The three kinds of email encryption explained in plain English, which one you actually need, and how to set it up in under 15 minutes.
Email was invented in 1971 and the basic protocols haven't changed much since. By default, every message you send travels through several servers in plain text — meaning the company running your email, their employees, and (in some cases) anyone who taps the connection in transit can read it. Encryption fixes that, but the word covers several different things, and the right answer depends on who you're trying to keep your messages from.
Good to know
🎯 Goal: By the end of this guide you'll know which type of encryption you actually need, and have a clear setup path you can finish today.
1. The three kinds of email encryption
People say 'encrypted email' to mean very different things. Knowing the difference saves a lot of wasted effort.
Transport encryption (TLS) — already on, automatic
Encrypts the connection between your device and your email server, and between mail servers along the way. Almost every major provider has supported it for over a decade. It stops a stranger on your café Wi-Fi from reading your inbox, but it doesn't stop your email provider from reading your messages — they have the keys.
End-to-end encryption (E2EE) — only you and the recipient can read it
This is what most people mean when they say 'encrypted email'. The message is scrambled on your device using the recipient's public key and only their private key can unscramble it. Even your provider can't read the contents — they only see encrypted gibberish. Right answer for sensitive personal messages, legal documents, medical info, journalists protecting sources.
At-rest encryption — your inbox is encrypted on the server
Messages stored in your mailbox are encrypted on disk. Most major providers do some version of this, but they hold the keys, so it mainly protects against physical theft of the server's hard drives — not against the provider itself reading your mail.
2. Which one do you actually need?
Be honest about who you're protecting against.
- Casual privacy from random snoops on Wi-Fi: TLS is enough. You already have it.
- Privacy from your email provider (no Google reading your mail to train AI or target ads): switch to a provider that uses E2EE by default — Proton Mail or Tutanota.
- Sending one specific sensitive message to one specific person: PGP between two clients, or a Proton Mail 'Password-protected message' (works to any recipient).
- Meeting a compliance requirement (HIPAA, legal, financial): your organisation usually mandates a specific tool — ask, don't improvise.
3. The easy path: switch to a privacy-first provider
If you want all email between you and other users of the same provider to be end-to-end encrypted automatically, with no key management on your end, the simplest answer is to switch providers.
Proton Mail and Tutanota both encrypt every message between two of their own users by default. You don't configure anything — sign up, send mail, it's encrypted. You can also send password-protected messages to recipients on Gmail, Outlook, etc. — they receive a link, enter the password you've shared with them via another channel, and read the message in their browser.
Good to know
💜 We recommend Proton Mail for most readers — free for up to 1GB, polished apps on every platform, based in Switzerland under strong privacy law. Disclosure: cybersecurityguides.net is an official Proton Partner, so links to Proton are affiliate links.
4. Setting up Proton Mail (10 minutes)
- Go to proton.me and create a free account. Pick a username and a strong password. Write the password down somewhere safe — Proton can't reset it for you, because they don't know it. That same property is what makes the encryption real.
- Verify your account via email or SMS, then download the Proton Mail app for your phone (App Store or Play Store) and the desktop bridge if you want to use Outlook or Apple Mail with it.
- Set up a recovery method (recovery email, recovery phone, or recovery file). This is the only way back into your account if you forget your password — set it up now while you remember.
- Send a test email to a friend. If they're also on Proton, you'll see a small purple padlock — that means end-to-end encrypted. If they're on Gmail, the message goes via TLS by default. To make a single email to a non-Proton user E2EE, click the lock icon at the bottom of the compose window and set a password (and a hint).
- Migrate your old email using Proton's free Easy Switch tool — it imports messages and contacts from Gmail, Outlook, or Yahoo without you setting up anything technical.
Good to know
📖 Need a deeper walkthrough? See our full Proton Mail migration guide for screenshots and per-provider instructions.
5. The harder path: PGP with your existing inbox
If you'd rather stay on Gmail or Outlook but encrypt specific messages, PGP (Pretty Good Privacy) is the open standard for end-to-end email encryption. It works in any client that supports it, but both sender and recipient need to set up keys, which puts most people off.
Roughly how it works: you generate a key pair (public + private). You publish your public key. Anyone can use your public key to encrypt a message that only your private key can decrypt. To send to someone else encrypted, you need their public key.
Important
⚠️ Realistic expectations. PGP setup is fiddly, key management is easy to mess up, and if you lose your private key your old messages are unreadable forever. Most people will be happier on Proton.
Practical PGP options
- Mailvelope — free browser extension that adds PGP to webmail
- GPG Suite — macOS, integrates with Apple Mail
- Thunderbird — built-in PGP since version 78
- FlowCrypt — Gmail-focused
Note: the recipient needs PGP set up too — if they don't, your encrypted message is just gibberish to them.
6. What encryption can't protect
Even with end-to-end encryption, a few things stay visible.
- Subject lines. PGP doesn't encrypt the subject. Proton-to-Proton mail does. If you're using PGP, keep sensitive details out of the subject line.
- Metadata. The sender, recipient, time sent, and attachment names are visible to your email provider and any provider in between. Encryption hides what you said, not who you said it to.
- The endpoints. If your phone or laptop is compromised, encryption is irrelevant — the attacker reads the message after it's decrypted on your screen.
- The recipient's choices. If you send an encrypted message and the recipient screenshots it, prints it, or forwards it in plain text, your encryption did its job — they undid it.
Quick reference: what to do this week
- Want better default privacy? Open a free Proton Mail account and use it for new sign-ups going forward. Keep your existing Gmail for noise.
- One specific sensitive message to send? Set up Proton Mail and use a password-protected message (works to any recipient).
- Regularly send sensitive material to specific people? Agree on PGP with them and set up Mailvelope or Thunderbird at both ends.
- Want full E2EE by default with no thinking required? Move to Proton Mail or Tutanota and ask the people you correspond with most to do the same.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers