Jun 09, 2026 · 5 min read

How to Encrypt Email in Gmail (2026 Guide)

Confidential mode, S/MIME, client side encryption, and PGP all promise to lock down your Gmail. Here is what each one actually protects, which need a paid Workspace plan, and the free route anyone can use.

Email encryption scrambles a message so only the intended recipient can read it. The catch in Gmail is that the option labeled to look like encryption—Confidential mode—is not encryption at all, and the methods that genuinely protect your mail each come with conditions. This guide explains how to encrypt email in Gmail in 2026, what protection each method really delivers, and the one approach anyone can set up for free without a Workspace subscription.

Key Takeaways

Gmail's Confidential mode is not encrypted—Google can read it, and recipients can screenshot it.
S/MIME and client side encryption are true end to end options but require a paid Google Workspace plan.
PGP via the free Mailvelope browser extension is the only end to end route for a regular Gmail account.
Encryption protects the message body, not the metadata—headers still reveal who, when, and where.
Encryption also does nothing to stop tracking pixels; those need a separate blocker.

Is Gmail Confidential Mode Actually Encrypted?

No. Confidential mode is a permission system, not encryption. It lets you set an expiration date, require an SMS passcode, and disable forwarding, copying, printing, and downloading. That sounds protective, but the message is not end to end encrypted—Google can still access the content, and anyone can simply screenshot what is on screen. Use it for low stakes "please do not forward this" situations, not for anything you truly need to keep private.

S/MIME: Encryption for Google Workspace

S/MIME (Secure/Multipurpose Internet Mail Extensions) uses public key cryptography to encrypt and digitally sign messages, providing real end to end protection so only the intended recipient can decrypt them. The limitations are practical: it is available only on certain paid Google Workspace (Business and Enterprise) accounts, an administrator must enable it, and both sender and recipient need S/MIME turned on with exchanged certificates. It is the right fit for organizations, not individual free accounts.

Client Side Encryption: The Strongest Native Option

Gmail Client side encryption (CSE) encrypts content in your browser before it is ever transmitted to or stored on Google's servers, so the encryption keys live with your organization rather than with Google. It is the strongest option Google offers natively—but it is limited to Workspace Enterprise Plus and Education Plus plans and requires administrator setup with an external key service. Powerful for regulated enterprises; out of reach for a personal Gmail.

PGP With Mailvelope: The Free Route

For a regular, free Gmail account, PGP (Pretty Good Privacy) is the only true end to end path, and you can use it through Mailvelope, a free open source browser extension for Chrome and Firefox. The basic flow:

Install Mailvelope and generate a public and private key pair inside the extension.
Share your public key with the people who will email you; collect theirs in return.
Compose in Mailvelope's secure editor; it encrypts the body (and attachments) to the recipient's public key.
The recipient decrypts with their private key. Only someone holding that key can read the message.

PGP is robust, but both parties must use it and manage keys—so it works best with a handful of regular correspondents rather than the general public.

Encrypting an email in Gmail with a padlock over the message

What Encryption Does Not Protect

Encrypting the body is a big step, but it leaves two gaps people often miss:

Metadata. Encryption protects the content, not the envelope—senders, recipients, timestamps, and routing stay exposed. We cover this in what your email metadata reveals.
Tracking pixels. Encryption secures what you send. It does nothing about the hidden trackers in mail you receive, which report the moment you open a message regardless of how it was encrypted.

A complete privacy setup pairs encryption for outgoing mail with a tracker blocker for incoming mail. Gblock handles the second half: it blocks tracking pixels and tracking links inside Gmail with an auto updating blocklist. For every blocking method compared, see how to block email tracking in Gmail.

Which Method Should You Use?

If you are on a personal Gmail account, PGP with Mailvelope is your only true end to end option, and it is free. If your organization runs Google Workspace, ask your administrator about S/MIME or client side encryption. Skip Confidential mode for anything genuinely sensitive—it is access control dressed up as privacy, as we explain in does Gmail Confidential Mode actually protect you. And whichever you choose, remember that encryption guards the message, not the metadata or the trackers, so close those gaps too.