How to Encrypt Your Emails

How to Encrypt Your Emails

Encrypting your emails scrambles message content so only the intended recipient can read it. Without encryption, emails travel in plain text across servers, leaving them vulnerable to interception. The approach you choose depends on your threat model, technical comfort, and the people you correspond with.

Choose an End-to-End Encrypted Email Provider

Some providers build encryption into their service so messages are encrypted on your device and only decrypted on the recipient's. ProtonMail and Tutanota are well-known examples. These services often require both sender and recipient to use the same provider or exchange public keys for cross-provider encryption.

Use PGP or S/MIME for Traditional Clients

If you use Outlook, Thunderbird, or Apple Mail, you can add encryption through PGP (OpenPGP) or S/MIME. PGP uses a web of trust and public-private key pairs; S/MIME relies on certificates issued by a certificate authority. Both require you to install keys or certificates and configure your client to sign and encrypt outgoing messages.

Set Up PGP

• Generate a key pair using a tool like GnuPG or a plugin such as Mailvelope.
• Share your public key with contacts and obtain theirs.
• In your email client, enable encryption and select the recipient's key before sending.

Set Up S/MIME

• Obtain an S/MIME certificate from a trusted provider.
• Install the certificate in your email client.
• Compose a message and choose to encrypt it using the recipient's certificate.

Encrypt Email Attachments Separately

If your provider or client does not support encryption, you can encrypt files before attaching them. Tools like 7-Zip, VeraCrypt, or GPG allow you to password-protect or encrypt archives. Send the password through a different channel, such as a phone call or a secure messaging app.

What Encryption Does and Does Not Protect

Encryption protects message content and attachments in transit and at rest on the server. It does not hide metadata such as sender, recipient, subject, or timestamps. For high-sensitivity communication, combine encryption with metadata-aware practices like using aliases or anonymizing remailers.

Quick-Reference Comparison