In short
Gmail encrypts mail in transit with TLS whenever the receiving server supports it, shown by a grey lock. For sensitive content, Google Workspace offers hosted S/MIME and client-side encryption on Enterprise Plus, Frontline Plus and some Education editions, and confidential mode on every edition. Other editions can add Echoworx or a gateway's encryption.
Get a quote for secure email for Gmail users
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Is Google Workspace email encrypted?
Yes, in transit, and with important limits. Google says all Gmail messages use TLS automatically, so a message is protected between servers when the recipient's mail service also supports TLS, which almost all major services do. If the receiving server does not use TLS, Gmail still sends the message, but the connection is not secure.
Gmail shows the protection a message has with an icon, which you can check by selecting Message security while composing (on a computer or Android) or by opening the recipient details on a message you have received:
| Icon | What Google calls it | What it means |
|---|---|---|
| Grey lock | Standard encryption | Sent with TLS |
| Green lock | Enhanced encryption | Hosted S/MIME: encrypted and signed, with Google managing a copy of the key |
| Blue shield | Additional encryption | Client-side encryption: your organisation holds the only copy of the key |
| Red open lock | Unencrypted | Do not send sensitive information; Google suggests telling the sender |
So the honest answer to "is Google Workspace email encrypted?" is that it is encrypted on the way, but a standard Gmail message is not protected end to end and can be read by anyone with access to either mailbox. For personal or confidential data you need one of the options below.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Gmail's options for sending secure email
What you can use depends on your Google Workspace edition. Google lists the following on its admin help pages:
| Option | What it protects | Editions Google lists | Recipient experience |
|---|---|---|---|
| TLS (default) | The connection, when the other server supports it | All | Nothing to do |
| Secure transport (TLS) compliance | The connection, with delivery refused if TLS is unavailable for listed domains | An Admin console compliance setting | Nothing to do |
| Confidential mode | Sharing: no forward, copy, print or download; expiry and revocation | All Google Workspace editions | Reads via a link, optionally with an SMS passcode |
| Hosted S/MIME | The message itself, encrypted and signed with certificates | Frontline Plus; Enterprise Plus; Education Fundamentals, Standard and Plus | Needs their own S/MIME certificate |
| Client-side encryption | Body, inline images and attachments, with keys held outside Google | Frontline Plus; Enterprise Plus; Education Standard and Plus | Needs S/MIME, or a Google account or guest account where Google's Assured Controls option is used |
| Third-party encryption service | Depends on the service: portal, encrypted PDF, S/MIME or PGP | Any edition | Usually a portal or document that opens anywhere |
Business Starter, Business Standard and Business Plus do not appear in Google's edition lists for hosted S/MIME or client-side encryption, so organisations on those editions usually rely on enforced TLS, confidential mode and a third-party service. Check your edition in the Admin console before you plan.
What Gmail confidential mode does and does not do
Confidential mode is the most visible option, and the most misunderstood. According to Google:
- The content is not sent. Gmail removes the message body and attachments from the recipient's copy and replaces them with a link. In Gmail the content appears as part of the message; other email apps show the link.
- Sharing is restricted. There are no options to forward, copy, print or download the message or its attachments.
- You control access. You can set an expiry date, revoke access at any time and require an SMS passcode. Recipients who do not use Gmail get a separate email with a passcode.
- It is not screenshot-proof. Google says recipients can still take screenshots or photos, and people with malicious programs may still copy or download the content.
- It affects records. Third-party archiving tools cannot access confidential mode content, and Google advises discussing eDiscovery and retention before enabling it. Confidential mode messages cannot be scheduled.
Admins can turn confidential mode on or off for the whole organisation or specific organisational units (Apps > Google Workspace > Gmail > User settings), and can block incoming confidential mode messages with a compliance rule. It is a useful way to stop casual forwarding, but it is not a substitute for encryption when a client contract or regulator expects the content itself to be protected.
Is secure email for Gmail users the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Hosted S/MIME and client-side encryption
On editions that include it, hosted S/MIME encrypts and digitally signs messages, and Google manages a copy of each user's key. To switch it on, an admin goes to Apps > Google Workspace > Gmail > User settings, scrolls to S/MIME and ticks Enable S/MIME encryption for sending and receiving emails, optionally letting users upload their own certificates. Google says changes can take up to 24 hours and messages sent in that window are not encrypted.
S/MIME only works when both sides have certificates. Admins can enforce it with content compliance, attachment compliance, objectionable content or routing rules that Encrypt messages if not encrypted (S/MIME), for example for messages containing card numbers. If Gmail cannot get a recipient's public key, the message is rejected or sent unencrypted, depending on how you set the rule, so test with each partner first.
Client-side encryption (CSE) goes further: your organisation's external key service holds the keys, so Google cannot decrypt the content. The body, inline images and attachments get the extra encryption; the subject, timestamps and recipients do not. For external recipients, Google's help says you exchange S/MIME certificates, unless you use Google's Assured Controls option, which Google describes as a beta for sending end-to-end encrypted email to anyone. CSE suits organisations with strict data-sovereignty needs and the edition to match.
Enforcing TLS with partners
For organisations you exchange sensitive mail with regularly, such as your accountant, solicitor, payroll bureau or parent company, enforced TLS is a simple control that needs nothing from either user.
