Gmail does not offer built-in encryption for individual messages, but you can use Google's confidential mode to set expiration dates and prevent forwarding

Gmail itself has no native encryption feature that scrambles your message content so only the recipient can read it. What Gmail offers instead is confidential mode, which lets you set an expiration date on a message and prevent the recipient from forwarding, copying, downloading, or printing it. This is not encryption — the message still travels through Google's servers unencrypted — but it does limit what someone can do with the message once they receive it.

If you need actual encryption where the message content is scrambled end-to-end, you will need to use a third-party tool or switch to an email provider that builds encryption in. Gmail's confidential mode is useful for sensitive information like passwords or account numbers where you want the message to disappear after a set time, but it is not the same as encryption.

Key Takeaways

  • Gmail's confidential mode sets an expiration date and prevents recipients from forwarding or copying the message, but does not encrypt the content itself.
  • To use confidential mode, click the lock icon when composing, set an expiration time from one day to five years, and optionally require a passcode.
  • True end-to-end encryption in Gmail requires a third-party extension like ProtonMail Bridge or Mailvelope, which encrypts before the message leaves your device.
  • If encryption is critical for your work, consider switching to an email provider like ProtonMail or Tutanota that encrypts all messages by default.

How to turn on confidential mode in Gmail

Open Gmail and start composing a new message. At the bottom of the compose window, you will see several icons: the paperclip (attach), the smiley face (emoji), and others. Look for the lock icon with a clock — that is confidential mode. Click it.

A dialog box will appear asking you to set an expiration time. Your options are one day, one week, one month, one year, or five years. Choose how long you want the recipient to be able to see the message. After the expiration time passes, the message will disappear from their inbox and they will no longer be able to read it.

You can also require a passcode. If you turn this on, the recipient will need to enter a code to open the message — you send the code separately, outside of Gmail. This adds a small extra layer of security, though the message itself is still not encrypted. Once you have set the expiration and passcode options, compose your message and send it normally.

What confidential mode actually protects

Confidential mode prevents the recipient from forwarding your message to someone else, copying the text, downloading it, or printing it. If they try any of these actions, Gmail will block them. The message will also disappear automatically after your chosen expiration date, so there is no permanent copy sitting in their inbox.

This is useful if you are sending something like a temporary password, a social security number, or a sensitive business detail that you do not want floating around. It keeps the message from being accidentally shared or stored permanently.

However, confidential mode does not stop someone from taking a screenshot of the message while it is open on their screen, or from photographing their monitor. It also does not encrypt the message in transit — Google can still read it, and so can anyone who gains access to Google's servers. If you need protection against Google itself or against interception during transmission, confidential mode is not enough.

Using third-party encryption tools with Gmail

If you need true end-to-end encryption, you can add it to Gmail using a browser extension. Mailvelope is one of the most common options. It encrypts your message on your device before it ever leaves Gmail's servers, so only someone with the correct decryption key can read it.

To use Mailvelope, install the extension from the Chrome Web Store or Firefox Add-ons. Once installed, you will see a new button in Gmail's compose window. Click it to encrypt your message. The recipient will need Mailvelope installed as well, or they will receive a link to a webpage where they can decrypt the message using a password you provide.

ProtonMail Bridge is another option if you use ProtonMail as your primary email provider. It lets you send encrypted messages to Gmail users, though they will need to click a link to read the encrypted content. The setup is more involved than Mailvelope because it requires configuring ProtonMail Bridge on your computer.

When to use confidential mode versus switching providers

Use confidential mode if you send sensitive information occasionally and want a straightforward way to prevent forwarding and set expiration dates. It requires no setup, works with any Gmail recipient, and handles most everyday security needs.

Switch to a provider like ProtonMail or Tutanota if encryption is central to your work — if you handle client data, legal documents, or financial information regularly. These providers encrypt all messages by default, so you do not have to remember to turn on a feature each time. They also encrypt messages between users of the same service automatically, without requiring the recipient to install anything.

Use a third-party extension like Mailvelope if you want to stay in Gmail but need encryption for specific messages. This is a middle ground: you keep your Gmail account and contacts, but you add encryption on top when you need it.

Limitations of Gmail's security features

Gmail scans all messages for spam and malware, which means Google reads your messages. If you need privacy from Google itself, neither confidential mode nor Gmail's standard encryption will help. Only end-to-end encryption with a tool like Mailvelope or a provider like ProtonMail prevents Google from reading your messages.

Confidential mode also does not protect against phishing or account compromise. If someone gains access to your Gmail account, they can still read your sent messages and turn off confidential mode on drafts before sending. If someone compromises the recipient's account, they can read the message before expiration. Confidential mode is a convenience feature, not a security feature against account takeover.

Third-party encryption tools are more find but add friction. The recipient may not have the tool installed, or they may find the decryption process confusing. If you use encryption, you will need to communicate with recipients about how to read your messages.

How to know if your message was encrypted

If you used confidential mode, you will see a lock icon next to the message in your sent folder. The recipient will see a lock icon in their inbox as well, and they will see the expiration date and any restrictions you set.

If you used Mailvelope or another third-party tool, the message will show as encrypted in your sent folder, and the recipient will see a notice that the message is encrypted. They will need to click a button or link to decrypt it.

If you did not use either of these features, your message was sent unencrypted. Gmail uses TLS encryption in transit (the same technology that secures websites), but the message itself is not encrypted, and Google can read it.

Frequently Asked Questions

Can I use confidential mode on messages I have already sent?

No. You must turn on confidential mode before you send the message. Once a message is sent without confidential mode, you cannot add it retroactively. You can delete the message from the recipient's inbox if you have not read it yet, but this only works if they have not opened it.

What happens to a confidential message after it expires?

The message disappears from the recipient's inbox and they can no longer open it. It is deleted from their account. A copy remains in your sent folder, but you can delete that manually if you want.

Do I need to do anything special to receive encrypted messages?

For confidential mode messages, no — Gmail handles them automatically. For messages encrypted with Mailvelope or similar tools, you will need the same extension installed. If you do not have it, you will see a link to decrypt the message on a webpage instead.

Is confidential mode the same as end-to-end encryption?

No. Confidential mode prevents the recipient from forwarding or copying the message and sets an expiration date, but it does not encrypt the message content. Google can still read it. End-to-end encryption scrambles the message so only you and the recipient can read it.

Can someone screenshot a confidential mode message?

Yes. Confidential mode prevents copying and downloading, but it cannot stop someone from taking a screenshot of their screen. If preventing screenshots is important, you need a different approach, like sending the information verbally or through a video call instead.