How to encrypt email in Gmail: what each account can do

Gmail already encrypts every message you send with TLS, and you can't turn that off. What most people mean by "encrypt", locking the message itself so only the recipient can read it, depends on your account. A personal @gmail.com address gets confidential mode. Paid Workspace accounts on certain editions get S/MIME or client-side encryption.

How do you encrypt an email in Gmail?

On a personal Gmail account, open Compose and turn on confidential mode at the bottom of the compose window, then optionally require an SMS passcode. On a work or school account, select Message security in the compose window and turn on S/MIME or additional encryption, if your admin has enabled it. All Gmail messages also travel over TLS automatically.

What your Gmail account can actually do

Google's page on how Gmail encrypts your emails splits encryption into three levels, and the account you are signed in to decides which ones you see.

The editions are from Google's admin pages, checked November 1, 2026. Hosted S/MIME is available on Frontline Plus, Enterprise Plus, and Education Fundamentals, Standard and Plus, per Google's S/MIME admin page. Client-side encryption is on Enterprise Plus, Education Standard, Education Plus and Frontline Plus, per Google's client-side encryption page. Confidential mode is in every Workspace edition, but an admin can switch it off.

If you are on a personal account, the S/MIME and client-side options do not exist for you, no matter what settings you dig through.

Read the lock icons first

Before you change anything, know what Gmail is already telling you. Google uses four icons:

• Gray lock: standard encryption. TLS protected the message in transit. Google's email security page adds the catch: "For TLS to work, the email providers for both the sender and recipient must use TLS."
• Green lock: enhanced encryption. Hosted S/MIME, work and school accounts only.
• Blue shield: additional encryption. Client-side encryption, eligible Workspace editions only.
• Red open lock: no encryption. Google's advice is not to send sensitive information, and to tell the sender if a message arrived that way.

To check a message you received, open it, click Show details under the sender, and look next to "security". To check before you send, on a computer or an Android phone, select Message security while composing. A red open lock there means the message would go out unencrypted, so don't send anything sensitive to that address by email. Google notes you may also see a warning on a custom domain address even when the mail is encrypted.

Encrypt email in personal Gmail with confidential mode

This is the only extra option on a free @gmail.com account. Steps are from Google's confidential mode page.

On a computer, including a Mac

1. In Gmail, click Compose.
2. At the bottom of the compose window, click Toggle confidential mode.
3. Click the drop-down to set an expiration date.
4. Choose how recipients open it: No SMS passcode or SMS passcode.
5. Click Save, then write and send the email.

Gmail on a Mac runs in the browser, so these are the Mac steps too.

In the Gmail app on iPhone, iPad or Android

1. Open the Gmail app and tap Compose.
2. In the top right, tap More options, then Confidential mode.
3. Turn on Confidential mode and set the expiration under "Set expiration".
4. Under "Require passcode", pick Standard or SMS passcode.
5. Tap Save.

To pull a message back early, open it in Sent and choose Remove access.

Can you encrypt a Gmail email with a password?

The closest thing Gmail offers is confidential mode's SMS passcode. Gmail texts a code to a phone number you enter for the recipient, and they need it to open the email. Google's instruction is blunt: enter the recipient's number, "Don't enter your phone number." The SMS option only works for phone numbers in North America, South America, Europe, Australia, and India, Korea and Japan in Asia.

With the standard option, Gmail users open the email directly, and people on other providers get the passcode by email instead.

Be clear about what this is. Google's help pages describe confidential mode as a way to set an expiration, revoke access, and disable forwarding, copying, printing and downloading. They don't call it encryption. Google's admin page on confidential mode explains that Gmail removes the body and attachments from the recipient's copy and replaces them with a link, and that "only the subject and link are sent." The content stays in Google's systems the whole time. Google also warns that recipients "can still take screenshots or photos of your emails."

If you need a real password on the content, put it on a file. Word's Encrypt with Password (File, then Info, then Protect Document on Windows) is described on Microsoft's Word password page. Attach the file in Gmail and send the password by a different channel. Our guide to sending a password securely covers that half.

