name for client-side encryption (CSE), where the keys stay with your organization and Google can't read the message. Google lists it for Enterprise Plus, Education Plus, Education Standard and Frontline Plus, and your admin has to set up the key service first.

1. In Gmail, click Compose.
2. Click the Message security icon, up in the new message's top-right corner.
3. Under Additional encryption, click Turn on.
4. Add recipients, a subject and the message.
5. Click Send. If Gmail asks, sign in to your company's identity provider.

Sending to people outside your company got easier in late 2025. Google's Workspace Updates blog announced that CSE users can send end-to-end encrypted email to anyone, on any provider, for Enterprise Plus with the Assured Controls add-on. Recipients open it through a guest account, with no key exchange or software. Without Assured Controls, external recipients need S/MIME and a swap of signed messages first.

How to use Gmail confidential mode, and what it doesn't do

Confidential mode lets any Gmail user set an expiry date, require a passcode and block forwarding, copying, printing and downloading. Google's own page doesn't call it encryption. Google's admin documentation explains that Gmail removes the body and attachments from the recipient's copy and swaps in a link that opens them. Google also warns that a screenshot or a photo of the screen gets around all of it.

I treat it as "this shouldn't sit in their inbox forever", not "this is secret". When I left a house sitter the door code and Wi-Fi password, confidential mode with a one-week expiry was the right weight. A scanned ID needs one of the real encryption options.

Turn on confidential mode on a computer

These steps follow Google's confidential mode guide.

1. Open Gmail and click Compose.
2. Turn on confidential mode with the toggle icon along the compose window's lower edge. If it's already on, click Edit below the email instead.
3. Pick an expiration date from the drop-down.
4. Choose No SMS passcode or SMS passcode. With an SMS passcode, enter the recipient's phone number, not yours.
5. Click Save, then send.

Turn on confidential mode on Android or iPhone

1. In the Gmail app, tap Compose.
2. Tap More options in the top right, then Confidential mode.
3. Turn on Confidential mode.
4. Under Set expiration, choose a timeframe.
5. Under Require passcode, choose Standard or SMS passcode, then tap Save.

Google says SMS passcodes work only for phone numbers in certain regions: North America, South America, Europe, Australia, India, Korea and Japan. For anyone else, use the standard passcode, which goes to the recipient by email.

Remove access early

Open Sent, open the confidential email and click Remove access. People who don't use Gmail open the message by selecting View the email, then Send passcode, and entering the code they receive. In a Workspace account, an admin can turn confidential mode off for everyone, which is why the toggle is sometimes missing.

How to send encrypted email from a personal Gmail account

Personal Gmail accounts can't use S/MIME or client-side encryption, so real encryption has to come from outside Gmail. The three practical routes are a PGP browser extension, a password-protected attachment, or a different service for that one message.

Use a PGP extension: FlowCrypt or Mailvelope

PGP extensions add encryption on top of Gmail in your desktop browser. The catch is that true PGP needs both people to have keys, so check what happens when the other person doesn't.

• FlowCrypt is a Chrome extension that works inside Gmail and encrypts with PGP. For a recipient with no PGP key, FlowCrypt asks you to set a message password, sends them a secure link, and keeps the encrypted message on its servers for 90 days by default. You share the password by phone or a messaging app. Its business pricing page says it's free for companies with fewer than 100 users.
• Mailvelope is an open-source PGP add-on for Chrome, Firefox and Edge, and its FAQ says it works in Gmail, with a Gmail API integration that's on by default and can be switched off in its options. The recipient needs a PGP key of their own, so it suits people who already use PGP. It doesn't run in mobile browsers.
• Virtru is the business-grade route, with expiry, revoking access and no account needed by the recipient. Its plans start at $119 a month for five users, billed annually, which makes sense for a team and rarely for one person.

An extension that reads your mail gets wide permissions over the mailbox it works in. Install only the ones you'd trust with every message in it, and remove the ones you stop using.

Lock the attachment instead

A password-protected file is the route I reach for most, because the recipient needs nothing new. The email stays ordinary, the attachment is locked, and the password travels another way. In Microsoft Word on Windows, go to **File > Info > Protect Document > Encrypt with Password**; on a Mac, it's Review > Protect > Protect Document. Microsoft warns that Word can't recover a forgotten password. Mac users can lock a PDF in Preview too, which our Mac encryption guide walks through.

When I had to send a copy of my passport for a rental application, I locked the PDF, emailed it from Gmail as usual and texted the password to the agent's phone.

Subject: The documents you asked for

Hi [Name],

The attached file is password-protected because it has personal details in it.
I'm sending the password by text in a minute, so look out for it.

If it won't open, reply here and I'll call. Please don't send the password back by email.

Thanks,
[Your name]

Share from Google Drive with restricted access

For a folder of files, sharing from Drive can beat attaching. Click Share, add the person's address, then set General access to Restricted, which Google describes as only people who have been given access can open the file. This isn't end-to-end encryption, but nothing sits in an inbox, and you can remove access when the job's done.

Send that one message from Proton Mail

Proton Mail's password-protected messages are available on every plan, including Proton Free, and they're meant for people who don't use Proton, such as your Gmail contacts. They expire after 28 days at most, and people outside Proton can reply up to five times. The Proton Mail and Gmail comparison covers whether it's worth keeping as a second address.

How to check if a Gmail message is encrypted

Gmail tells you with the icon in the message details. For mail you're writing, select the Message security icon in the compose window on a computer or Android device. For mail you've received, open the message and open the recipient details under the sender's name, where the icon shows standard encryption (gray lock), enhanced encryption (green lock) or additional encryption (blue shield).

Those icons only describe Gmail's own encryption. A message sealed by a PGP extension or a locked attachment won't show a green lock or a blue shield, so open your own file once before you send it to confirm it really asks for the password.

Mistakes that undo encrypted email

Most leaks happen around the encryption, not through it. These are the ones worth a second look before you send anything sensitive from Gmail:

• The password in the same email. Anyone who can read the email can then open the file. Text it or say it on a call.
• A revealing subject line. Google says subjects stay readable even with client-side encryption.
• The wrong recipient. Gmail's autocomplete will happily offer the other person with the same first name. I read the To line twice on anything private.
• Trusting confidential mode with something that matters. It doesn't stop a screenshot or a phone camera.
• A weak sign-in. A stolen Gmail password opens every message in the account. The Google and Gmail privacy and security settings guide walks through locking down the account itself.
• Old copies left lying around. Search Sent for "passport" or "tax return" now and then and delete what nobody needs anymore.

One limit nothing on this page fixes: once someone can read your message, they can copy it. If that would be a real problem, a call may be the better channel.