How does email encryption work in Google Workspace: S/MIME, confidential mode or client-side encryption?

Google Workspace offers four different things that people call "Gmail encryption", and they protect against very different risks. TLS protects mail on the wire, confidential mode limits what the recipient can do with a message, hosted S/MIME encrypts the message itself, and client-side encryption keeps even Google out. This guide explains each one, which editions include it, the exact Admin console paths at the time of writing (November 2026), and how to choose. For encryption outside Google, see our overview of email encryption types for business.

Is Google Workspace email encrypted by default?

Yes, in transit: Gmail encrypts mail between servers with TLS whenever the other server supports it. Google's admin help says "by default, Gmail always tries to send messages over a secure TLS connection" (Google). If the other server doesn't support TLS, the message can be delivered without it. Google's encryption help page warns not to send passwords or financial details over a connection with no encryption.

TLS protects each hop, not the message. Every mail server along the way, including Google's, can read the content. That's what lets Google and gateways scan mail for spam and malware, and it's why TLS alone may not meet a contract or policy that requires message-level encryption. Our STARTTLS guide explains how TLS can be downgraded and how MTA-STS prevents it.

To require TLS with specific partners, use Apps > Google Workspace > Gmail > Compliance > Secure transport (TLS) compliance. Google says that when the rule applies, inbound messages over non-TLS connections "are rejected," and outbound messages that can't use TLS "aren't delivered, and will bounce." Our TLS compliance guide walks through the steps, certificate options and testing.

What is the difference between S/MIME, confidential mode and client-side encryption?

S/MIME encrypts a message with the recipient's certificate, confidential mode restricts what the recipient can do and lets you revoke access, and client-side encryption encrypts content with keys your organization holds. This table compares all four options:

The S/MIME standard itself is RFC 8551. Gmail's version is "hosted" because Google stores the users' certificates and private keys on their behalf.

What does Gmail confidential mode actually do?

Gmail confidential mode lets a sender set an expiry date, revoke access, require an SMS passcode and remove the recipient's options to forward, copy, print and download. Google's Gmail Help page lists the features and the limits:

• Expiry: pick an expiration date from a drop-down when composing.
• Revocation: in Sent, open the message and click Remove access before it expires.
• Passcode: No SMS passcode lets Gmail recipients open it directly and sends other recipients a passcode by email; SMS passcode texts a code to a phone number you enter (only for numbers in North America, South America, Europe, Australia, India, Korea and Japan).
• Restrictions: copy, paste, download, print and forward are disabled for the text and attachments.

The important limit is in Google's own warning: recipients "can still take screenshots or photos of your emails," and "recipients with malicious programs may still be able to copy or download your messages." Confidential mode stops accidental sharing. It doesn't stop a determined recipient.

How does a confidential message look to a recipient? (example)

A recipient outside Gmail sees a short notification instead of the content, along these lines (illustrative example, not Google's exact wording):

Subject: Contract draft (confidential)
[Sender] has sent you a confidential email.
View the email

They click View the email, then Send passcode, and enter the code. Attackers copy this pattern in phishing emails, so train staff to open confidential messages only when they expect one, and to report unexpected ones.

How do admins turn confidential mode on or off?

Admins control confidential mode under Apps > Google Workspace > Gmail > User settings > Confidential mode. Check or clear Enable confidential mode for the whole organization or an organizational unit; you need the Gmail Settings administrator privilege. Google says "changes can take up to 24 hours but typically happen more quickly" (Google Workspace Admin Help).

Before you turn it on, check eDiscovery. Google says Vault can hold, search and export confidential messages your users send, but "Vault can't access or read the content of confidential mode messages sent to your organization from external senders." To block those incoming messages:

1. Go to Apps > Google Workspace > Gmail > Compliance > Content compliance > Configure.
2. Check Inbound messages.
3. Add an expression: Metadata match, attribute Gmail confidential mode, match type Message is in Gmail Confidential mode.
4. Set the action to Reject message, with an optional custom rejection notice, and save.