Encrypt email in Gmail with S/MIME (work or school)

Hosted S/MIME is the green lock. It needs your admin to turn it on, and a certificate on your account. From Google's hosted S/MIME page:

1. Get a PKCS #12 certificate file, either from your admin or from a certificate authority.
2. In Gmail, click Settings, then See all settings.
3. Open the Accounts tab. In Send mail as, click edit info next to your work account.
4. Click Upload a personal certificate, choose the file, enter its password and click Add Certificate.

After that, there is no button to press per message. When someone sends you a signed S/MIME message, Gmail saves their public key to the contact, and Gmail automatically encrypts messages you send to anyone whose key it has. So the first step with a new contact is swapping signed emails.

The trade-off is in the name. Google's security page says these keys "are hosted by Google, and they encrypt and decrypt the message." That protects the message from everyone between you and the recipient, not from Google.

Encrypt email in Gmail with client-side encryption (Workspace)

Client-side encryption is the blue shield, and it is the one Google calls end to end. Google's admin overview describes it as "end-to-end encryption that Google servers and third parties can't decrypt," with your organization holding the keys. The user steps:

1. Decide before you start writing. Turning it on mid-draft deletes the draft and opens a new one.
2. Click Compose, then Message security at the right of the message.
3. Under "Additional encryption", click Turn on.
4. Add recipients, subject and text, then click Send. Sign in to your identity provider if asked.

Two things Google's page spells out. First, the subject, timestamps and recipients are not covered by the extra encryption; only the body, inline images and attachments are. Keep sensitive details out of the subject line. Second, sending to people outside your organization works one of two ways: with S/MIME, you exchange signed messages with each contact once before encryption becomes available; with Assured Controls, Google lists a beta that sends end-to-end encrypted email to anyone, and external recipients read it with a Google account or a guest account.

Which option should you use?

• You just want a padlock on normal mail. You have it already. Check for the gray lock and send.
• You want to stop forwarding or set an expiry. Confidential mode, on any account.
• You want the recipient to need a code. Confidential mode with SMS passcode, or a password-protected attachment.
• You need Google out of the message too. Client-side encryption, which means an eligible Workspace edition.

For what Gmail encrypts without you doing anything, including storage and who holds those keys, see does Gmail encrypt emails. The same steps for Outlook and Apple Mail are in how to send an encrypted email.

A mailbox that is encrypted without the extra steps

Secria Mail protects your mailbox with post-quantum encryption, ML-KEM-1024 with X25519, on every plan by default, free included. There is nothing to switch on and no edition to upgrade to. Tracking pixels are removed automatically and senders never see your IP address. You can create a free address with no phone number and no card, just a name, the address you want and a password, then bring your Gmail history across from Settings, then Import & export, then Bring mail in. The details are on the Secria Mail page.

Frequently asked questions

Is Gmail confidential mode encrypted? The notification email travels over TLS like any Gmail message, but Google doesn't describe confidential mode itself as encryption. It replaces the email's content with a link, lets you set an expiry and revoke access, and blocks forwarding, copying, printing and downloading.

Can I use S/MIME on a personal Gmail account? No. Google lists S/MIME for work or school accounts, and hosted S/MIME needs an eligible Workspace edition with the admin setting turned on.

How do I know if my Gmail message was encrypted? Open it, click Show details under the sender, and check next to "security". A gray lock means TLS, a green lock means S/MIME, a blue shield means client-side encryption, and a red open lock means no encryption.

Can someone without Gmail open a confidential mode email? Yes. They get an email with a link and a passcode, sent by email or by text depending on what you chose. They open the message in their browser until it expires or you remove access.

Why can't I find Message security in Gmail? Google documents it for Gmail on a computer and on Android. The S/MIME and additional encryption options inside it appear only on Workspace accounts where an admin has enabled them.

Send one test to yourself at a second address before you rely on any of these. And if you would rather your mailbox be encrypted from the moment it exists, create a free Secria account.