How to send an encrypted email
Gmail and Outlook both offer something that sounds like encryption. Only some of it keeps the email company out of your message.
Gmail and Outlook already send mail over TLS whenever the recipient's provider supports it, which encrypts the connection between mail servers but leaves the message readable by the providers on each end. Outlook adds an Encrypt button if you pay for Microsoft 365, and Gmail offers S/MIME only on work or school accounts. If you want nobody but the recipient to read the message, use an end-to-end encrypted provider such as Proton Mail or Tuta, or PGP.
The four things people call encrypted email
"Encrypted email" covers four different protections, and they differ in who besides the recipient can read the message.
| Method | Who can read the message | What you need |
|---|---|---|
| TLS (in transit) | You, the recipient, and both email providers | Nothing extra: Gmail and Outlook use it automatically when the recipient's provider supports it |
| Gmail confidential mode | The recipient and Google, and nothing stops the recipient taking a screenshot | Any Gmail account |
| Outlook Encrypt (Microsoft Purview) | The recipient. The message stays inside Microsoft 365, and Microsoft runs the service. | A Microsoft 365 Personal, Family, or qualifying business plan |
| End-to-end (Proton Mail, Tuta, PGP) | Only you and the recipient. Your provider stores it in a form it cannot open. | An end-to-end provider, or PGP keys on both ends |
S/MIME sits between the last two rows. It encrypts the message itself with certificates, but both sides need certificates set up, and Gmail's hosted version lets Google keep a copy of the key.
How to send an encrypted email in Gmail
Basic encryption needs no action: Google says all Gmail messages use TLS automatically. While you write a message, select Message security in the compose window to see its level. A gray lock means standard TLS. A red open lock means the message is unencrypted, and Google tells you not to send sensitive information when you see it.
Confidential mode is the closest thing to an encrypt button on a personal Gmail account. It adds an expiration date, lets you revoke access, and turns off forwarding, copying, printing, and downloading. Google's own help page warns that recipients can still take screenshots or photos, and its description never calls the feature encryption. Use it to limit what the recipient can do with a message, and assume Google can still read it.
- 1Open Gmail on a computer and click Compose.
- 2At the bottom of the compose window, click the confidential mode icon.
- 3Pick an expiration date from the drop-down.
- 4Choose SMS passcode if you want the recipient to need a code texted to their phone, or No SMS passcode to let them open it directly.
- 5Click Save, then send. To cut off access later, open the email in Sent and click Remove access.
Gmail S/MIME, which encrypts the message itself, is only available on work or school accounts run by an administrator.
How to send an encrypted email in Outlook
Outlook has an Encrypt button, but only on paid accounts. Microsoft says your account must have a qualifying Microsoft 365 subscription. A free Outlook.com account can open encrypted messages people send you but cannot send them.
- 1Sign in to Outlook.com or the new Outlook with your Microsoft 365 Personal or Family account.
- 2Start a new message and select the Options tab.
- 3Select Encrypt, then choose Encrypt or Do Not Forward.
- 4Write and send the message as usual.
With Encrypt, the message stays encrypted and does not leave Microsoft 365. Recipients on Outlook.com or Microsoft 365 read it normally. Google and Yahoo users can sign in with that account or use a temporary passcode, and everyone else gets a passcode by email. Do Not Forward adds a block on copying and forwarding.
Work accounts can also use S/MIME, under Options > More Options > Encrypt this message (S/MIME) in the new Outlook, but you have to set up certificates first, and to encrypt to an external recipient you need their certificate installed on your computer.
End-to-end encryption: Proton Mail, Tuta, or PGP
End-to-end encryption means the message is locked on your device and only unlocked on the recipient's.
Proton Mail encrypts messages between Proton users end to end automatically, and stores your inbox with zero-access encryption. The free plan gives you one address, up to 1 GB of storage, and 150 messages a day. Mail Plus costs $3.99 a month on a yearly plan ($47.88 for the first 12 months), and Proton accepts bitcoin for any paid plan, though you have to create a free account first and upgrade from settings.
Tuta also has a free plan with 1 GB. It encrypts subject lines, which Proton does not, and uses its own protocol instead of PGP, including a post-quantum scheme it calls TutaCrypt.
PGP is the do-it-yourself route. Thunderbird has OpenPGP built in since version 78, so you can generate a key pair in account settings, swap public keys with your contact, and encrypt each message by hand. It works with any email provider, but you have to manage the keys yourself and Thunderbird will not encrypt anything automatically.
To send an end-to-end encrypted message from Proton to someone who does not use Proton:
- 1Write the email and add the recipient's address.
- 2Click the lock icon labeled External encryption in the toolbar.
- 3Set a password and an optional hint, then confirm.
- 4Check that the lock next to the recipient's address turns blue, adjust the expiry if you want, and send.
- 5Give the recipient the password through a different channel, such as a Signal message or in person, never in the same email thread.
This works on Proton Free. The message expires after 28 days at most, and the recipient can reply securely up to five times.
What encryption does not hide
- Subject lines in Proton Mail are not end-to-end encrypted, and plain PGP leaves them readable too unless your mail app encrypts them, as Thunderbird does by default. Write a dull subject.
- Email addresses and send dates stay visible, even on Tuta, because mail servers need them to deliver the message.
- A message sent from Proton to a Gmail address without a password is protected only by TLS, and Google can read its copy.
- Nothing stops the recipient from forwarding, screenshotting, or printing what you sent.
Your email account is the master key to your exchange accounts
For bitcoiners, the bigger risk is the inbox itself. Many exchange accounts reset their password through email. Someone who takes over your inbox does not need to decrypt anything: they click "forgot password" and read the reset link.
Lock the account down with a hardware security key (see my YubiKey setup guide), and never put a seed phrase in an email, encrypted or not. A seed phrase belongs on paper or metal, offline. If you are moving coins off an exchange, my self-custody guide walks through it.
Frequently asked questions
What is an encrypted email?
An email scrambled so that only someone with the right key can read it. Most email is encrypted only in transit (TLS), so the providers on both ends can read it. End-to-end encrypted email can only be read by the sender and the recipient.
Does Gmail encrypt emails?
Yes, in transit. Google says every Gmail message uses TLS automatically, as long as the recipient's provider supports it too. Google can still read your messages on its servers. Gmail S/MIME, which encrypts the message itself, is only available on work or school accounts.
Is Gmail confidential mode encrypted?
Google does not describe it as encryption. Confidential mode adds an expiration date and blocks forwarding, copying, printing, and downloading, but Google warns that recipients can still take screenshots or photos.
How do I send an encrypted email in Outlook for free?
You cannot from a free Outlook.com account. The Encrypt button needs a Microsoft 365 subscription such as Personal or Family. The free route is a Proton Mail or Tuta account, both of which have free plans.
What is the best free encrypted email provider?
I'd pick Proton Mail for most people, because password-protected emails to anyone work on the free plan and the paid plans accept bitcoin. Pick Tuta if you also want subject lines encrypted.
Can I send an encrypted email to someone who does not use Proton?
Yes. Use the External encryption button to set a password, then share that password through another channel. The recipient opens the message in a browser and can reply securely up to five times. The message expires within 28 days.