send encrypted email email encryption Outlook encryption Gmail confidential mode S/MIME PGP

How to send an encrypted email: Outlook, Gmail, iPhone

Adrian Maverick · · 10 min read

Most guides to sending an encrypted email stop at "click Encrypt." That gets the message past snoops on the network, but it rarely stops your own email provider from reading it. Below are the exact steps for each app, and for each method, who can still read the message after you hit send.

Quick answer: how do you send an encrypted email?

In Outlook, open a new message, select Options, then Encrypt, and choose Encrypt or Do Not Forward. In Gmail, click the confidential mode lock icon at the bottom of the compose window. For encryption that even your provider cannot read, use S/MIME, PGP, or an end-to-end encrypted email service instead.

Which method should you use? Compare them first

Every method below hides your message from someone. The question is who. This table is the part most guides leave out.

Method What you set up What the recipient needs Can your email provider read it?
Gmail confidential mode Nothing Nothing (an SMS passcode if you require one) Yes
Outlook Encrypt A Microsoft 365 Personal or Family plan, or a work account Nothing (sign in or use a one-time passcode) Yes, Microsoft manages the keys
Gmail S/MIME (work and school accounts) Admin turns it on, certificates uploaded Their own certificate Google keeps a copy of the key
S/MIME in Apple Mail or Outlook, your own certificate A personal certificate Their own certificate No
PGP (Mailvelope, Thunderbird) A key pair Their own PGP key No

If the threat is a person (a nosy forwarder, a shared inbox), the first two rows are fine. If the threat is a platform, a data breach at your provider, or a broad legal request served on it, you need one of the last two. For the reasoning behind that split, see how email encryption actually works.

How to send an encrypted email in Outlook

Outlook's built-in encryption is Microsoft 365 Message Encryption. On a personal account it needs a Microsoft 365 Personal or Family subscription. It works in Outlook.com, the new Outlook for Windows, Outlook for Mac, and the Outlook mobile app.

  1. Start a new message.
  2. Select the Options tab in the ribbon.
  3. Select Encrypt.
  4. Pick a permission level:
    • Encrypt: the message stays encrypted. Recipients on Outlook.com or Microsoft 365 can download attachments without encryption.
    • Do Not Forward: the message stays encrypted and cannot be forwarded or copied. Office attachments stay encrypted after download.
  5. Write your message and send it.

A recipient on Outlook reads it like any other email. A recipient on Gmail or Yahoo gets a link to Microsoft's encrypted message portal and can sign in with that Google or Yahoo account or request a one-time passcode.

Two gotchas from Microsoft's own documentation. First, PDF and image attachments download unencrypted even under Do Not Forward. Second, if you choose no permission at all, the message only gets the standard in-transit encryption every email gets. On work accounts, your IT team may also have set a subject-line tag (such as [secure]) that triggers encryption automatically, so check your company's help pages.

Who can still read it: Microsoft. It runs the encryption service and manages the keys.

How to send an encrypted email in Gmail

Personal Gmail has no true encryption button. What it offers is confidential mode, which adds expiry and access controls.

  1. Click Compose.
  2. At the bottom of the compose window, click Toggle confidential mode (the lock with a clock).
  3. Set an expiration date.
  4. Choose No SMS passcode or SMS passcode. With no SMS passcode, recipients who do not use Gmail get the passcode by email.
  5. Click Save, write the message, and send.

Know what this does not do. Google's help page says recipients "can still take screenshots or photos of your emails." The EFF went further when the feature launched: confidential mode is not end-to-end encrypted, and it "provides zero confidentiality with regard to Google." The message also stays in your own Sent folder.

On Google Workspace work and school accounts, an admin can turn on S/MIME, which Gmail marks with a green lock. Google says that with hosted S/MIME it "securely manages a copy of your key." Only client-side encryption, marked with a blue shield, is one where "not even Google can open your briefcase," and that is a paid enterprise feature your organization has to set up.

Who can still read it: Google, in every mode available to a personal account.

How to send an encrypted email on iPhone and Mac (Apple Mail)

Apple Mail supports S/MIME, which is real end-to-end encryption. You need a personal S/MIME certificate (some issuers, such as Actalis, offer a free one), and you need the recipient's certificate, which you get when they send you a signed email.

