Email is the backbone of modern communication, yet standard emails are often compared to sending a postcard: anyone who handles it along the route can potentially read the message. Sending an encrypted email changes this by scrambling your message into unreadable ciphertext that only the intended recipient can decode.

To send an encrypted email, you generally have three options: use the built-in encryption features of your current provider (like Gmail or Outlook), switch to a dedicated secure email service (like Proton Mail), or implement a manual encryption standard (like PGP or S/MIME). The best choice depends on your technical comfort level and whether you are communicating within a corporate environment or seeking maximum personal privacy.

Using Built-in Encryption in Professional Email Services

If you use email for work or education, your organization likely already provides tools to secure your messages. Most professional-grade suites use advanced protocols that handle the heavy lifting behind the scenes.

How to Send Encrypted Emails in Microsoft 365 and Outlook

Microsoft 365 offers robust encryption, but it is typically reserved for paid business or enterprise subscriptions. In our testing of the Outlook desktop client and web interface, the process is straightforward for users within the same organization.

When composing a new message in Outlook, navigate to the Options tab. Look for the Encrypt button (it often features a padlock icon). Clicking this provides several choices:

  1. Encrypt-Only: This ensures the message remains encrypted from end to end. Recipients with Microsoft accounts can read it directly; others may receive a one-time passcode via email to access a secure portal.
  2. Do Not Forward: This not only encrypts the content but also prevents the recipient from forwarding the email, printing it, or copying the text. This is particularly useful for sensitive internal memos or HR-related data.

For those using the Outlook.com web interface, the "Encrypt" button is located in the top toolbar. One observation from our practical use is that if you send an encrypted email to a Gmail user, they will be redirected to a secure Microsoft-hosted webpage. While this adds a step for the recipient, it maintains the integrity of the encryption outside the Microsoft ecosystem.

Managing Confidential Mode in Gmail

It is important to distinguish between "Confidential Mode" in free Gmail and "S/MIME encryption" in Google Workspace.

For standard users, Gmail provides Confidential Mode. While not "true" end-to-end encryption in the cryptographic sense, it prevents the recipient from forwarding, copying, or downloading the email. You can also set an expiration date or require a SMS passcode for the recipient to open the message. To use this, click the clock-and-lock icon at the bottom of the compose window.

For Enterprise and Education users, Google offers Hosted S/MIME. When enabled by an administrator, a lock icon appears next to the recipient's name. A green lock indicates the message is protected by S/MIME, which is a high level of encryption. If the lock is grey, the message is protected by standard TLS (Transport Layer Security), which only protects the email while it is moving through the internet but not while it sits on the servers.

Switching to Privacy-Focused Email Providers

For individuals who want privacy by default without relying on corporate settings, dedicated encrypted email services are the most effective solution. These providers use end-to-end encryption (E2EE), meaning the service provider itself cannot read your messages.

Sending Secure Messages with Proton Mail

Proton Mail is often cited as the benchmark for accessible E2EE. Based on our evaluation of the platform, the encryption is mostly "invisible" to the user, which solves the complexity issue of older encryption methods.

If both the sender and recipient use Proton Mail, every email is automatically encrypted. There is no need to click extra buttons; the platform handles the public and private key exchange in the background.

However, a common challenge is sending a secure email to someone using a non-encrypted service like Yahoo or a standard Gmail account. Proton Mail solves this through Password-Protected Emails:

  1. Compose your message as usual.
  2. Click the Encryption (padlock) icon at the bottom of the composer.
  3. Set a password and a password hint.
  4. Send the email.

The recipient receives a notification that they have an encrypted message. They must click a link and enter the password you provided (ideally through a different secure channel like an encrypted messaging app or a phone call) to read and reply to the message. This ensures that even if their Gmail account is compromised, your specific message remains unreadable without that password.

Other Encrypted Alternatives

Beyond Proton, services like Tuta (formerly Tutanota) and Skiff provide similar E2EE workflows. Tuta, for instance, encrypts the subject line in addition to the body and attachments, which is a step further than some competitors. When choosing between these, consider where their servers are located (e.g., Switzerland or Germany) and their specific privacy laws.

