How to encrypt email in Outlook: new, classic, web, Mac

Outlook can encrypt a message in two ways: Microsoft Purview Message Encryption, which is the Encrypt button, and S/MIME, which needs a certificate. Which one you get depends less on the Outlook version than on the account and subscription behind it. Here are the steps for each version, and what the person on the other end actually sees.

How do you encrypt an email in Outlook?

Open a new message, select Options, then Encrypt, and pick Encrypt or Do Not Forward. That works in new Outlook, classic Outlook, Outlook on the web and Outlook.com, as long as your account has a qualifying Microsoft 365 subscription. If the Encrypt button is missing, your account doesn't include it, and S/MIME with a certificate is the other route.

Which encryption does your account get?

Microsoft's own page on securing and protecting email in Outlook breaks it down by account type. Here is that table, trimmed to what matters for sending:

Everyone in the table can open encrypted mail that other people send them. Only the first two rows can send it.

For work and school accounts, the Encrypt button is Microsoft Purview Message Encryption. Microsoft's Message Encryption FAQ lists the plans that include it: Office 365 Enterprise E3 and E5, Microsoft 365 Enterprise E3 and E5, Microsoft 365 Business Premium, Office 365 A1, A3 and A5, and Office 365 Government G3 and G5. Microsoft 365 Business Basic, Business Standard, Office 365 E1, F3 and Exchange Plans 1 and 2 need the Azure Information Protection Plan 1 add-on. Each user who sends encrypted mail needs a license. If you have one of these plans and the button still isn't there, your admin has not set it up.

Encrypt vs Do Not Forward: which should you pick?

Both options encrypt the message. The difference is what the recipient can do afterward, and it shows up most clearly in attachments. From Microsoft's page for Microsoft 365 Personal and Family subscribers:

• Encrypt keeps the message encrypted but puts no limits on what the recipient does with it. Recipients on Outlook.com or Microsoft 365 can download attachments without encryption. Anyone else downloads them from Microsoft's encryption portal using a temporary passcode.
• Do Not Forward keeps the message encrypted and stops it from being copied or forwarded. Word, Excel and PowerPoint attachments stay encrypted even after they are downloaded, so a forwarded copy won't open for someone else. PDFs and images can still be downloaded without encryption.
• No permission set is the default. It means no message encryption, only the opportunistic TLS Outlook uses for every connection with the recipient's provider.

Pick Encrypt when you just want the message protected on its way and in the recipient's inbox. Pick Do Not Forward when the recipient passing it along is the risk. Work accounts may see extra options, such as custom templates your organization created. And if you are sending a PDF that must not travel further, Do Not Forward won't stop that, so send it a different way.

Steps for each version of Outlook

New Outlook for Windows

1. In a new message, select Options, then Encrypt.
2. Choose Encrypt or Do Not Forward.
3. Finish the message and select Send.

Microsoft's encryption steps note that new Outlook supports Purview Message Encryption as long as your organization's email server has an Office 365 Enterprise E3 license. Personal Microsoft 365 subscribers use the same Options, Encrypt steps.

For S/MIME in new Outlook, select Options, then More Options, and check Encrypt this message (S/MIME). To encrypt everything you send, go to Settings, then Mail, then S/MIME, and select Encrypt contents and attachment for all messages I send.

Classic Outlook (Outlook for Microsoft 365, 2024, 2021, 2019, 2016)

1. In a new message, select Options, then Encrypt.
2. Choose the option with the restrictions you want, such as Do Not Forward.
3. Finish the message and select Send.

To encrypt every outgoing message with S/MIME, select File, then Options, then Trust Center, then Trust Center Settings. On the Email Security tab, under Encrypted email, check Encrypt contents and attachments for outgoing messages. Microsoft warns that every recipient then needs your digital ID to read your mail, which is rarely what you want for a personal mailbox.

Outlook on the web and Outlook.com

On a Microsoft 365 Personal or Family account at Outlook.com, compose a new message, select Options, then Encrypt, and choose Encrypt or Do Not Forward. To remove it, choose No permission set.

On a work account in Outlook on the web, S/MIME sits in a different place: at the top of the message, select More options, then Message options, and check Encrypt this message (S/MIME). This needs the S/MIME control installed first, from Settings, then Mail, then S/MIME. If Outlook can't confirm every recipient can decrypt the message, it shows a warning and lets you send anyway, remove those recipients or check again.

Outlook for Mac

Microsoft's Mac page documents S/MIME for current Outlook for Mac:

1. Add your certificate to the Mac keychain, and save each recipient's certificate with their contact.
2. Choose Outlook, then Accounts, select the account, then Security.
3. Under Certificate, pick your certificate and choose OK.
4. In a message, choose See more items, then S/MIME, then Encrypt with S/MIME. If S/MIME isn't there, add it with Customizable Toolbar.