On iPhone:

  1. Install your certificate on the iPhone (usually by opening the certificate file and installing the profile).
  2. Open Settings, then Mail (on iOS 18 and later: Apps, then Mail), then Mail Accounts, and choose your account.
  3. Tap Account, then Advanced, and turn on Encrypt by Default.
  4. When you compose, a lock appears next to each recipient's address. A closed blue lock means Mail has their certificate and the message will be encrypted. Tap it to switch encryption on or off for that message.

Apple notes that when you reply to or forward a message, the encryption setting follows the incoming message, not your default.

On Mac: install your certificate in Keychain Access. When you write to someone whose certificate you hold, a lock icon appears in the message header. Click it until it shows closed, then send.

Who can still read it: only you and the recipient.

How to send an encrypted email in Yahoo Mail

Yahoo Mail has no built-in encryption button. Messages travel with standard in-transit encryption and that is all. To encrypt from a Yahoo address, add PGP with a browser extension (next section). Mailvelope lists Yahoo as a supported provider out of the box.

How to send an encrypted email with PGP (any webmail)

PGP works on top of whatever address you already have. The free, open-source Mailvelope extension supports Gmail, Outlook.com, Yahoo, and Zoho Mail. Thunderbird has OpenPGP built in.

  1. Install Mailvelope in Chrome, Edge, or Firefox.
  2. Generate a key pair and set a strong passphrase.
  3. Share your public key with the people you write to, and import theirs.
  4. In your webmail compose window, click the Mailvelope button, write inside its secure editor, choose the recipient's key, and encrypt.
  5. Send as normal. Your provider only ever sees a block of scrambled text.

The cost is setup on both sides. A recipient with no PGP key sees an unreadable block and nothing else.

Who can still read it: only you and the recipient.

The no-setup option: an end-to-end encrypted email service

The reason PGP never went mainstream is key management. An encrypted email service moves that work into the app, so encryption happens without you ever touching a key.

That is how we built Secria Mail. Keys are created on your device and only ever reach our servers encrypted. End-to-end encryption is automatic: no certificates, no key exchange, no extension. Mail that arrives from outside providers is encrypted to your key as soon as it reaches us, so your stored mailbox is sealed with keys we never hold.

Every plan, including the free one, uses hybrid post-quantum encryption (ML-KEM-1024 combined with X25519). That matters for anything you want to stay private for years, because encrypted mail captured today could be stored and decrypted later by a future quantum computer. You can start on the free plan and see how it feels before paying for anything.

Can you send an encrypted email to someone who doesn't use encryption?

Yes, through a portal. Outlook Encrypt and Gmail confidential mode both let recipients open the message through a sign-in or a passcode, with nothing installed. That protects the message from casual interception and from anyone who gets hold of the recipient's inbox later. It does not stop the sending provider, which holds a readable copy. For end-to-end protection, the recipient needs a key: an S/MIME certificate, a PGP key, or an account on an end-to-end encrypted service.

How do you know the email actually went out encrypted?

Look at the sent message. Outlook shows the encryption banner on the message, and Apple Mail shows the lock. For ordinary mail, you can check whether the trip itself was encrypted from the message headers. We wrote a separate walkthrough on how to tell if your email is encrypted, including what the header lines mean.

FAQ

Can I send an encrypted email for free?

Yes. Gmail confidential mode is free but Google can read it. PGP through Mailvelope or Thunderbird is free and end-to-end. Some issuers give out free personal S/MIME certificates. An encrypted email service with a free plan, such as Secria, gives you end-to-end encryption without any setup.

How do I send an encrypted email from Outlook to Gmail?

Use Encrypt in Outlook exactly as above. The Gmail recipient gets a message with a link, then signs in with their Google account or asks for a one-time passcode to read it. They do not need Outlook or a Microsoft account.

Is Gmail confidential mode encrypted?

Only in the way all Gmail is: in transit, with TLS. Confidential mode adds expiry, a passcode, and blocks the forward button. Google can read the contents, and the EFF has called the "confidential" label misleading for that reason.

How do I send a password-protected email?

In Gmail, choose SMS passcode in confidential mode. In Outlook, recipients outside Microsoft get a one-time passcode automatically. Both are access controls on a message the provider can still read. A PGP- or S/MIME-encrypted message is protected by the recipient's key, which is stronger.

Pick the method by who you are hiding the message from, not by which button is closest. Once that is clear, the steps above take about two minutes.

Sources

Secria fact-checks every post against primary sources. Spotted something wrong or out of date? Email hq@secria.me and we will correct it.

Back to all posts