Being built

Methmailprivate email

How to send an encrypted email

Updated: · Sources checked:

In short. There are four ways to encrypt an email: an email service with built-in end-to-end encryption, the OpenPGP standard, the S/MIME standard, or a password-protected archive. In every case the recipient needs a way to decrypt it too. And the addresses, the time and often the subject stay visible.

Way 1. Email with built-in end-to-end encryption

Some email services encrypt mail between their own users automatically, with nothing to set up. If you and your recipient both use such a service, this is the easiest way. For recipients on other services, these providers usually offer separate options, most often OpenPGP.

Way 2. OpenPGP

OpenPGP is an open standard for email encryption [1]. Every participant has a key pair: the public key can be shared, the private key stays with its owner. More in What is PGP?

In an email app. Thunderbird has had OpenPGP built in since version 78 [2]:

  1. In your account settings, open the end-to-end encryption section and create a key or import an existing one.
  2. Send your public key to the recipient and get theirs.
  3. Compare key fingerprints over another channel: in person, by phone, in a messenger.
  4. Turn on encryption in the new message window, and send.

In webmail. For webmail there are browser extensions with OpenPGP support, such as Mailvelope [3]. The keys stay in the extension, not with the email provider.

Way 3. S/MIME in Outlook and corporate email

S/MIME is the second open standard [4]. Instead of keys that people exchange themselves, it uses certificates issued by a certificate authority. That is why S/MIME is more common in companies, where IT issues the certificates.

The built-in features of big providers work differently. In Microsoft 365, message encryption comes with a qualifying subscription [5]. In Gmail, client-side encryption exists only in certain Google Workspace editions, not in personal accounts [6].

Way 4. A password-protected archive

If the recipient has none of the above, you can put the file in an archive with AES-256 encryption, for example with 7-Zip [7], and email the archive. Send the password another way: by phone, in a messenger, in person. A password in the same email undoes the protection.

In 7-Zip, choose the 7z format and turn on “Encrypt file names”: otherwise the names of the files inside the archive stay visible. In a ZIP with AES encryption, file names are always visible.

This encrypts only the attachment. The message text and subject stay readable.

What stays visible whichever way you choose

  • the sender and recipient addresses, and the time sent;
  • the subject line: classic OpenPGP and S/MIME do not encrypt it [8];
  • attachment names, and file names inside an archive unless name encryption is on.

More in Email metadata.

Common mistakes

  • The password in the same email as the encrypted archive.
  • Something sensitive in the subject line. Servers along the way can see it.
  • An unverified recipient key. Without checking the fingerprint, you may encrypt to someone else’s key.
  • A lost private key. Without a backup, old messages can no longer be decrypted.
  • An unencrypted reply. If the recipient replies with a regular email, the quoted text of your message goes out unencrypted.

Sources

  1. RFC 9580: OpenPGP. IETF, July 2024. https://www.rfc-editor.org/rfc/rfc9580
  2. Mozilla Wiki: Thunderbird OpenPGP (built in since Thunderbird 78, on by default since 78.2.1, August 2020). https://wiki.mozilla.org/Thunderbird:OpenPGP
  3. Mailvelope. https://mailvelope.com/
  4. RFC 8551: S/MIME Version 4.0 Message Specification. IETF, April 2019. https://www.rfc-editor.org/rfc/rfc8551
  5. Microsoft Learn: Microsoft Purview service description, Message Encryption: the plans that include it. https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-purview-service-description
  6. Google: client-side encryption in Gmail. https://support.google.com/mail/answer/13317990
  7. 7-Zip. https://www.7-zip.org/
  8. RFC 9788: Header Protection for Cryptographically Protected Email. IETF, August 2025. https://www.rfc-editor.org/rfc/rfc9788