How to Encrypt Email (And the Best Encrypted Email Services)

This in-depth guide shows you exactly how to encrypt email, while also taking a look at the best encrypted email services.

Despite being one of our oldest methods of online communication, email is still one of the most popular. Untold billions of email messages fly around the world every day, carrying personal and business messages that we depend on, making email a prime target for snoops and spies of all types.

Unfortunately, experience shows that most large email providers do not respect the privacy of your inbox. For example,

• Gmail was caught giving third parties full access to user emails and also tracking all of your purchases. (See our guide on the best Gmail alternatives.)
• Advertisers are allowed to scan Yahoo and AOL accounts to “identify and segment potential customers by picking up on contextual buying signals, and past purchases.”
• Yahoo was also caught scanning emails in real-time for US surveillance agencies.

And the problem runs deeper than the policies of your email provider.

Where your email service is located can have a huge impact on your email privacy. While jurisdictions like Switzerland have laws that protect your online privacy, others (unfortunately including the United States and its Five Eyes friends) have laws in place to erode it.

Leaving aside all the folks who can legally stick their nose into your email communications, there are also the illegal peeping Toms. While email services take steps to protect your messages from outsiders (aside from themselves), these steps are not foolproof.

Data breaches do result in crooks getting their hands on the passwords of email accounts, which can result in identity theft, fraud, and other crimes. Hackers do manage to get access to people’s inboxes. If some creep gets access to your inbox, there is nothing to stop them from reading your email and stealing all that juicy personal information.

As you can see, email security is a big issue today. There are a lot of different ways in which your email privacy can be compromised. In this guide, we’ll talk about various scenarios in more detail, and I’ll show you how to encrypt your email to protect against at least some of these problems.

Why is email encryption important?

Once you see the scope of the problem, we think you’ll agree that you need to encrypt at least some of your emails.

Data breaches – Breaches of the databases at companies large and small expose hundreds of millions, if not billions of records per year. Some unknown number of those records are email messages, stored on mail servers around the world. Bad guys of all stripes target email messages because they can contain valuable information that can be sold or used for fraudulent activities. Financial data, vacation plans, corporate strategies, and personal data are all juicy targets.

Pervasive surveillance – Years ago, Snowden and others revealed the vast scope of surveillance programs (many of at best marginal legality) that are being run around the world. Since then, the problem has only grown, with governments around the world sucking up every bit of email data they can get their hands on. Private companies are in on the act too, who may collect and sell your email content, or use it to target you with heads.

Because most email services store your data on their servers in unencrypted form, you have no real privacy. Hoping that big providers of free email services like Gmail won’t read your messages and use what they find for their own purposes, is foolish in the extreme.

We know that Gmail, for example, reads through every message you send or receive looking for information like airline reservations to add to your calendar. Then there is Smart Reply, an optional feature that reads messages so it can suggest short replies that might be relevant to the content of that message. While features like these can be useful, they can only work if Gmail can read and understand (at least a little bit) your email messages.

How can you protect your email messages?

There are a few approaches you can take to protecting your email messages from being read by the wrong people. The easiest solutions are ones where the email provider makes sure that only the intended recipient can read the messages you send.

Gmail’s Confidential mode

Gmail’s Confidential mode is an example of an approach where the email provider makes sure that only the intended recipient can read messages. Beyond controlling access to the message, Confidential mode restricts what the recipient can do with the message (no forwarding, etc.), and causes the message to be inaccessible after a set amount of time. This sounds good, so let’s keep going with it.

To use Confidential mode, you compose your message normally. When you are ready to send the message, you select Confidential mode. Gmail displays the following dialog box:

This looks promising. For someone to read the message, they will need to enter the passcode. But there are a couple of drawbacks to this approach.

First is that passcode. Note the sentence circled in red, “All passcodes will be generated by Google.” In other words, Google is in control of the code that gives access to the message, not you, and not the recipient.

Second is the fact that selecting Confidential mode doesn’t hide the contents of your message from Google. Confidential mode protects your mail from everyone except Google. It doesn’t create an encrypted email message. It simply prevents someone from seeing the message unless they enter the password.

A solution like this is only useful if you don’t mind your email provider continuing to have access to your email.

If you really want to protect the privacy of your inbox, you can’t rely on solutions like Confidential mode. It is time to talk about email encryption.

About email encryption

Email encryption is a growing market. According to Facts and Factors, the global email encryption market is expected to grow at a compound annual growth rate of 21.4% fro 2021 to 2026. Clearly there is widespread demand for email encryption.

If we start talking about the details of various ciphers and encryption algorithms used in email encryption, we’ll be here for a very long time… and your email may never get encrypted. So we’re going to try to keep this discussion at a high level.

To protect your email against any and all of the attackers we discussed at the top of this article, we need to use something called end-to-end encryption. This is often abbreviated as E2E encryption (or even E2EE).