For the Encrypt button on a Mac, Microsoft's page gives the steps for legacy Outlook for Mac: in a message, choose Options, then Encrypt, and pick Do Not Forward or Encrypt-Only. The same page says support for legacy Outlook for Mac was set to end in October 2026, so if you are still on it, move to the current app.

Outlook mobile app (iPhone and Android)

Microsoft's mobile help documents S/MIME. Tap the account control at the top left, tap Settings, tap your account, then Security, and turn S/MIME on. Sign and encrypt options then appear in the compose window. If you don't see Security, Microsoft says your account type or provider doesn't support S/MIME. If your organization manages your phone with Intune, the certificate arrives through the Company Portal app.

Reading is simpler: Outlook for iOS and Android opens Purview-encrypted mail directly, the same as any other message.

Can you encrypt an email in Outlook with a password?

Not in the way most people mean. Outlook has no box where you type a password for the recipient. When you send with Encrypt or Do Not Forward to someone outside Outlook, Microsoft handles the "password" part for you: the recipient proves who they are with a sign-in or a one-time passcode sent to their inbox. Microsoft's page on opening protected messages says each passcode expires after 15 minutes.

If you want a password you choose, put it on the file instead. In Word on Windows, go to File, then Info, then Protect Document, then Encrypt with Password, and save the file. On a Mac it is Review, then Protect, then Protect Document. Microsoft's Word password page notes passwords are limited to 15 characters and that Word can't recover a lost one. Attach the file in Outlook and send the password some other way, such as a text or a call, never in the same email. Our guide to sending a password securely covers that half.

What the recipient sees

It depends on where they read mail.

• Outlook or Microsoft 365. The message opens like any other, with a banner or alert about restricted permissions. Microsoft lists new Outlook, Outlook on the web, Outlook for iOS and Android and Outlook for Windows 2019 and newer as reading encrypt-only messages directly.
• Gmail. A message with a Read your message link. They select Sign in with Google, select Allow, and the message opens in a new browser tab. It never displays inside Gmail itself.
• Yahoo, Comcast, AOL or anything else. The same link, then a one-time passcode sent by email, entered in the browser. Yahoo users can also sign in with their Yahoo account.

Recipients don't need a Microsoft 365 subscription to read or reply, according to Microsoft's email encryption overview, and their replies are encrypted too. S/MIME is the exception: the recipient needs a matching certificate and an app that supports S/MIME, and Microsoft notes that to send S/MIME to external recipients you must install their certificate first.

Tell people a protected message is coming. A link plus a passcode request from an address they don't recognize looks a lot like phishing.

Who can still read an encrypted Outlook message?

The Encrypt button keeps the message away from people who shouldn't see it, and in Microsoft's words the message "stays encrypted and doesn't leave Microsoft 365", so the recipient's mail provider never gets a readable copy. It does not keep Microsoft out. Microsoft's overview says plainly that for Message Encryption, "Microsoft securely manages and stores the keys, so you don't have to." S/MIME is the option where the private keys stay with the people sending and receiving. We go through who holds which key in is Outlook encrypted, and the same steps for Gmail and Apple Mail are in how to send an encrypted email.

If you want encryption without a subscription

On free Outlook.com there is nothing to switch on, because the Encrypt button needs Microsoft 365. Secria Mail takes the other approach: your mailbox is protected with post-quantum encryption on every plan by default, free included, with nothing to turn on. Tracking pixels are removed automatically and senders never see your IP address. Sign-up needs no phone number and no card, just a name, the address you want and a password, and you can import your Outlook mail from Settings, then Import & export, then Bring mail in. See Secria Mail for how it works.

Frequently asked questions

Why don't I see the Encrypt button in Outlook? Your account doesn't have a qualifying Microsoft 365 subscription, or your organization hasn't set up Purview Message Encryption. Free Outlook.com and Hotmail accounts don't get it. Personal and Family subscribers find it under Options when composing.

Is Outlook encryption free? No. Microsoft says encryption needs a qualifying Microsoft 365 subscription. On free accounts, Outlook still uses opportunistic TLS for the connection to the recipient's provider, but there is no message encryption to add.

Can I send an encrypted Outlook email to a Gmail address? Yes. The Gmail user gets a link, signs in with Google, and reads the message in a browser tab. They can reply from there, and the reply is encrypted.

How do I encrypt all emails in Outlook automatically? With S/MIME. In new Outlook and Outlook on the web it is Settings, Mail, S/MIME, then Encrypt contents and attachment for all messages I send. In classic Outlook it is in the Trust Center under Email Security. Work admins can also encrypt automatically with mail flow rules.

What is the difference between S/MIME and the Encrypt button? S/MIME uses certificates that you and the recipient each hold, so both sides need setup. The Encrypt button uses Microsoft's service, needs no setup on the recipient's side and lets you restrict forwarding, but Microsoft manages the keys.

Whichever option you pick, send yourself a test at a Gmail address first so you see exactly what your recipient will see. And if you would rather start with a mailbox that is encrypted from day one, create a free Secria account.