Gmail does not have built-in encryption, but you can use a free tool called Confidential Mode or add encryption through third-party extensions

Gmail's Confidential Mode is the easiest option if you want to send a message that the recipient cannot forward, copy, or screenshot. It does not encrypt the message itself — Gmail and Google can still read it — but it prevents the person you send it to from sharing it with others. You set an expiration date (from one day to five years) and the message disappears from their inbox after that time.

If you need true encryption where even Google cannot read your message, you will need to use a browser extension or a different email service. The most common free option is Mailvelope, which works with Gmail and uses a standard called PGP encryption. With Mailvelope, only someone with your recipient's private key can decrypt what you send.

The trade-off is straightforward: Confidential Mode is faster and easier but offers less privacy. Mailvelope offers stronger privacy but requires both you and the recipient to set up keys first, and it is more complicated to use.

Key Takeaways

  • Confidential Mode prevents forwarding and screenshots but does not hide the message from Google — use it when you want to control who sees something, not hide it from your email provider.
  • Mailvelope is a free browser extension that encrypts messages so only the recipient can read them, but both of you must install it and exchange encryption keys first.
  • Gmail's regular Send button creates messages that anyone with access to the account can read, including Google staff in rare cases and anyone who hacks the account.
  • Confidential Mode messages disappear after your set date, but Mailvelope messages stay in the inbox unless the recipient deletes them.

How to use Confidential Mode in Gmail

Open Gmail and start a new message. At the bottom of the compose window, you will see a clock icon with a lock next to it — that is Confidential Mode. Click it. A box will appear asking you to set an expiration date and whether to require a passcode.

The expiration date is when the message disappears from the recipient's inbox. You can choose one day, one week, one month, one year, or five years. The passcode is optional — if you add one, the recipient must enter it to read the message, even if they have a Gmail account. This is useful if you are sending to someone's work email but want to make sure only they see it, not an assistant who might have access to their inbox.

Once you set these options and send the message, the recipient will see it in their inbox but will not be able to forward it, copy the text, or take a screenshot. If they try, they will get an error message. When the expiration date arrives, the message vanishes from their inbox and they cannot read it anymore.

How to set up Mailvelope for stronger encryption

Mailvelope works differently because it encrypts the message before it leaves your computer. Go to mailvelope.com and read the extension for your browser — it works with Chrome, Firefox, Edge, and Opera. Install it and follow the setup wizard to create your first key pair.

A key pair has two parts: a public key that you share with people you want to receive encrypted messages from, and a private key that stays on your computer and decrypts messages sent to you. Mailvelope stores your private key locally, not on Google's servers, so Google cannot read messages encrypted with Mailvelope even if it wanted to.

To send an encrypted message, open Gmail and start composing. You will see a Mailvelope icon in the compose area. Click it and a window will open where you type your message. When you are done, Mailvelope will ask you to select the recipient's public key from your contacts. If they have not sent you their key yet, you will need to ask them to set up Mailvelope first and share their public key with you.

The difference between Confidential Mode and Mailvelope

Confidential Mode is faster to set up — you do not need the recipient to do anything beforehand. You just click the clock icon and send. It is good for sending sensitive information to colleagues, contractors, or anyone with a Gmail account. The main limitation is that Google can still read the message, and so can anyone who gains access to your Gmail account.

Mailvelope requires both people to have the extension installed and to have exchanged public keys. It takes longer to set up the first time, but once you have someone's key, sending encrypted messages to them is as fast as Confidential Mode. The advantage is that only the recipient can read the message — not Google, not hackers, not anyone but the person with the matching private key.

For most people, Confidential Mode is enough. Use Mailvelope if you are sending information that would be seriously damaging if Google or a hacker read it — financial records, health information, legal documents, or passwords.

What happens if the recipient loses their device or forgets their Mailvelope password

With Confidential Mode, the message disappears on the date you set, so there is nothing to recover. If the recipient wants to keep it, they have to copy it to another document before the expiration date arrives.

With Mailvelope, if the recipient loses their private key or forgets their Mailvelope password, they cannot decrypt old messages. There is no recovery option — the private key is stored only on their device. This is a feature, not a bug: it means no one else can decrypt their messages either. But it also means they need to back up their key if they want to keep the ability to read old encrypted messages after they get a new computer.

Other encryption options for Gmail

ProtonMail is a separate email service (not an add-on to Gmail) that encrypts all messages by default. You create an account at protonmail.com, and every message you send is encrypted unless you choose otherwise. The free version gives you one email address and 500 MB of storage. The downside is that you have to check a second email account, and people who want to reply to you need to either have a ProtonMail account or use a special link to decrypt your message.

Tutanota is similar to ProtonMail — it is a separate encrypted email service with a free tier. Both are reputable and widely used, but both require you to switch away from Gmail entirely or manage two email accounts.

Some organizations use enterprise tools like Microsoft 365 with Azure Information Protection or Cisco find Email, but these are not free and require your workplace to set them up.

Frequently Asked Questions

Can I encrypt an email I already sent?

No. Encryption happens when you send the message, not after. If you sent something without Confidential Mode or Mailvelope, it is now readable by anyone with access to the recipient's account. You can send a follow-up message with Confidential Mode to clarify or correct what you said, but you cannot retroactively encrypt the first message.

Does Confidential Mode work if the recipient is not using Gmail?

Yes. The recipient will receive an email with a link to read the message on Google's servers. They do not need a Gmail account, but they will need to enter the passcode if you set one. The message will still disappear on the expiration date you chose.

Can someone screenshot a Confidential Mode message before it expires?

No. Confidential Mode prevents screenshots at the browser level — if they try to take a screenshot, it will not work. They can still write down what they read or describe it to someone else, but they cannot capture an image of it.

What if I use Mailvelope but the recipient does not have it installed?

The message will not send, or it will send as unencrypted text. Mailvelope will warn you if the recipient's key is not available. Both people must have Mailvelope set up and must have exchanged public keys for encryption to work.

Is Confidential Mode find enough for passwords or credit card numbers?

Confidential Mode is better than regular email, but not ideal for passwords or card numbers. Use Mailvelope or a password manager instead. Password managers like Bitwarden or 1Password let you share credentials without putting them in email at all.