How to Send Encrypted Email on a Mac in 2026 and Stay Secure

To send encrypted email on a Mac, install a personal S/MIME certificate, get your recipient's certificate, and check that the lock in Apple Mail is closed before you send. If the other person has no certificate, use a Proton Mail password-protected message or send a password-protected PDF instead.

The urge usually arrives with something specific in hand: a signed contract, a tax form, a copy of a passport. Then you find out that "encrypted" can mean different things, and that the setting you found may not do what its name suggests. This guide sorts out which kind you already have, gives the Mac steps for each app, and covers the route that works when the person on the other end has never heard of a certificate.

Which way of sending encrypted email should you use?

The right method depends mostly on what the recipient can do, not on which app you like. S/MIME, the encryption standard built into Apple Mail and Outlook, gives each person a certificate: a small file that lets others encrypt mail to them and lets them sign what they send. It's the cleanest once it's set up, but it needs both people to hold certificates, so it suits people you email often. For a one-off to anyone, a password on the message or the file is far more practical.

Is your email already encrypted?

Your email is probably already encrypted on its way between mail servers, but that isn't the same as end-to-end encryption. Transport Layer Security (TLS) protects the connection. End-to-end encryption protects the message itself, so that only the intended recipient can open it.

The difference matters once the message lands. Microsoft puts it plainly: TLS encrypts the connection, not the message, so the message might not stay encrypted after it reaches the recipient's provider. Google says all Gmail messages use TLS automatically when the receiving side supports it, shown by a gray lock. Apple says iCloud Mail is not end-to-end encrypted because it has to work with the global email system, and turning on Advanced Data Protection doesn't change that.

So for everyday mail you already have decent protection against someone snooping on the wire. You don't have protection from anyone who can get into a mailbox at either end, which is why a passport scan needs more than the default.

How to send an encrypted email in Apple Mail

Mail, the app built into macOS, encrypts messages with S/MIME certificates and needs no plug-in. You need a certificate of your own for each address you use, plus a certificate from each person you're writing to. Apple's guide says the certificate has to come from a certificate authority.

Step 1: Get a certificate and install it

Two low-cost sources: SSL.com lists its Basic S/MIME certificate at $14 for one year, checked only by a confirmation link sent to your address, and Actalis offers a free first year with renewal at €6 plus VAT. Prices change, so check before you buy.

1. Download the certificate file from the authority. Apple lists .cer, .crt, .p12 and .p7c as the extensions Keychain Access accepts.
2. Double-click the file to import it. If that fails, drag it onto the Keychain Access icon in the Finder.
3. Open Keychain Access and confirm the certificate appears under My Certificates.
4. Check that its trust setting is Use System Defaults or Always Trust.

Step 2: Swap certificates with the other person

Apple Mail can only encrypt to someone whose certificate is already in your keychain, and a signed email is how it gets there. Posteo's guide explains that Mail saves the sender's public key when you open a signed message. SSL.com describes the same habit: both people hold certificates and exchange public keys by sending each other signed email. To send a signed email:

1. Choose File > New Message in Mail, then pick the address that has your certificate from the From field's pop-up menu.
2. Look for the signed icon, a checkmark in the message header. It shows the message will be signed when you send it, and you don't need to turn anything on.
3. Send it to the other person and ask them to reply the same way from their own certificate.
4. Open their signed reply so Mail can save their certificate.

When I set this up with my accountant, the first message was nothing more than "Testing the secure email setup, please reply." We each sent one signed note, and the lock worked from then on. Do this before the sensitive message is due, not the afternoon it's due.

Step 3: Encrypt and send

1. Choose File > New Message in Mail.
2. Hold the pointer over the From field and pick the account that has your certificate.
3. Add the recipient, then look at the header. A closed lock means every recipient has a certificate in your keychain.
4. Write the message and attachments. Keep the subject line generic.
5. Check the lock one more time, then click Send.

A checkmark next to the lock means the message will also be signed, which lets the recipient see it came from you. Signing and encrypting are separate: one says who sent it, the other says who can read it.

Why is there no lock in Apple Mail, or why is it open?