Why use E2E encryption with email

E2E encryption means that you encrypt something (email in our case) on your computer or mobile device, and the recipient decrypts it on their computer or mobile device. Why is this important?

Think about how an email message gets from you to the recipient. You create the message in some email program. When you hit Send, the message passes out of your computer onto a connection controlled by your Internet Service Provider (ISP). The message then goes to your email provider, who passes it along another connection controlled by some other service, and so on. Eventually, the message arrives in the recipient’s inbox at their email provider. Then it goes through another set of connections controlled by other entities until it ends up on the recipient’s computer to be read.

That’s an awful lot of steps. At any one of those steps it is theoretically possible for someone to try to read your email. E2EE solves this problem. Done right, no one read encrypted messages except the sender and the recipient.

If you encrypt your email before it leaves your device, and the recipient decrypts it once it arrives on their device, no one in the middle will be able to read it.

Since E2E encryption is the way to go, we’ll show you one way you can do it. But first we have to discuss…

The drawbacks of E2E encryption

While E2E encryption is the only way to protect your email from the various threats out there, it does have some real drawbacks, such as:

• It is more complicated than just sending email the old way. You’ll see what we mean in the next section.
• The people who receive encrypted emails need to know what to do with them. This too will become clear shortly.
• The powers that be don’t much like any kind of encryption. For example, the European Parliament is currently considering a bill forcing all email (and other types of messages) to be scanned for possible child abuse.
• Encryption makes it harder for governments and law enforcement to spy on you, corporations to earn money from your personal data, and social media companies to censor you.

How to encrypt email

There are two ways to E2E encrypt email. On the assumption that you are not prepared to change email services right now, we are going to talk about how you can end-to-end email encryption to the bodies of your messages before letting providers like Gmail and company see them.

Recommended: The alternative approach is to switch to a secure email provider that respects your privacy and builds E2E encryption right into their product. For more on this approach, check out our review of the best private and secure email providers.

How email encryption works

The essence of the process is that regular readable text (also called plaintext) gets converted into encrypted text (also known as ciphertext). The “key” to the encryption process is that the algorithms use an encryption key to turn plaintext into ciphertext. Likewise, the decryption algorithm that turns ciphertext back into plaintext depends on a decryption key.

Encrypting an email message turns the body of the message into ciphertext. Some encryption approaches also encrypt additional parts of the message, possibly including the subject line and/or any attachments.

However, certain parts of the email need to remain unencrypted. For example, the email address of the recipient cannot be encrypted if you want the message to actually arrive at its destination!

Other metadata is also readable, one of the key drawbacks of email in general (but we’ll discuss more secure alternatives below).

Symmetric vs asymmetric encryption

There is one more aspect of how encryption works that you need to know about before we can move forward. Remember that we said turning your message into ciphertext requires an encryption key, and turning it back into plaintext requires a decryption key.

The relationship between the encryption key and the decryption key can be either symmetric or asymmetric. In symmetric-key encryption, the encryption key and the decryption key are identical or related by a simple transformation. In effect, the encryption/decryption key pair is a secret shared between the sender and the recipient.

To send a message using symmetric key encryption, the sender encrypts the message using their copy of the secret key and the recipient decrypts it using their copy of the secret key.

In asymmetric-key encryption (more commonly known as public-key encryption) the relationship between the encryption and decryption keys is much more complex. Each person has both a public key and a private key.

The public keys can be shared publicly and are used to convert plaintext to ciphertext. The private keys are kept secret and used to convert ciphertext back into plaintext.

With asymmetric-key encryption, there is no need for a shared secret. Both parties publish their own public keys and keep secret their own private keys.

To send a message using asymmetric key encryption, the sender encrypts the message using the recipient’s public key and the recipient decrypts it using the recipient’s private key.

Pros & cons of encryption methods

As you might expect, each approach has pros and cons.

Symmetric-key encryption is easier to implement, and generally faster to encrypt/decrypt messages, but requires the sender and receiver to somehow agree on an encryption key and share it (securely). This could require a phone call, face-to-face meeting, or some other creative methods.

Asymmetric-key encryption is more complicated, in that it needs some system for discovering the public key of a person you want to communicate with. Certificate Authorities issue digital certificates that certify that a particular public key is owned by a particular person. Certificate Authorities need to be trusted services for this approach to work, but they make it possible to send encrypted messages to someone you have never communicated with before.

Introduction to Mailvelope

There is an encryption solution you can use to add E2E encryption to several webmail services in addition to industry giants like Gmail and Yahoo mail. That solution is Mailvelope, a browser extension for Chrome, Edge, or Firefox. The extension works by adding optional PGP encryption to services that don’t already have it.

The details of using Mailvelope differ for each service, so we won’t give you a “how to” here. Instead, we urge you to visit the Mailvelope website, as well as the support pages of the email service you are considering, to find out if and how Mailvelope works with that service.

What are the best encrypted email services?

As noted above, we think the best solution is to switch to an email provider that offers support for end-to-end encryption. Many email services offer support for various encryption options:

1. One of the most popular encryption methods for email is PGP, which stands for Pretty Good Privacy. Support for PGP is built into most secure email providers.
2. Some email services rely on a unique encryption method, outside of PGP. One popular example of this is with the email provider Tutanota.
3. Email services also allow you to send a link to an encrypted message that can be accessed with a shared password.

If you are open to switching to a secure email service that supports built-in encryption, we’d encourage you to explore our guide on secure and private email services.

Here are the best encrypted email services:

1. Tutanota – Based in Germany; free plans; very secure and open source email with full encryption of email inbox, contacts, calendar, and subject lines. (Tutanota does not use PGP due to concerns over PGP limitations and weaknesses.)
2. ProtonMail – Based in Switzerland; free plans; secure and open source email that is based on PGP encryption
3. Mailbox.org – Secure and private email based in Germany; fully-featured, support for PGP encryption
4. Posteo – Privacy-focused email service based in Germany; anonymous payment options; no support for custom domains; strong PGP encryption standards
5. Mailfence – Secure email based in Belgium, free plans up to 500 MB, fully-featured with built-in support for PGP encryption
6. Runbox – A private email service in Norway, support for PGP encryption
7. CounterMail – Based in Sweden, this email offers strong encryption options (based on PGP).
8. Kolab Now – A higher-priced email service in Switzerland, Kolab Now has some good encryption options while also being fully-featured.
9. StartMail – Based in The Netherlands, StartMail offers built-in PGP encryption support.

We have personally tested (and use) many different encrypted email services. We not only do this just to write reviews; we take data privacy seriously. Below I’m testing out the feature with ProtonMail to send an encrypted message to a person who does not use ProtonMail.

If you are serious about encrypting your email, it would be wise to first start out by switching to a secure email provider. Finding the best encrypted email service is very subjective and all comes down to your own unique needs. Check out our email reviews for an in-depth look at many providers.

What about encrypted email services based in the US?

Did you notice above that none of our recommended encrypted email services are based in the United States?

There’s a reason for this. And that is concerns about privacy and data security. There are many examples of US tech companies being forced to hand over private data to US authorities. This is particularly important with email services. Here are just two examples that we know about:

1. Lavabit – Lavabit was a privacy-focused email based in the US that was forced to shut down when the owner refused to give up the encryption keys to government agents.
2. Riseup – Another US email service catering to privacy-minded users, Riseup was hit with data requests and was forced to comply.

Here’s a quote describing the Riseup situation, which could affect any US-based email service:

After exhausting our legal options, Riseup recently chose to comply with two sealed warrants from the FBI, rather than facing contempt of court (which would have resulted in jail time for Riseup birds and/or termination of the Riseup organization).

There was a “gag order” that prevented us from disclosing even the existence of these warrants until now. This was also the reason why we could not update our “Canary” [warrant canary that warns users about these events].

Recommendation: Choose an encrypted email service located in a good privacy jurisdiction. If you don’t, your data could be at risk.

Encrypted email alternatives

One of the fundamental problems with email is metadata.

Email is structured in such a way that metadata is very difficult to conceal from third parties. Email headers can reveal a lot of private data. What’s worse, PGP, the most widely-used encryption protocol, does not encrypt subject lines. This exposes further data to third parties and potential adversaries.

Another problem is that most people simply do not want to use an encrypted email service and/or encrypt messages. This isn’t an easy problem to get around — unless you use an alternative to email.

Best alternative: encrypted messaging service

We’d recommend using a good encrypted messaging service if you are really concerned about privacy and data security. Most encrypted messaging services do a very good job encrypting data, collect little (or no) metadata, and offer stronger encryption than most email services.

Some of our favorite options are Signal, Session, WickrMe, and others. Check out the best secure messaging services for more options.

Conclusion on encrypting email in 2022

In this world where the assaults on our privacy grow by the day, it behooves us to take whatever steps we can to defend ourselves. One place you can fight back is in your email inbox. Unless you want a vast number of entities (from Google AIs to foreign spies) reading your email messages and doing who knows what with the information they find there, you need to encrypt your email.

Remember: If you aren’t up for rolling your own end-to-end encryption system, you can move your most important email connections to one of the private email services.

ProtonMail, for example, has a free version that handles E2EE for you and uses a system much like Gmail’s Confidential mode to send private messages to people who don’t use ProtonMail. And if your encrypted messaging needs aren’t too intense, you can get by just fine with the free version of ProtonMail or another one of our recommended encrypted email providers.

This guide on encrypted email was last updated on May 10, 2022.