We treat email like a private conversation, but it often works more like a postcard, readable by others as it travels. Understanding email encryption is key to protecting your personal and business data from prying eyes. Here’s what you need to know.
Two Types of Must-Know Encryption
Email encryption scrambles your message to prevent unauthorized access. There are two main types. The first, and most common, is 'encryption in transit'. This is handled by Transport Layer Security (TLS), which protects your email as it travels from your server to your recipient's server. Think of it as a secure courier; the message is protected on its journey but sits in a readable state on the servers at either end. Most major email providers, like Gmail and Outlook, use TLS by default. The second type is 'end-to-end encryption' (E2EE). This is like putting your message in a locked box that only the recipient has the key for. With E2EE, the email is encrypted on your device and can only be decrypted by the intended recipient's device. Even your email provider cannot read the message content.
What Gmail, Outlook, and Others Do by Default
By default, services like Gmail and Outlook automatically use TLS to encrypt messages in transit, so long as the recipient's email server also supports it. In Gmail, you'll see a gray lock icon, which Google calls 'standard encryption', indicating a message was protected by TLS. However, if a recipient's server doesn't support TLS, the message may be sent unencrypted, like a postcard anyone can read. This default level is good for general correspondence but is often insufficient for highly sensitive information like financial details or confidential business documents. The core issue is that while the journey is protected, the email itself is accessible to the email provider on their servers.
How to Check Your Security Settings in Gmail
Google provides a Security Checkup tool that is the best place to start. You can access it by going to your Google Account settings. This tool guides you through reviewing signed-in devices, recent security activity, and third-party apps with access to your account. Inside Gmail itself, you can check specific settings. Go to 'Settings' > 'See all settings'. Under the 'Filters and Blocked Addresses' tab, ensure no filters are auto-forwarding your mail to an unknown address. In the 'Forwarding and POP/IMAP' tab, check that forwarding is disabled unless you set it up. Under 'Accounts and Import', review the 'Grant access to your account' section to ensure no one else has access.
Reviewing Security Settings in Outlook
For Outlook users, security settings depend on whether you use the desktop app, the web version, or a Microsoft 365 subscription. In the desktop app, you can go to 'File' > 'Options' > 'Trust Center' > 'Trust Center Settings' > 'Email Security'. Here, you can manage settings for encrypted email. Microsoft 365 subscribers (including Personal or Family plans) have access to a simple 'Encrypt' button when composing a new message. This uses Microsoft Purview Message Encryption. You can select 'Encrypt-Only' or 'Do Not Forward' to add more restrictions. Free Outlook.com accounts do not have this builtin encryption feature but still use TLS for protection in transit.
When You Need a Higher Level of Security
If you handle truly sensitive data—such as legal documents, financial records, or protected health information—relying on standard TLS is risky. This is where endtoend encryption becomes essential. For Gmail, this can be achieved through 'Confidential Mode' for personal accounts, which adds some controls but isnt true E2EE. For business accounts on specific Google Workspace plans, S/MIME or ClientSide Encryption (CSE) offer true E2EE, marked by a green or blue lock icon, respectively. For Outlook, S/MIME is also an option for business accounts, but it requires setup and coordination between sender and receiver. Alternatively, dedicated E2EE services like Proton Mail and Tuta are built from the ground up for privacy, encrypting everything by default.
