Gmail End-to-End Email Encryption Explained: A Guide for Enterprise Users

Google recently announced it will offer end-to-end encrypted (E2EE) email via Client-Side Encryption (CSE) to all enterprise users. While it’s still in beta, enterprise users can already send encrypted emails to Gmail users within the same organization. However, Google mentioned that “In the coming weeks, users will be able to send E2EE emails to any Gmail inbox, and, later this year, to any email inbox.” This capability is not yet available for all organizations or personal/free Gmail accounts.

The new form of encryption aims to simplify the technology behind E2EE. The company presents it as an alternative to S/MIME, which is known for its complexity and overhead in enterprise environments.

Does Gmail Offer End-to-End Encryption?

By default, Gmail uses TLS (Transport Layer Security) to encrypt emails in transit. However, TLS only protects messages between mail servers, not at the content level. It does not prevent server-side access by providers like Google or hackers. 

In 2019, Gmail introduced Confidential Mode as an added privacy layer, allowing expiration dates and restricted access. However, this mode does not qualify as true end-to-end encryption because:

• Google can still access message content.
• Screenshots, copy/paste, and workarounds can bypass Confidential Mode controls.

True end-to-end encryption means that only the sender and recipient can access the message, not even Google.

Recently, Gmail made end-to-end encryption available for enterprise users using supported editions of Google Workspace. While it’s not available for free Gmail accounts yet, broader access is on the roadmap.

How Gmail’s Built-in Encryption Works 

TLS ensures encryption in transit. Confidential mode allows expiration dates and revoking access. However, messages are still stored unencrypted on Google’s servers.

However, Confidential Mode has significant limitations:

• It doesn’t prevent users from taking screenshots.
• Recipients can download or copy email content using simple tricks:
  • Use “Save page as” to download email content.
  • In Firefox, disable @print media rules via Style Editor to re-enable printing.
  • Screenshot attachments or use Google Drive’s “Create copy” to duplicate protected PDFs.
    

Additionally, when emails are sent to non-Gmail users, recipients must access them via a link and passcode. If these are shared, the message is no longer confidential.

How to Enable End-to-End Encryption in Gmail 

To enable end-to-end encryption in Gmail, you can use Google Workspace CSE or third-party encryption tools. 

Google Workspace Client-Side Encryption (CSE)

To enable Google Workspace Client-Side Encryption (CSE), follow the steps below:

1. You need to select your external encryption key service. This will control the top-level encryption keys that serve to safeguard your data.
2. Then, you must connect Google Workspace to your identity provider, which may be a third-party IdP or Google identity. The IdP checks the users’ identity before it allows them to either encrypt or access encrypted content. 
3. Thirdly, you need to collaborate with your key service provider. The aim is to establish the service for Google Workspace Client-side encryption.
4. Once you complete the above steps, you need to add your key service information, along with adding the external key service’s URL  to the Admin console. This will help you connect the service to Google Workspace. 
5. After connecting the service to Google Workspace, you will need to assign your key service(s) to your organizational units.
6. Note that you will need some technical know-how with APIs and Python scripts to complete this step. If you have the necessary knowledge and skills, follow the steps below:
   1. Create a Google Cloud Platform (GCP) project
   2. Enable the Gmail API
   3. Give the API access to your organization
   4. enable CSE for Gmail users
   5. Configure access for private and public encryption keys to Gmail
7. Turn on CSE for users who need to create client-side encrypted content. Once complete, you’re all set! 

Some final optional steps may include setting up external access with S/MIME and/or importing messages to Gmail as CSE email.

Note: Enabling CSE may disable some native Gmail features.

Using Third-Party Encryption Tools

• Tools like FlowCrypt add PGP (Pretty Good Privacy) encryption to Gmail. This helps enhance the security of your email communications. PGP refers to the encryption system that is used for sending encrypted emails. It is also used for encrypting sensitive files. It was invented in 1991 and soon became the de facto standard for email security.
• Mailvelope offers a Mailvelope Key Server, file encryption, and form encryption features. The system adds any missing encryption and decryption features to the UI. This provides a quick and effective way to encrypt your email communications. The platform integrates with cloud solutions like Google Workspace, Microsoft 365, and Nextcloud. It is also compatible with PGP applications. 

However, always be cautious when using encryption features from email providers and proprietary point solutions.

Other Email Providers Supporting End-to-End Encryption

Other email providers that support end-to-end encryption include ProtonMail, Tuta, Mailfence, and others. 

ProtonMail 

ProtonMail helps you take control of your own data with built-in end-to-end encrypted email. It also provides other services, such as a VPN, cloud storage, password manager, calendar, and wallet. The end-to-end encryption and zero-access encryption restrict access to your emails solely to you, not even to Proton itself.

Tuta 

Tuta is one of the early providers of end-to-end encrypted email services with quantum-resistant cryptography. The platform leverages zero-knowledge architecture along with strictly followed GDPR regulations. 

Mailfence 

Mailfence does not use any third-party advertising or marketing trackers. It also does not contain any advertisements. It follows strict privacy regulations and provides end-to-end encryption. This means that even Mailfence itself cannot access or read your emails. 

Why End-to-End Encryption Matters for Email Security 

End-to-end encryption offers numerous advantages for email security. 

Protection against phishing and email interception

Gmail is also adding a new AI model that will check and evaluate a substantial number of combined signals from billions of endpoints. The advanced evaluation will enable the system to detect and address phishing at the early stages. This, combined with the right DMARC setup, can boost your email security and protect your domain. 

Compliance with data privacy laws (GDPR, HIPAA, etc.)

There are many compliance requirements. GDPR, for example, requires Data Processing Agreements for every cloud service provider that handles European consumers’ data.  Gmail’s new end-to-end encryption can be a step toward compliance with existing standards. It will be most effective when combined with DMARC, as many of these international regulations also require email authentication protocols. 

Secure Communication for Sensitive Data

E2EE helps protect sensitive data by limiting access to only authorized parties. This means that only the sender and the target recipient can access the data in the emails. Since emails are encrypted on the client side even before being transmitted, even Google cannot access the encrypted data. 

Minimized Human Risk Error

End-to-end encryption reduces human error by simplifying the encryption process. There is no longer a need to exchange certificates or verify configurations, which was the case under the S/MIME protocol. 

Endnote 

Gmail’s launch of a new end-to-end encryption mechanism is promising; however, the initiative is still in its early stages. Only with time will it be possible to assess the true effectiveness of this new technology. In the meantime, all businesses should explore additional encryption methods and exercise best practices. 

In addition to email encryption, using email authentication can substantially reduce the risk of email spoofing and phishing. Trusted companies in email and domain name security, like PowerDMARC, offer DMARC managed services. This will help you achieve error-free DMARC implementation, without the technical complexity.

• About
• Latest Posts

Milena Baghdasaryan

Content Specialist at PowerDMARC

Milena is a skilled writer and content creator with 7+ years of experience in crafting engaging content on IT, cybersecurity, virtual events, and more. She has a proven track record of delivering high-quality work for international magazines and is a graduate of prestigious institutions such as New York University Abu Dhabi, UWC China, and the College of Europe.

Latest posts by Milena Baghdasaryan (see all)

• Gmail End-to-End Email Encryption Explained: A Guide for Enterprise Users - April 9, 2025
• Best Email Deliverability Tools - April 7, 2025
• How to Check Email Deliverability? - April 2, 2025