Email Encryption Guide | How S/MIME, PGP, and E2EE Services Like ProtonMail Work

Without encryption, an email's body and attachments travel across the internet in something close to plain text. To reduce the risk of eavesdropping, tampering, and spoofing, you need email encryption. This guide walks you through the main encryption approaches (S/MIME, PGP, and E2EE), how to send encrypted mail from Gmail or Outlook, and how to choose between encrypted email services like ProtonMail and Tutanota.

Table of Contents

1. Why email encryption matters
2. The three approaches to email encryption
3. S/MIME: certificate-based encryption
4. PGP / OpenPGP: public-key encryption for the open web
5. E2EE encrypted email services (ProtonMail and friends)
6. Sending encrypted email from Gmail and Outlook
7. Choosing the right encryption approach
8. Limits and caveats of email encryption
9. Summary

Why email encryption matters

A normal email passes through multiple servers between sender and recipient. While SMTP/IMAP use TLS to encrypt traffic in transit, the email is often stored in plain text on intermediate servers, which exposes you to three classes of risk:

• Eavesdropping: server admins or attackers on the path can read your message body
• Tampering: an attacker can modify the body or attachments without you noticing
• Spoofing: phishing emails can impersonate the sender

For sensitive content — business contracts, medical records, financial data, personally identifiable information — you need to encrypt the body and attachments themselves, not just the transport. Services like Gmail and Proton Mail protect the channel with TLS, but message-level encryption is a separate concern.

The three approaches to email encryption

There are three broad approaches to encrypting email content:

The choice comes down to two questions: do you manage your own keys, or let a service handle it? And do you need to interoperate with arbitrary email systems, or only people inside the same service?

S/MIME: certificate-based encryption

S/MIME (Secure / Multipurpose Internet Mail Extensions) uses an X.509 digital certificate issued by a Certificate Authority (CA) to encrypt and sign mail.

S/MIME characteristics

• Identity backed by an authority (high trust value)
• Supported natively by Gmail (Google Workspace), Outlook, and Apple Mail
• Widely deployed in enterprises and government
• Certificates cost money (free options exist but at lower assurance levels)

Using S/MIME in practice

1. Obtain a personal certificate from a CA such as GlobalSign, DigiCert, or Sectigo
2. Install the certificate in your mail client
3. Share your public key (the certificate) with your recipients
4. Send and receive encrypted mail

Gmail S/MIME requires a paid Google Workspace organization account — personal Gmail cannot send S/MIME mail. Microsoft 365 Business and Enterprise plans support S/MIME out of the box.

PGP / OpenPGP: public-key encryption for the open web

PGP (Pretty Good Privacy) and the standardized OpenPGP spec let you generate your own key pair and exchange public keys directly with recipients — no CA required.

PGP characteristics

• No CA needed; you generate a public/private key pair yourself
• Free; many open-source implementations exist
• Trust comes from a "Web of Trust" of mutually-signed keys
• Technical learning curve is real

Major PGP implementations

• GnuPG (GPG): the canonical open-source implementation, runs on Linux/Mac/Windows
• Mailvelope: a browser extension that adds PGP to Gmail and other webmail
• Enigmail (deprecated): the Thunderbird plugin, now folded into Thunderbird's built-in PGP support

How PGP encryption works

1. Generate your key pair (public + private)
2. Exchange public keys with your correspondent
3. To send: encrypt the body with the recipient's public key
4. To receive: decrypt with your private key

PGP works well inside technical communities where public keys are casually shared and signed. It's harder to use with a brand-new correspondent because you both need a pre-shared public key.

E2EE encrypted email services (ProtonMail and friends)

S/MIME and PGP both require technical setup. Encrypted email services skip that by building end-to-end encryption (E2EE) into the service itself — you write email normally and the service handles the crypto.

Major E2EE email services

How E2EE works between ProtonMail users

Mail between two ProtonMail addresses is automatically end-to-end encrypted. Encryption happens in your browser or app, ProtonMail's servers store only ciphertext, and decryption happens on the recipient's device. Proton themselves cannot read your messages.

Sending to non-ProtonMail addresses

When you send from ProtonMail to Gmail or another external service, the default is normal TLS-protected mail. To force end-to-end protection, use password-protected mail — you set a shared password, the recipient gets a link to a web view where they enter the password to decrypt.

See the Proton Mail overview for a closer look at one specific service.

Sending encrypted email from Gmail and Outlook

You can also get partial protection without leaving Gmail or Outlook.

Gmail's confidential mode

Gmail has a "confidential mode" feature that lets you:

• Set an expiration date (one day to five years)
• Require an SMS passcode to open
• Disable forwarding, copying, and printing for the recipient

This is not real encryption — Google can still read the body. It's access-control sugar applied on top of normal Gmail. Treat it as a mild privacy enhancement, not as cryptographic security.

To use it:

1. Click the lock icon (confidential mode) in the Gmail compose window
2. Configure expiration and SMS requirement
3. Send

Outlook's built-in encryption

Microsoft 365 Business and Enterprise Outlook has "Encrypt-Only" and "Do Not Forward" options. If you've also installed an S/MIME certificate, you can get stronger encryption.

1. In the compose window, choose Options → Encrypt
2. Select Encrypt-Only or Do Not Forward
3. Send

Within the same Microsoft 365 tenant this can be quite strong; mail to external recipients gets a more limited protection model.

Choosing the right encryption approach

Here's a quick recommendation matrix:

For personal, high-trust mail → ProtonMail or Tutanota

For family, friends, and your own backups, a free E2EE service is the easiest entry point. ProtonMail's 1 GB free tier is enough to start with.

For business S/MIME or government workflows → Microsoft 365 + S/MIME

Enterprises and government recipients often require S/MIME. Pair Microsoft 365 Enterprise with a CA-issued certificate.

For technical communities → GnuPG + Thunderbird

Open-source projects and security researchers regularly use OpenPGP. Thunderbird's built-in PGP support and GnuPG are the standard tools.

For casual confidentiality on personal Gmail → confidential mode

If you just want "expires in 7 days, require a code," Gmail confidential mode is good enough. Just remember Google still sees the body.

Limits and caveats of email encryption

Encryption isn't a silver bullet. Watch out for these limits.

Subject lines are never encrypted

Both S/MIME and PGP encrypt the body and attachments, but leave the Subject header in plain text. Never put sensitive content in the subject.

Metadata is still visible

"Who emailed whom, when, and how much" is visible even with encrypted bodies. If full-on anonymity is what you need, look at alternatives like Signal or another dedicated messaging system.

Private-key management is critical

In PGP and S/MIME, losing your private key means permanently losing the ability to decrypt past mail. With a service like ProtonMail, losing your account password can cost you access to the encrypted store. Back up keys and passphrases carefully.

The recipient needs the same setup

S/MIME mail only opens on an S/MIME-capable client. ProtonMail E2EE works only between ProtonMail accounts. Check what your correspondent uses before committing to an approach.

Encryption doesn't stop phishing

Encryption keeps content private; it doesn't tell you whether a sender is real. To spot impersonators, see our phishing email detection guide.

Summary

Pick your email encryption tool by use case:

• Easy personal start: ProtonMail or Tutanota's free plan
• Business / contracts / government: Microsoft 365 + S/MIME certificate
• Technical communities: GnuPG with Thunderbird
• Quick confidentiality on Gmail: confidential mode (expiration + SMS)

Understand the differences between S/MIME, PGP, and service-level E2EE, and choose based on your recipient's environment and your willingness to manage keys. For a broader view of email security risks, see our writeup on free email and security risks.