Here Are the Best Ways to Encrypt Your Email.
You probably already know that your email isn’t really that private, especially if you have a free account with a major service provider like Gmail (Google) or Outlook (Microsoft). But if you send sensitive information via email, you can minimize what can be intercepted and by whom by using end-to-end encryption, which generally ensures that only the recipient can read your message. Here’s what you need to know about email encryption and how to set up an additional layer of privacy.
How email encryption works
As detailed in this document from Adaptive Security, most emails are encrypted in transit using the Transport Layer Security (TLS) protocol, preventing anyone from reading your message as it travels from server to server. However, at each server, the encryption is temporarily removed: the content is received and processed in cleartext, then re-encrypted upon transmission, meaning it can be read, logged, and distributed through the provider’s server.
Emails are typically encrypted at rest—for example, on Google’s servers and in the recipient’s Gmail inbox. However, this prevents messages from being read by anyone other than those with physical access to the server hardware, as Google still holds the encryption key and can access the stored data. And, as PCMag notes , Google scans your messages to a certain extent and, in some cases (along with other email providers), may hand over emails to law enforcement and government agencies.
In contrast, with end-to-end encryption (E2EE), emails are read only on the sender and recipient’s devices and can only be decrypted using the recipient’s private key. They are never converted to plaintext during transit between servers and through them to the destination, meaning no one—including server providers, hackers, or law enforcement—can view the content. However, it’s worth noting that E2EE is not impenetrable and does not guarantee complete privacy. For example, metadata such as email subjects and email addresses may remain in plaintext, and encrypted messages are still vulnerable to phishing. Furthermore, forwarding an encrypted message breaks the encryption.
However, end-to-end encryption is especially useful when sending sensitive information that could be valuable to attackers. However, if security and privacy are paramount to you, you may want to consider implementing it for all your emails. The method for implementing encryption depends on whether you’re adding it to your current email service or switching to a separate provider.
Add third-party encryption to your existing email.
If you have an account with a major email service like Gmail, Outlook, or Apple Mail, you can add a third-party tool that overlays an encryption protocol like OpenPGP on top of your existing account. PCMag recommendsPreVeil , SecureMyEmail , and Virtru (which is only available to Gmail users on Chrome) for those who want to preserve their current email. Mailvelope is a browser extension (and therefore a desktop-only tool) available in Chrome, Firefox, and Edge, although it can also be installed on other browsers like Brave, which are built on the same architecture. FlowCrypt integrates with Gmail and Google Workspace on desktop and mobile devices.
It’s worth noting that Google Workspace and Microsoft 365 enterprise users have access to true end-to-end encryption without the need for third-party add-ons. Gmail’s Confidential Mode and Outlook’s Encryption feature, available to all users, are not equivalent to end-to-end encryption, as the keys are still managed by Google and Microsoft, respectively.
Switch to a dedicated encrypted email provider.
For those ready to start from scratch with a new email address (or have their own domain), providers like Proton Mail or Tuta offer built-in end-to-end encryption. However, keep in mind that by default, this only works between users of the same service—that is, from one Proton user to another. If you want to send an end-to-end encrypted email from Proton to, say, a Gmail user, you’ll need to set up password protection (and share the password through another secure channel) or use a PGP-compatible tool, such as those listed above. Proton’s Gmail integration also enables end-to-end encryption, but only if both Gmail users use the Proton integration .
Ultimately, email wasn’t designed to be a highly secure method of communication. End-to-end encryption certainly adds an extra layer of privacy and security if you take the necessary steps to set it up, but it’s still susceptible to human error and social engineering.