Secure email services: what end-to-end encryption means

“Encrypted email” can mean two quite different things. Almost all email today is encrypted while it travels between mail servers, but far less of it is end-to-end encrypted, where only the sender and the recipient can read the message. This guide explains what end-to-end encrypted email is, how it differs from encryption in transit, what it does and doesn’t protect against, and how four services (Gmail, Microsoft Outlook, Proton Mail and Tuta) describe their encryption in their own documentation.

Two kinds of email encryption

Encryption in transit (TLS). When an email moves from one mail server to another, the connection can be encrypted using Transport Layer Security (TLS). Think of it as a sealed pipe: nobody listening on the network can read what’s passing through. But at each end, the mail service handles the message in a form it can read, so it can show it in the inbox, filter spam and search it.

Google says “All Gmail messages use TLS automatically”, and that a message is protected in transit when the recipient’s service also supports TLS. If a message arrives with a red open lock icon, Google says it means the message is unencrypted. Microsoft describes the same idea for Outlook: without an encryption setting, messages use “opportunistic TLS”, which Microsoft says encrypts the connection, not the message.

End-to-end encryption. Here the message is encrypted on the sender’s device and only decrypted on the recipient’s device. The mail services in between store and pass on scrambled data they can’t read. That protects the content if a mail server is breached or accessed without permission, but it also means features that rely on reading the message, such as server-side search, can work differently.

Zero-access encryption is a related term. Proton uses it for email that arrives from other services: Proton says such mail arrives over TLS and is then stored with zero-access encryption. That protects stored mail, but the message wasn’t end-to-end encrypted on its way in, so the sender’s email service may have had access to it.

Do you need one?

For many people, the built-in protections of a mainstream email service are what they rely on: TLS in transit, spam and phishing filtering, and account protections such as multi-factor authentication. Google and Microsoft also offer extra encryption options, though, as their documentation describes, mostly with work, school or paid subscriptions.

A dedicated encrypted email service adds something mainly for people who want end-to-end encryption by default, rather than on selected messages or accounts. Whether that suits a person depends on who they write to, what they send and whether their contacts use the same service. For a business, it also depends on the organisation’s obligations and IT setup, which this guide doesn’t cover.

What end-to-end encryption doesn’t protect

Encryption protects the content of a message from people who shouldn’t be able to read it. It doesn’t decide whether the message is trustworthy.

• Phishing still arrives. A scam email can be encrypted just as easily as a genuine one. Scamwatch says “Scam emails look like the real thing, but watch out for links and attachments designed to steal your money or information.” The guide to phishing, smishing and vishing explains how these messages work.
• Some details stay visible. Mail servers need addresses to deliver email. Tuta says email addresses of senders and recipients, and the date an email is sent or received, are not encrypted. Proton says subject lines and addresses are encrypted but not end-to-end encrypted. Google says its client-side encryption doesn’t add encryption to the header, including subject, timestamps and recipients.
• Mail to other services. End-to-end encryption usually works automatically only when both people use the same service. Proton says mail sent to non-Proton users without password protection travels over TLS and isn’t end-to-end encrypted by default, so the recipient’s provider may be able to read it.
• The account and devices. Anyone who gets into the email account, or an unlocked device, can read the mail just as its owner can. The guide to securing online accounts explains strong passwords and multi-factor authentication, and what passkeys are covers a newer sign-in method.
• What happens after it’s read. Once a recipient has the message, they can copy, forward or paste it elsewhere, including into other apps or tools. The guide to using AI chatbots safely touches on sharing personal information with online services.

What to compare

What’s end-to-end encrypted, and when. Some services encrypt automatically only between their own users. Others describe password-protected messages for outside recipients.

What’s left unencrypted. Subject lines, addresses and dates are handled differently by each service. Their own documentation spells this out.

Sending to people on other services. Proton and Tuta describe password-protected messages; Microsoft describes recipients signing in or using a one-time passcode; Google’s S/MIME relies on certificates.

Which accounts get the feature. Google’s S/MIME and client-side encryption are described for work, school and Workspace accounts. Microsoft’s encryption needs a qualifying Microsoft 365 subscription.

Openness. Some providers publish their source code. Tuta describes its software as open source.

Account security. Encryption doesn’t help if someone signs in to the account, so sign-in protections matter for any service.