- In the Admin console, go to Apps > Google Workspace > Gmail > Compliance.
- Choose the organisational unit, point to Secure transport (TLS) compliance and select Configure.
- Choose inbound, outbound or both, and add an address list of the partner domains or addresses.
- Optionally require a CA-signed certificate and verify the hostname, and test the connection.
- Save, then send a test message to each partner.
Google explains what happens when TLS is not available: outgoing messages bounce with a non-delivery report after a single attempt, and incoming messages are rejected with the sender getting the report. That is the point, but tell partners before you switch it on. For mail coming in to your own domain, MTA-STS asks every sender to use TLS, not just the ones on your list.
Third-party options for sending secure email from Gmail
If your edition lacks S/MIME or client-side encryption, or your recipients need something simpler, these services we supply work with Google Workspace:
| Service | How it works with Gmail | What recipients get | Read more |
|---|---|---|---|
| Echoworx | Gmail routes outbound mail to Echoworx over SMTP; senders encrypt by policy or from a Gmail add-on installed from the Google Workspace Marketplace, for one user or the whole organisation | TLS, branded portal, encrypted PDF or attachment, S/MIME or PGP | Echoworx |
| Trend Micro Cloud Email Gateway Protection | A gateway in front of Gmail; encryption comes with the Essentials and Pro packages on the gateway deployment | Depends on the policy configured | Trend Micro email security |
| Proofpoint Essentials | A cloud gateway in front of Gmail (an MX record change); encryption by filter rules or a subject-line tag | Proofpoint's Secure Mail portal, with secure reply | Proofpoint Essentials |
| Sophos Email with Portal Encryption | Sophos Email protecting Google Workspace, with the Portal Encryption add-on | A web portal to read and reply | Sophos Email |
IRONSCALES Email Encryption currently supports Microsoft 365 only, so it is not an option for Gmail. A gateway also changes how inbound mail reaches you; if you only need outbound encryption, a service like Echoworx that leaves your MX records alone is usually less disruptive. Google Workspace email security explains the gateway and API options for inbound protection.
Which option fits your organisation
A quick way to narrow it down:
- You mostly need to stop accidental forwarding of internal or semi-sensitive mail: confidential mode, with an expiry date.
- You exchange sensitive mail with a handful of known firms: enforced TLS for their domains, plus Gmail security settings such as external recipient warnings.
- You are on Enterprise Plus or Frontline Plus and partners use certificates: hosted S/MIME, or client-side encryption if you need to hold the keys.
- You send personal data to clients, patients or the public: a portal or encrypted PDF service with a Gmail add-on, so recipients can open messages on any device.
- You also need to catch sensitive data automatically: pair encryption with email DLP.
Our wider guide to send secure email compares the Microsoft 365 options too, which helps if you run both platforms.
How we help Google Workspace organisations
We work with organisations on Google Workspace, Microsoft 365 or both. We can review your Gmail compliance settings and edition, set up enforced TLS, confidential mode policy and S/MIME where you have it, and recommend, deploy and configure a third-party encryption service where you do not. We test the recipient journey with you and brief staff on when to use each option. We do not sell Google Workspace licences.
Pricing for third-party services depends on the product and number of senders: ask us for a quote. Contact us to talk about sending secure email from Gmail.
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
Is Gmail secure for sending sensitive information?
Gmail encrypts mail in transit with TLS when the other server supports it, which protects it between servers. It does not encrypt the message end to end by default. For sensitive information, use hosted S/MIME or client-side encryption if your edition has them, enforced TLS with known partners, or a third-party encryption service with a Gmail add-on.
Is Google Workspace email encrypted?
Google Workspace uses TLS for every message where the receiving server supports it, shown by a grey lock in Gmail. Message-level encryption needs hosted S/MIME or client-side encryption, which Google lists for Enterprise Plus, Frontline Plus and Education editions, or a third-party service.
How do I send an encrypted email in Gmail?
If your organisation has hosted S/MIME and the recipient has a certificate, Gmail encrypts automatically and shows a green lock. With client-side encryption, select the additional encryption option before you write the message. On other editions, use your organisation's encryption add-on, such as Echoworx's Gmail add-on, or ask your admin about enforced TLS for that recipient's domain.
Is Gmail confidential mode encrypted?
Confidential mode is not end-to-end encryption. It replaces the message content with a link, removes the options to forward, copy, print and download, and lets you set an expiry date, revoke access and require an SMS passcode. Google notes that recipients can still take screenshots or photos.
Which Google Workspace editions support S/MIME?
Google lists hosted S/MIME for Frontline Plus, Enterprise Plus, and Education Fundamentals, Education Standard and Education Plus. Business Starter, Standard and Plus are not listed, so those organisations usually use a third-party encryption service instead.
Can non-Gmail users open a confidential mode email?
Yes. Recipients who do not use Gmail get an email with a link to the content and a passcode to open it, or an SMS passcode if the sender required one. The content stays in Gmail rather than being delivered to their mailbox.
Still have a question about secure email for Gmail users?
Ask us and a member of our team will reply by email.
More email security guides
EchoworxPolicy-driven email encryption with TLS, branded portal, encrypted PDF and S/MIME or PGP delivery.