Implementing Third-Party Encryption Plugins

If you are not ready to switch email addresses but need more security than your standard provider offers, third-party plugins can bridge the gap. These tools "layer" encryption on top of your existing Gmail or Outlook account.

Virtru for Enterprise Security

Virtru is a popular choice for businesses that need to meet compliance standards like HIPAA or GDPR. It functions as a browser extension or an Outlook add-in. In a professional workflow, we found Virtru helpful because it allows the sender to revoke access to an email even after it has been sent.

When Virtru is active, a toggle switch appears in your compose window. When turned on, the message is encrypted locally before it ever reaches Google or Microsoft’s servers. This "client-side" encryption ensures that the cloud provider cannot scan your emails for data.

Mailvelope for OpenPGP in the Browser

For those who want to use the OpenPGP standard within their webmail (like Gmail, Outlook.com, or Yahoo), Mailvelope is the most reliable browser extension.

Mailvelope integrates directly into the browser. You generate your own encryption keys within the extension. When you want to send an encrypted email, Mailvelope opens a secure overlay window where you type your message. Once you hit "encrypt," the scrambled text is pasted into your regular email window. It requires the recipient to also have Mailvelope (or any PGP-compatible software) and your public key to decrypt the message.

Advanced Standards for Technical Users

If you require total control over your encryption keys and do not want to rely on any third-party service or plugin, you must look at S/MIME and PGP. These are the "manual" ways to encrypt email, and they require a significant setup.

S/MIME (Secure/Multipurpose Internet Mail Extensions)

S/MIME is the standard for digital signatures and encryption in large-scale corporate environments. It relies on a Certificate Authority (CA) to verify your identity.

To use S/MIME:

  1. Obtain a Certificate: You must buy or obtain a digital certificate from a CA (like Sectigo or DigiCert).
  2. Install the Certificate: The certificate must be installed in your email client’s keychain (e.g., Apple Mail or Outlook).
  3. Exchange Public Keys: To send an encrypted email, you first need the recipient's public key. The easiest way to get this is for both parties to exchange digitally signed (but not necessarily encrypted) emails first. Once you receive a signed email, your client saves the recipient's public key.
  4. Encrypt the Send: Once the public key is stored, the "Encrypt" option becomes available for that specific contact.

The primary drawback of S/MIME is the cost of certificates and the lack of interoperability with webmail services that don't support certificate installations.

PGP (Pretty Good Privacy)

PGP is the gold standard for activists, journalists, and privacy enthusiasts. It does not rely on a central authority. Instead, it uses a "web of trust."

To send a PGP encrypted email, you use a key pair:

  • Public Key: You give this to everyone. They use it to encrypt messages sent to you.
  • Private Key: You keep this secret and use it to decrypt messages you receive.

Using PGP manually involves software like GnuPG (GPG). In our experience, the steep learning curve is the biggest barrier. You must manage your keyrings, ensure your private key is backed up securely (often on a physical hardware token), and manually import the public keys of everyone you wish to contact securely. If you lose your private key, any messages encrypted to you are lost forever—there is no "forgot password" feature in PGP.

Why Encrypting Your Email is Necessary

In an era of frequent data breaches and sophisticated phishing attacks, encryption is no longer just for those with "secrets." It is a fundamental tool for data hygiene.

Protection Against Data Breaches

When a major email provider suffers a server-side breach, hackers can often access the contents of millions of accounts. If your emails are stored in plaintext, all your sensitive information—bank statements, private photos, recovery codes—is exposed. If your emails are encrypted (specifically with "Zero-Access" or E2EE), the hackers only see gibberish.

Compliance and Legal Requirements

For professionals in law, finance, and healthcare, sending unencrypted emails containing client data is often a violation of professional ethics and law. Regulations like the CCPA (California Consumer Privacy Act) and HIPAA (Health Insurance Portability and Accountability Act) often mandate encryption for sensitive data transfers.