How the services compare

Based on makers’ published specifications, checked October 2026. Services are listed alphabetically, not ranked.

Plans and prices change; each provider’s site has current details. The service summaries below set out what each provider states.

How to turn on encryption in each service

How encryption is switched on differs by service:

• Gmail. Based on Google’s documentation (checked October 2026), TLS is automatic. S/MIME and client-side encryption are set up by an organisation’s administrator for work, school or Workspace accounts; Google says to contact the administrator if client-side encryption isn’t available.
• Outlook. Based on Microsoft’s documentation (checked October 2026), people with Outlook.com and a Microsoft 365 Personal or Family subscription can choose Encrypt or Do Not Forward when writing a message. Work and school accounts use whatever their organisation has set up. Microsoft’s guide to encrypted email in Outlook has the steps for each version of Outlook.
• Proton Mail and Tuta. Both describe end-to-end encryption as automatic between their own users. For other recipients, both describe setting a password on the message, which the recipient needs to open it. Tuta says this password is exchanged once with each contact and can then be reused.

For businesses on Microsoft 365, sensitivity labels and data loss prevention explains how Microsoft describes protecting information in email at an organisation level.

Things to watch for

• A lock icon isn’t a trust signal. It describes how a message travelled or is stored, not whether the sender is genuine.
• Recovery. Account recovery works differently for each service, and with encrypted mail it can affect access to stored messages. Each provider’s own documentation explains its recovery options, and the guide to securing online accounts covers recovery details in general.
• Attachments. Microsoft notes that with Do Not Forward, PDFs and images can be downloaded unencrypted.
• Feature support. Providers document which apps and features work with their encryption, including third-party email apps.
• Moving providers. Changing email address affects every account that uses it for sign-in and recovery.

Common questions

What is end-to-end encrypted email?

It’s email that’s encrypted on the sender’s device and only decrypted on the recipient’s device, so the mail services in between store and pass on data they can’t read. Most email is instead encrypted in transit with TLS, which encrypts the connection between servers; the mail service can still read the message at each end. Services also differ on what stays visible, such as subject lines and addresses. See two kinds of email encryption.

Do I need an encrypted email service?

For many people, the built-in protections of a mainstream email service are what they rely on: TLS in transit, spam and phishing filtering, and account protections such as multi-factor authentication. A dedicated encrypted email service adds something mainly for people who want end-to-end encryption by default. Whether that suits someone depends on who they write to, what they send and whether their contacts use the same service. See Do you need one?

Is Gmail end-to-end encrypted?

Google describes Gmail’s standard protection as encryption in transit. It says all Gmail messages use TLS automatically when the recipient’s service also supports it, and that a red open lock icon means a message is unencrypted. Google describes hosted S/MIME and client-side encryption for work, school and certain Workspace accounts, plus a beta for Gmail with Assured Controls that can send end-to-end encrypted emails to anyone. See how to turn on encryption.

How do I send an encrypted email in Outlook?

Microsoft says Outlook.com users with a Microsoft 365 Personal or Family subscription can choose Encrypt or Do Not Forward when writing a message, and recipients on other services can read it by signing in or using a temporary passcode. Work and school accounts use S/MIME or Microsoft Purview Message Encryption, depending on what the organisation has set up. Without an encryption setting, Microsoft says messages use opportunistic TLS. Microsoft’s guide has the steps.

Can I send an encrypted email to someone on a different email service?

With some services, yes, though it works differently. End-to-end encryption usually works automatically only when both people use the same service. Proton Mail and Tuta describe password-protected emails for outside recipients, Microsoft describes recipients signing in or using a temporary passcode, and Google’s S/MIME relies on certificates. Proton says mail to non-Proton users without a password isn’t end-to-end encrypted by default. See what to compare.

Can encrypted email stop phishing?

No. Encryption protects message content; it doesn’t check who sent a message, and a scam email can be encrypted just as easily as a genuine one. A lock icon describes how a message travelled or is stored, not whether the sender is genuine. Scamwatch says scam emails look like the real thing, with links and attachments designed to steal money or information. The guide to phishing, smishing and vishing explains how these messages work.

Where to get official help

Scamwatch explains types of scams, including scam emails. Google’s Gmail encryption help and Microsoft’s Outlook encryption guide are the makers’ own references.