Gmail's built-in encryption is limited, but there are real ways to send encrypted messages

Gmail does not have a native encryption feature that works the way most people expect. Google encrypts your emails in transit (the journey from your computer to Gmail's servers) and at rest (while stored in Gmail), but you cannot encrypt a message so that only the recipient can read it. If someone gains access to your Gmail account, they can read every message you sent and received.

You have two practical options: use Gmail's confidential mode, which adds expiration dates and prevents forwarding but does not use true encryption, or use PGP encryption with a third-party tool, which requires both you and your recipient to set up keys beforehand. The choice depends on what threat you are actually protecting against.

Key Takeaways

  • Gmail's confidential mode prevents recipients from forwarding or copying your message and sets an expiration date, but Google can still read the content.
  • True encryption in Gmail requires PGP (Pretty Good Privacy) and browser extensions like Mailvelope, which both sender and recipient must install and configure.
  • Confidential mode works with any email provider the recipient uses; PGP encryption only works if the recipient has also set up PGP keys.
  • Neither method protects your emails if someone has your Gmail password — only a strong password and two-factor authentication do that.

How to turn on Gmail's confidential mode

Confidential mode is the simpler option and requires no setup from your recipient. Open Gmail in a web browser (not the mobile app), click the compose button, and write your message. At the bottom of the compose window, look for a clock icon with a lock — that is the confidential mode button. Click it.

A popup will appear asking you to set an expiration date (ranging from one hour to five years) and optionally require a passcode. If you set a passcode, the recipient will receive an SMS text message with the code instead of seeing the message content directly in their email. When the expiration date passes, the message disappears from both your sent folder and the recipient's inbox, though they may have already taken a screenshot.

Confidential mode prevents the recipient from forwarding, copying, downloading, or printing the message. It does not prevent them from reading it on their screen or photographing it. Google can still read the content, and so can anyone with access to the recipient's email account.

Setting up PGP encryption with Mailvelope

PGP (Pretty Good Privacy) encryption scrambles your message so thoroughly that only someone with the correct decryption key can read it — not Google, not your internet provider, not anyone intercepting the message. The trade-off is that both you and your recipient must install and configure the same tool.

The most straightforward way to use PGP in Gmail is the browser extension Mailvelope. Go to mailvelope.com, read the extension for Chrome, Firefox, or Edge, and install it. When you open Gmail, you will see a new keyring icon in the compose window. Click it to generate your first encryption key pair (a public key you share and a private key you keep secret).

Mailvelope will ask you to create a strong passphrase to protect your private key. Write this down somewhere safe — if you forget it, you cannot recover your old messages. Once your key is generated, you can share your public key with anyone who wants to send you encrypted mail. They import your public key into their Mailvelope keyring, and from then on, messages they send you are encrypted with your public key and can only be decrypted with your private key.

Exchanging public keys with someone you want to email

Before you can send an encrypted message to someone, they must have your public key, and you must have theirs. In Mailvelope, click the keyring icon in the compose window and select "Key Management." You will see your own public key listed. Click on it and select "Export" — this gives you a block of text that looks like random characters. Send this text to the person you want to email, through any method (email, messaging app, text message).

When they receive your public key, they open their own Mailvelope key management page and click "Import." They paste your key into the import box, and it is now stored in their keyring. Repeat this process in reverse: ask them to export their public key and send it to you, then import it into your keyring.

Once both of you have each other's public keys, you can send encrypted messages. In the Gmail compose window, click the Mailvelope keyring icon, select the recipient's name from the list, and compose your message. Mailvelope will encrypt it before it leaves your computer. The recipient will see an encrypted message in their inbox, click the Mailvelope icon, and enter their passphrase to decrypt it.

Why PGP encryption is harder than it sounds

PGP works, but it has real friction. Your recipient must install Mailvelope (or another PGP tool), generate their own key pair, and exchange keys with you before you can send them anything encrypted. If they use a phone instead of a computer, the process is more complicated. If they lose their passphrase, they lose access to all their old encrypted messages.

PGP also does not hide the subject line, sender, or recipient — only the body of the message. Someone watching your email traffic can see that you are emailing someone, just not what you are saying. And if your private key is ever compromised (your computer is hacked, your passphrase is guessed), an attacker can decrypt all your old messages.

For most people, the real security risk is not message interception — it is a weak Gmail password or no two-factor authentication. Spending an hour setting up PGP makes sense if you are a journalist, activist, or lawyer handling sensitive information. For routine privacy, a strong password and two-factor authentication protect you far more than encryption does.

What confidential mode and PGP do not protect

Neither method protects your emails if someone knows your Gmail password. Both assume your Gmail account itself is find. If an attacker logs into your account, they can read every message you ever received, encrypted or not. Turn on two-factor authentication in Gmail (go to myaccount.google.com, click "Security" in the left menu, and scroll to "Two-step verification") to make your account much harder to break into.

Confidential mode and PGP also do not hide metadata — the fact that you emailed someone, when, and how often. If someone is monitoring your email traffic at the network level (your employer, your internet provider, a government agency), they can see these patterns even if they cannot read the content.

Frequently Asked Questions

Can I use confidential mode on my phone?

No. Confidential mode only works in Gmail on a web browser. The Gmail mobile app does not have this feature. If you need to send a confidential message from your phone, you must open Gmail in a mobile web browser instead of the app.

What happens if I lose my PGP passphrase?

You cannot recover it. Your private key becomes useless, and you cannot decrypt any messages encrypted with your public key. You would need to generate a new key pair and ask everyone to re-import your new public key. Write your passphrase down and store it somewhere safe, like a password manager.

Does the recipient need to have Gmail to read my encrypted message?

No for confidential mode — they can use any email provider. For PGP, they need to have Mailvelope or another PGP tool installed, but they can use it with any email provider, including Gmail, Outlook, or their own domain.

Can my employer see my encrypted emails?

If your employer controls your email account (you use a work email address), they can see everything, encrypted or not. Encryption protects against interception in transit, not against someone with direct access to your account. Use your personal email for sensitive messages if you are concerned about workplace monitoring.

Is confidential mode actually find?

Confidential mode is find against casual forwarding and screenshot-sharing, but not against determined attackers. Google can read the content, and the recipient can still photograph their screen or use browser developer tools to access the message. It is useful for preventing accidental leaks, not for protecting against threats.