How to send an encrypted email in Gmail
Gmail already encrypts messages in transit. For extra control, use Confidential mode; for true certificate-based encryption, you need a Google Workspace plan with S/MIME.
Every Gmail message is sent with TLS encryption in transit automatically. For more protection, click Compose, then the Toggle confidential mode icon (a lock with a clock) at the bottom, set an expiration date, choose whether to require an SMS passcode, click Save and send. Full S/MIME encryption is only available on certain Google Workspace plans.
What Gmail encrypts automatically
Google says all Gmail messages use TLS automatically. That protects the message while it travels between Gmail and the other email service, as long as that service supports TLS too. Look for the lock icon when you view a message:
- Red open lock: the message was not encrypted in transit (the other service does not support TLS).
- Green lock: enhanced S/MIME encryption (Workspace only).
- Blue shield: client-side encryption (some Workspace plans).
Use Confidential mode (free Gmail)
- Click Compose.
- At the bottom, click Toggle confidential mode (the lock-and-clock icon).
- Set an expiration date.
- Choose No SMS passcode or SMS passcode. With SMS, the recipient must enter a code sent to their phone.
- Click Save, then send.
Recipients cannot forward, copy, print or download the message, and you can cut off access early: open the message in Sent and click Remove access.
Confidential mode is not end-to-end encryption. Google can still see the message, and recipients can take a screenshot or photo of it. Do not use it for passwords or anything that would be harmful if copied.
Hosted S/MIME (Google Workspace)
S/MIME encrypts the message with digital certificates, and Gmail shows a green lock. It is available on Google Workspace Enterprise Plus, Frontline Plus and Education Fundamentals, Standard and Plus, and an administrator has to turn it on. It is not available for free Gmail accounts, and it works only when both sides have S/MIME set up.
Sending something truly sensitive?
- Share the file through Google Drive with access limited to that person, rather than attaching it.
- Or use an end-to-end encrypted service such as Proton Mail.
- Never email Social Security numbers, card numbers or passwords in plain text.
Steps checked against the official help pages in October 2026. Menus move from time to time; if yours looks different, tell us.
Questions people ask
- Is Gmail encrypted?
- In transit, yes: Gmail uses TLS automatically when the other service supports it. It is not end-to-end encrypted by default.
- Can I password-protect an email in Gmail?
- Confidential mode with SMS passcode is the closest built-in option. For a password-protected file, protect the PDF or ZIP itself before attaching it.
- Does Confidential mode work with Outlook or Yahoo users?
- Yes. They get a link to view the message in a browser, and may need a passcode.
Sending one email to a whole list? Check the addresses first with Veml, which removes bad and risky emails before you hit send. (Veml and EmailNa have the same owner.)