An open lock or a missing one usually points to a certificate. These are the four to check:

• One recipient has no certificate. Mail shows a closed lock only when it has a certificate for every person on the message. Apple warns that an open lock means the message goes out unencrypted, so remove that person or ask them for a signed email first.
• The certificate doesn't match your address. In Keychain Access, Control-click it and choose **New Identity Preference**, then enter the address.
• You switched Macs. Import the certificate into Keychain Access on the other Mac too.
• The import was refused. Ask the authority whether the certificate has expired or is invalid.

Keep a backup of your certificate with its private key somewhere safe: select it under My Certificates in Keychain Access and choose File > Export Items, which saves a .p12 file you can also import on another Mac. Apple says Mail decrypts a message only if your private key is in your keychain, so losing it can cut you off from older encrypted mail.

How to send encrypted Gmail from your Mac

Personal Gmail accounts can't use Gmail's own message encryption. Google limits S/MIME to work and school accounts, and everyone else gets TLS. That leaves three realistic routes, depending on your account.

Personal Gmail address. Apple ties certificates to an email address rather than a provider, so you can add the account to Apple Mail and follow the steps above. Expect to read those messages on a Mac that holds your certificate, not at gmail.com, because Gmail's own S/MIME support isn't there for you. For a one-off, a password-protected PDF is simpler.

Google Workspace account. Hosted S/MIME is available on Frontline Plus, Enterprise Plus and the Education editions, and an admin has to turn it on. A stronger option, client-side encryption, is listed for Enterprise Plus, Education Plus, Education Standard and Frontline Plus. To use it, click the Message security icon in the compose window and turn on Additional encryption. If neither appears, your edition or your admin is the reason.

Gmail confidential mode. This is the setting people find first, and I wouldn't treat it as encryption. Google's page describes expiry dates, revoking access, blocking forwarding and an optional SMS passcode, and it doesn't describe the message as encrypted. It also warns that recipients can still take screenshots or photos. To use it:

1. Open mail.google.com and click Compose.
2. Click the confidential mode toggle along the window's lower edge.
3. Set an expiration date and pick SMS passcode or No SMS passcode.
4. Click Save, then send. To cut off access later, open the message in Sent and click Remove access.

Confidential mode is a sensible fit for a salary figure I'd rather not leave sitting in someone's inbox forever. A scanned passport belongs in one of the other options.

How to encrypt an email in Outlook for Mac

Outlook for Mac encrypts with S/MIME when your certificate is in the Mac keychain and each recipient's certificate is saved with their contact or in the global address list. Microsoft's Mac instructions cover Outlook for Microsoft 365, Outlook 2024 and Outlook 2021 for Mac.

1. Choose Outlook > Accounts, select your account, then choose Security.
2. Pick your certificate, click OK and close the window.
3. In a new message, select See more items, then S/MIME > Encrypt with S/MIME.
4. If S/MIME isn't listed, add it through Customizable Toolbar, then send.

The Do Not Forward and Encrypt-Only options are a different system, Microsoft 365 Message Encryption, which Microsoft says is included in the Office 365 Enterprise E3 license. Its Mac page describes those two options only for legacy Outlook for Mac, and that page gives October 2026 as the end of support for legacy Outlook. If you don't see them in the current app, ask your IT team what your plan allows.

Microsoft 365 Personal and Family subscribers have a simpler route through Outlook.com in a browser. Compose a message, select the **Options** ribbon, select **Encrypt**, then choose Encrypt or Do Not Forward. Google and Yahoo recipients can sign in with those accounts or use a temporary passcode, and people on other providers get a passcode by email. That makes it one of the easier ways to reach someone who has no setup at all.

How to send a password-protected email with Proton Mail

Proton Mail's password-protected messages reach anyone, on any email service, and they're available on every plan, including Proton Free. Mail between Proton accounts is end-to-end encrypted automatically. Mail to other services travels over TLS by default, so the password step is what you want for those.

