Recommended Free Tools
Short answer: not by default. A normal Gmail message is protected with TLS in transit when the other provider supports it, and Google encrypts stored data. That is not end-to-end encryption (E2EE). Gmail can offer E2EE-style protection through client-side encryption (CSE) and related Assured Controls options, but those are Google Workspace features for specific paid editions, managed by an administrator. Proton Mail and Tuta Mail encrypt automatically between their own users, but both need extra steps for recipients on other providers. Which is “better” depends on who you are and what you are protecting against.
Is Gmail end-to-end encrypted?
Not in the ordinary sense. Google’s documentation says Gmail uses TLS to communicate with other email providers where supported; if the other provider does not support TLS, the message may not be encrypted in transit. Google also describes Workspace data as encrypted at rest and in transit between its facilities. So “Gmail is unencrypted” is wrong, but “Gmail is fully end-to-end encrypted” is also wrong unless you mean a specific Workspace configuration.
As an Amazon Associate I earn from qualifying purchases.
Three kinds of encryption, and what each does
TLS (encryption in transit)
Protects the connection between mail systems while a message travels, provided both sides support it. It does not stop either provider from reading the message at its end.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteEncryption at rest
Protects data on a provider’s servers. Whether the provider can decrypt it depends on the service’s key arrangement, so “encrypted at rest” says little about who can read your mail.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
End-to-end encryption
Content is encrypted so only the intended endpoints can decrypt it. Headers and routing data are usually left out because servers need them to deliver mail. Google CSE (organization-managed keys) and consumer products like Proton and Tuta (user-held keys) have different key and admin models, so treat them as different things even though both get called “E2EE”.
What Gmail’s encrypted option actually is
Client-side encryption (CSE)
Google’s help documentation lists Gmail CSE for Enterprise Plus, Education Plus, Education Standard and Frontline Plus. The body, inline images and attachments get additional encryption. Headers, including subject, timestamps and recipient information, do not. Keys are controlled by the organization through an external key service, so an administrator must set it up; an individual with a free Gmail account cannot switch it on.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Assured Controls and external recipients
Google also describes an Assured Controls route for E2EE with outside recipients, where the recipient may open the message with a Google account or a guest account. Google Workspace’s own blog describes the design this way: “The emails are protected using encryption keys controlled by the customer and not available to Google servers, providing enhanced data privacy and security.” That is the vendor’s account, not independent verification.
Plan eligibility and rollout details change, so confirm your edition against Google’s current Workspace documentation before relying on it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Who it suits
Organizations that need admin-managed keys, policy controls and compliance integration while staying in Gmail.
How Proton Mail handles encryption
- Proton to Proton: E2EE by default.
- Proton to another provider: not E2EE by default. You can use a password-protected email (the recipient opens it through a link with a password you must share by a separate channel) or PGP with a compatible recipient.
- Metadata: Proton says subject lines and sender/recipient addresses are encrypted at rest but are not end-to-end encrypted.
How Tuta Mail handles encryption
- Tuta to Tuta: E2EE by default.
- Scope: Tuta’s documentation lists subjects, attachments, calendars, contacts and the search index among the data encrypted end-to-end.
- Still visible: email addresses and message dates, which are needed for delivery.
- Outside recipients: an external password-protected workflow is required.
Side-by-side comparison
| Question | Gmail with Workspace CSE | Proton Mail | Tuta Mail |
|---|---|---|---|
| E2EE by default? | No; admin-enabled on eligible editions | Yes, to other Proton users | Yes, to other Tuta users |
| Body and attachments | Additionally encrypted under CSE | E2EE within Proton | E2EE within Tuta |
| Subject line | Not additionally encrypted | Not E2EE | E2EE |
| Addresses and dates | Not additionally encrypted | Addresses not E2EE | Visible for delivery |
| Who controls keys | The organization | The user | The user |
| Outside recipients | Assured Controls route; Google or guest account access | Password-protected email or PGP | Password-protected external workflow |
| Administration | Strong admin and policy tools | Individual and business plans | Individual and business plans |
This is a feature-fit comparison, not a security ranking.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The limit no provider can remove
A secure provider cannot control the recipient’s mailbox. If you send a plain message from Proton to a Gmail address, the message can leave a copy at Gmail, as Proton itself notes. Password-protected or PGP workflows reduce that exposure, but only if the recipient actually uses them and the password travels separately. Always consider both endpoints.
Which should you choose?
- You run an organization on Workspace with compliance needs: CSE (if your edition is eligible) keeps your existing workflow and gives admins key control. Accept that subjects and recipients are not additionally encrypted.
- You are an individual who wants automatic E2EE and mostly talks to people who will also use it: Proton Mail or Tuta Mail. Tuta covers more fields, including subjects; Proton offers PGP compatibility for exchanging with outside users who already use it.
- You mostly email people on Gmail, Outlook and similar: expect to use password-protected messages for sensitive items. That adds friction for recipients, so reserve it for content that warrants it.
- Metadata is your main worry: no option hides the fact that you emailed a particular address at a particular time. Choose based on which fields are exposed, and consider whether email is the right channel at all.
“Better” here means a better fit for your threat model, recovery needs and the people you correspond with. Features and plan eligibility are volatile, so check each vendor’s current documentation before committing.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
