Sending an unencrypted email is like mailing a postcard; anyone who handles it can read its contents. While encryption solves this, not all methods are created equal. The right choice depends on your needs, technical skill, and your recipient.
The Basics: Why Encrypt Email?
Email was
not originally designed for privacy. By default, messages travel across the internet in plaintext, meaning they can be intercepted and read by server administrators or attackers along the route. End-to-end encryption (E2EE) scrambles a message on the sender's device and ensures it can only be unscrambled by the intended recipient. This protects the email's content not just in transit between servers, but also while it's stored in an inbox. The two main standards for this are S/MIME and PGP, which differ significantly in how they are set up and what they ask of the person receiving the email.
S/MIME: The Corporate Standard
S/MIME (Secure/Multipurpose Internet Mail Extensions) is an encryption standard that is widely integrated into major corporate email clients like Microsoft Outlook and Apple Mail. Its security is based on a centralized trust model. To use it, both the sender and recipient must have a digital certificate issued by a trusted Certificate Authority (CA). This certificate acts as a digital passport, verifying their identity. The setup requires purchasing and installing this certificate. Before exchanging encrypted emails, both parties typically need to first exchange a digitally signed message, which shares their public keys and establishes a trusted connection. While seamless within an organization that manages certificates for all employees, it can be cumbersome when communicating with external parties who may not have an S/MIME certificate.
PGP: The Privacy-Focused Power Tool
PGP (Pretty Good Privacy) and its open-source version, OpenPGP, offer robust end-to-end encryption favoured by journalists, activists, and privacy-conscious individuals. Unlike S/MIME's centralized system, PGP uses a decentralized 'Web of Trust'. Users create their own public and private key pairs for free. Trust is established by users signing each other's public keys to vouch for their authenticity. Setup can be complex, often requiring thirdrdparty plugins or software like Gpg4win or Mailvelope. Crucially, for PGP to work, the recipient must also use a PGP-compatible system. The sender needs the recipient's public key before they can send an encrypted message, which requires a manual exchange via a key server or direct communication. This technical hurdle makes it less practical for average business users.
Portal Encryption: The User-Friendly Fallback
What happens when your recipient doesn't use S/MIME or PGP? Secure web portals offer a common solution, especially in sectors like healthcare and finance. Instead of the email itself being encrypted, the sender uses a service that places the message on a secure website. The recipient gets a simple email notification with a link. To read the message, they click the link and log into the portal, sometimes creating a password for access. This method is universally compatible as it only requires the recipient to have a web browser. However, it can create friction for recipients who may have to manage multiple portal accounts and passwords for different senders, and it pulls the conversation out of their regular email workflow.
Choosing Your Method
The best encryption method depends entirely on your context. S/MIME is often the most practical choice for large organizations with managed IT departments, as it can be automated and scaled across thousands of users communicating internally. PGP is the gold standard for individuals or small groups who need maximum privacy and control, and are willing to handle the technical setup and key management. For communicating securely with the general public—clients, patients, or customers who can't be expected to have encryption software—portal-based systems are often the most reliable, despite their clunky user experience. Some modern services act as gateways, automatically choosing the right method for each recipient to simplify the sender's decision.
