How to Encrypt Email in Gmail: Every Option Compared
Gmail already encrypts your email in transit, but that is not the same as making a message unreadable to anyone but the recipient. Google's own help page shows three levels of protection with three icons: a gray lock for standard encryption, a green lock for hosted S/MIME, and a blue shield for client-side encryption (Google). Confidential mode, which many people reach for first, is a fourth thing entirely: it controls what a recipient can do with a message.
This guide compares every way to protect email in Gmail and Google Workspace today: what each one protects, who holds the keys, which editions include it, and what your recipients have to do to read the message. It covers Gmail's built-in options, Google's newer end-to-end encryption, S/MIME, and add-ons such as Virtru.
At a glance
- Keys
- Google and the mail providers
- Editions
- All
- Recipients
- Nothing to do
- Keys
- Editions
- All
- Recipients
- Non-Gmail recipients open a link and may enter a passcode
- Keys
- Google manages a copy of your key
- Editions
- Frontline Plus, Enterprise Plus, Education Fundamentals, Standard and Plus
- Recipients
- Any S/MIME mail client, after exchanging signed mail once
- Keys
- Your external key service
- Editions
- Enterprise Plus, Education Standard and Plus, Frontline Plus
- Recipients
- S/MIME exchange, or a guest account with Assured Controls
- Keys
- Your external key service
- Editions
- Enterprise Plus with the Assured Controls add-on
- Recipients
- Read and reply through a guest account in the browser
- Keys
- Virtru, or your own keys on higher plans
- Editions
- Works with Google Workspace
- Recipients
- Read in Virtru Secure Reader in the browser
- Keys
- Google (hosted) or your key service (CSE-wrapped)
- Editions
- Enterprise Plus
- Recipients
- Any S/MIME mail client
The options in detail
Standard encryption (TLS)
Every Gmail account gets it. TLS protects a message while it moves between mail servers, and Gmail shows a gray lock when it was used. A red open lock means the message was not encrypted, usually because the other provider does not support TLS (Google). Google manages the keys, so TLS protects mail from outsiders on the network, not from the providers that handle it.
Confidential mode
Confidential mode is a sharing control, not encryption. Gmail removes the body and attachments from the recipient's copy and sends a link instead; the recipient views the message on Google's servers (Google Workspace Admin Help). You can set an expiry date, revoke access, block forwarding, copying, printing and downloading, and require an SMS passcode (Gmail Help).
It is available in all Workspace editions. Its limits: recipients can still take screenshots or photos, and admins can still search and export the messages in Vault. Use it to limit sharing, not to meet an encryption requirement.
Hosted S/MIME
S/MIME signs and encrypts the message itself with a certificate for each user. Gmail shows a green lock, and Google manages a copy of your key (Google). It is available on Frontline Plus, Enterprise Plus, and Education Fundamentals, Standard and Plus, and an admin turns it on in the Admin console (Google Workspace Admin Help).
The work is the certificates. Every user needs one from a certificate authority that Google trusts, uploaded to Gmail and replaced when it expires or the user leaves (Google Workspace Admin Help). Two people must exchange signed messages before they can send each other encrypted mail. S/MIME is a standard, so recipients need no add-on, only an S/MIME-capable mail client.
Client-side encryption (CSE)
With CSE, Gmail encrypts the body, inline images and attachments in the browser before Google receives them, using keys from an external key service you control. Gmail shows a blue shield. The subject, timestamps and recipients are not encrypted (Gmail Help).
CSE is available on Enterprise Plus, Education Plus, Education Standard and Frontline Plus. It needs an external key service and an identity provider, set up by a super admin (Google Workspace Admin Help). Limits include a 5 MB cap on attachments and inline images, and no Google AI or smart features on encrypted mail (Gmail Help).
Gmail end-to-end encryption to any recipient
Google made this generally available on 2 October 2025. It extends CSE so you can send encrypted mail to anyone, including people outside Gmail, who read and reply through a guest account (Google Workspace Updates). It requires Enterprise Plus with the Assured Controls add-on, and admins must turn it on. Since April 2026 it also works in the Gmail apps for Android and iOS (Google Workspace Updates).
Virtru
Virtru adds encryption to Gmail through a plugin and describes it as a client-side encryption option that does not require S/MIME (Virtru). Recipients without Virtru read and reply in Virtru Secure Reader in their browser (Virtru). Plans are billed annually with five users included, from $119 a month for Starter to $499 a month for Compliance, which lists a FedRAMP Moderate ATO and key hosting (Virtru pricing).
How to choose
Start with what you need to prove, then check which options your Workspace edition allows.
One rule of thumb: if a policy says email must be encrypted, confidential mode does not meet it on its own. Use S/MIME or client-side encryption.
Where Qanapi Flow fits
Qanapi Flow is for teams that want standards-based S/MIME in native Gmail without managing a certificate for every user by hand. Admins select users or a Google Group and click Enable; Qanapi orders, verifies, uploads and renews each certificate. Only the admin needs a Qanapi account, and recipients use any S/MIME-capable mail client.
For the full setup, see How to Set Up S/MIME in Gmail and Google Workspace with Qanapi Flow. To price your user count, create an estimate.
Frequently asked questions
Is Gmail email encrypted by default?
In transit, usually yes: Gmail uses TLS when the other provider supports it and shows a gray lock. That protects the message on the network, but Google manages the keys. A red open lock means the message was sent without encryption.
Is Gmail confidential mode encrypted?
Confidential mode controls access, not encryption. It sends a link instead of the message, lets you set an expiry date, and blocks forwarding and downloads. Recipients can still take screenshots, and admins can still find the messages in Vault.
How do I send an encrypted email in Gmail?
On a supported Workspace edition, an admin turns on S/MIME or client-side encryption. You then click the lock icon in the compose window. For S/MIME, both people must exchange signed messages first. See our step-by-step S/MIME setup guide.
Can I encrypt email on a Business Starter, Standard or Plus plan?
Not with Google's built-in S/MIME or client-side encryption; Google offers those on Enterprise, Education and Frontline Plus editions. Business plans can use confidential mode, or a third-party add-on.
What is the difference between the green lock and the blue shield?
A green lock means hosted S/MIME, where Google manages a copy of your key. A blue shield means client-side encryption, where your own key service holds the keys and Google cannot read the content.
Do recipients need special software?
For S/MIME, they need an S/MIME-capable mail client, which most business mail clients are. For Gmail end-to-end encryption and add-ons such as Virtru, recipients without the same setup read the message in a browser.
See what it costs for your team
Enter your user count and get pricing for Secure Email and Zero Trust in seconds: Create an estimate and our team will follow up. Prefer to see it first? Book a walkthrough of S/MIME working inside Gmail.