Preventing Identity Theft

Many identity theft schemes begin with a hacker "nesting" in a victim's email account. They watch for patterns, find tax returns, and wait for the perfect moment to reset passwords on financial accounts. Encrypting your most sensitive correspondence makes it significantly harder for an intruder to gather the intelligence needed to steal your identity.

Understanding the Limitations of Email Encryption

While encryption is powerful, it is not a magic shield. There are specific things that encryption does not protect, which every user should understand.

Metadata is Still Visible

Encryption typically scrambles the body of the email and its attachments. However, it does not hide the metadata. This includes:

  • The sender’s email address.
  • The recipient’s email address.
  • The subject line (in most cases).
  • The date and time the email was sent.
  • The IP address of the sender.

Because the subject line is often not encrypted, you should never put sensitive information there. Instead of "Quarterly Financial Audit for Project X," use something generic like "Follow-up regarding our meeting."

The Endpoint Vulnerability

Encryption protects the message while it is in transit and while it is stored on a server. However, once the recipient decrypts and opens the email on their device, the protection ends. If the recipient's computer has a keylogger or malware, an attacker can read the message as it is displayed on the screen. True security requires both encrypted communication and secure endpoints (clean, updated devices).

Interoperability Issues

The biggest hurdle in email encryption is that both the sender and the recipient must "speak the same language." A PGP user cannot easily send an encrypted email to an S/MIME user without a bridge. This is why "Portal-based" encryption (like Proton’s password-protected emails) is often the most practical choice for communicating with the general public.

What is the Easiest Method for Most People?

For the vast majority of users, we recommend a two-tiered approach:

  1. For General Use: Use your existing provider's "Confidential Mode" or basic encryption settings for moderately sensitive tasks, like sending a scan of an ID to a trusted person.
  2. For High-Value Privacy: Open a free Proton Mail or Tuta account specifically for your most sensitive communications, such as banking, legal matters, or private health discussions.

Using a dedicated privacy service avoids the configuration headaches of PGP while providing much higher security than standard Gmail or Outlook.

Common Questions About Email Encryption (FAQ)

Does Gmail encrypt all emails by default?

Gmail uses TLS (Transport Layer Security) by default. This encrypts the connection between your computer and Google's servers. However, once the email reaches the recipient's provider, it may no longer be encrypted unless that provider also supports TLS. Furthermore, Google still has the technical ability to "see" the content for features like smart replies or ad personalization (though they claim to have stopped scanning emails for ad purposes).

Can I send an encrypted email from my phone?

Yes. If you use an app like Proton Mail or Tuta, the mobile app handles encryption automatically. If you use Outlook, the mobile app supports the "Encrypt" and "Do Not Forward" options for eligible accounts. Manual PGP on mobile is more difficult and usually requires a dedicated app like OpenKeychain on Android.

What happens if I forget the password to my encrypted email?

If you are using an E2EE service like Proton Mail and you lose your account password (and your recovery phrases), your old emails remain encrypted and unreadable even if you reset your password. This is because your password is used to generate the decryption key. No one, not even the service provider, can recover those messages for you.

Is an encrypted email the same as a secure web portal?

Often, yes. When a bank says they are sending you a "secure message," they are usually sending you a notification email with a link. When you click the link and log into their portal, you are viewing the message over a secure HTTPS connection. This is a common way to bypass the weaknesses of traditional email.

Can attachments be encrypted?

Yes. Most modern encryption methods (E2EE services, S/MIME, PGP, and Virtru) encrypt both the body of the email and any attached files. If you are using a basic service that doesn't support encryption, you can manually encrypt a file (e.g., using a password-protected 7-Zip or Word document) before attaching it to a standard email.

Summary

Sending an encrypted email is the most effective way to ensure your private data doesn't fall into the wrong hands. For corporate users, the best route is utilizing built-in Microsoft 365 or Google Workspace S/MIME tools. For those seeking personal privacy, Proton Mail provides a seamless end-to-end encrypted experience. If you are a technical user who demands full control, PGP remains the most powerful, albeit complex, option. Regardless of the method you choose, remember that encryption is a tool for risk reduction—it protects your content, but you must still be mindful of your metadata and the security of your own devices.