1. Sign in to Proton Mail, where a free account works and the message comes from that Proton address. Write your message and enter the recipient's address.
2. Click the External encryption button, the lock icon in the toolbar.
3. Enter a message password and, if you want, a hint, then click Set encryption.
4. Check that the lock beside the recipient's address has turned blue.
5. Click Send, then give the password to the recipient through a separate channel.

Two limits to plan around: the message expires after 28 days at most, and the recipient can reply up to five times per message. Free accounts are capped at 150 messages a day and up to 1 GB of storage, which is plenty if Proton is only your secure side door. If you're weighing a full move, my Proton Mail and Gmail comparison goes further.

Thunderbird is the other free Mac option. It has OpenPGP built in, set up under Account Settings > End-To-End Encryption > Add Key, and it suits people who already use PGP keys. The secure email client roundup compares it with the rest, including how it stacks up against Apple Mail.

How to encrypt an attachment on a Mac without changing your email

Encrypting the file is often the most practical choice, because the recipient needs no certificate and no new account. The Mac has two built-in ways to do it, and both work from whatever email app you already use.

When I send tax paperwork, this is the method I reach for. The email itself stays ordinary, the PDF is locked, and the password goes by text.

Password-protect a PDF in Preview

1. Open the PDF in Preview.
2. Choose File > Export. Rename the copy if the original should stay unprotected.
3. Click Permissions.
4. Select Require Password To Open Document, then enter and confirm a password.
5. Enter and confirm an Owner Password in its section.
6. Click Apply, then Save.

Apple's Preview guide notes that changes take effect the next time the PDF is opened, so reopen it and confirm it asks for the password before you attach it.

Put several files in an encrypted disk image

For a folder of documents going to another Mac user, Disk Utility can build an encrypted disk image. Apple's page only covers Macs, so I'd stick to PDF if the recipient might be on Windows.

1. Open Disk Utility and choose File > New Image > Blank Image.
2. Name the file, set a size, and choose APFS as the format.
3. Open the Encryption menu, pick an option, then enter a password and click Choose.
4. Click Save, then Done. The image mounts on your Mac.
5. Copy your files onto it in the Finder, eject it, and attach the image file to your email.

Apple warns that a forgotten password means you can't open the image at all, and that anyone using your Mac can reach the files while the image is mounted.

How to share the password safely

A password in the same email as the attachment undoes the whole exercise, since anyone who can read one can read the other. Send it by a different route: a text, a call, or an end-to-end encrypted app such as Signal. A short cover note helps too, because a locked file from out of the blue looks suspicious.

Subject: Documents you asked for

Hi Dana,

The attached PDF is password-protected because it has personal details in it.
I'm texting you the password now, so look for a message from me in the next few minutes.

If the file won't open, reply here and I'll call you. Please don't reply with the password in email.

Thanks,
[Your name]

How to stay secure beyond encryption

Encryption protects a message in one narrow way, and most email trouble comes from elsewhere: the wrong recipient, a stolen password or a convincing fake. These settings and habits cover the rest on a Mac.

• Read the To line twice. Encryption can't help if you address the right message to the wrong person. Autocomplete once offered me an old colleague with the same first name as my accountant, and I now slow down on anything sensitive.
• Turn on Mail Privacy Protection. In **Mail > Settings > Privacy**, select **Protect Mail Activity**. Senders then can't see your IP address or learn when you open a message.
• Check FileVault. Mail saved on your Mac is only as safe as the disk. FileVault lives in System Settings > Privacy & Security and requires your login password before anyone can reach the data.
• Secure the sign-in. A stolen password opens every message in the mailbox, encrypted route or not. The Gmail on Mac security guide covers passkeys and 2-Step Verification.
• Watch for phishing. Apple lists the common signs: an address that doesn't match the company, a link pointing elsewhere, an unsolicited attachment, or a request for a password.
• Heed the red lock in Gmail. A red open lock means the message isn't encrypted, and Google says not to send sensitive information through it.
• Clear out what you've already sent. Old threads hold bank details and scans long after anyone needs them. Search your Sent mailbox for "passport" or "W-2" once in a while and move the files somewhere safer.

One honest limit: once a person can read your message, they can copy or photograph it. If that would be a real problem, a meeting or a phone call may be the right channel.