Our content compliance rules guide explains how rules combine.

How do you turn on hosted S/MIME in Google Workspace?

To turn on hosted S/MIME, go to Apps > Google Workspace > Gmail > User settings, check Enable S/MIME encryption for sending and receiving emails, then give each user a certificate. Google's S/MIME setup page lists the steps and requirements:

1. Confirm your edition is one of Frontline Plus, Enterprise Plus, or Education Fundamentals, Standard or Plus.
2. In User settings > S/MIME, check Enable S/MIME encryption for sending and receiving emails for the organizational unit. Child units inherit the top-level setting by default.
3. Optionally check Allow users to upload their own certificates.
4. If partners use certificate authorities Google doesn't trust by default, add them under Accept these additional Root Certificates for specific domains.
5. Obtain a certificate for each user from a certificate authority on Google's trusted list. Google says certificates must be in the PKCS 12 archive file format (Public-Key Cryptography Standards number 12, usually a .p12 or .pfx file).
6. Upload certificates. Google recommends "admins upload certificates using the Gmail S/MIME API"; users can also add their own in Gmail settings.
7. Have users reload Gmail. Google says messages sent during the propagation period, up to 24 hours, aren't encrypted.

Why S/MIME needs a key exchange first

S/MIME only works when both sides have certificates and Gmail has the recipient's public key. Google says keys are exchanged when a user sends an S/MIME signed message, which includes their public key, or when the recipient sends one. In practice: your user and the partner each send one signed message, and encrypted mail then flows. "If the message is encrypted with hosted S/MIME, the lock is green."

How to require S/MIME for certain mail

An admin rule can force encryption for a partner or for messages that match content. In a content compliance, attachment compliance, objectionable content or routing rule, use Modify message and check the S/MIME encryption option (Google). If Gmail can't find the recipient's public key, the message is "rejected or sent unencrypted"; check Bounce message if unable to encrypt if unencrypted delivery isn't acceptable.

The same rules can check S/MIME signatures on inbound mail, and Google suggests routing unsigned mail from a partner domain that always signs to admin quarantine.

What about Gmail client-side encryption?

Gmail client-side encryption (CSE) encrypts messages in the browser with keys held by a key service your organization controls, so Google can't decrypt them. It's the strongest option and the most work: you need an external key management service that your organization runs or contracts. Our encryption types guide covers CSE's general requirements and editions.

The big recent change: in October 2025 Google announced that Gmail CSE users can send end-to-end encrypted email to recipients on any provider, who "can easily access the encrypted message via a guest account" in a restricted version of Gmail (Google Workspace Updates). Google lists it for Enterprise Plus with the Assured Controls add-on, off by default for admins and enabled per organizational unit or group.

Which Google Workspace encryption option should you use?

Choose by what you need to stop: interception, accidental resharing, or anyone (including the provider) reading the content.

If you handle regulated data, such as health information, confirm with counsel which controls your obligations require; our HIPAA email security guide cites the HHS rule text.

Does encryption stop phishing?

No. Encryption protects a message from being read; it does nothing to stop a fake message from arriving. Phishing emails arrive over TLS like any other mail, and attackers imitate confidential mode notices and "secure message" portals because users expect to sign in to read them. End-to-end encrypted messages also can't be scanned by Gmail once encrypted. Pair encryption with filtering and with sender authentication: check your domain's setup with the Email Health Check.

Next steps

1. Check what your edition includes before promising S/MIME or CSE to a partner.
2. Decide whether to allow confidential mode, and add the inbound reject rule if Vault coverage matters to you.
3. For S/MIME partners, exchange signed messages, then add a rule that requires encryption for their domain.
4. Keep the inbound side clean. iBlockSpam filters spam, phishing and malware at the MX before mail reaches Gmail; see our Google Workspace page.

Browse our other setup guides.