Gmail’s TLS, hosted S/MIME, and client-side encryption protect different parts of the email workflow. Check the actual protection shown for your message and account. A generic claim that an email is encrypted does not tell you who manages the keys or which information receives additional protection.
TLS protects transfer between supporting providers
Transport Layer Security is Gmail’s standard email-transfer protection. It works when the sending and receiving providers support TLS. It helps prevent interception during transfer, but does not mean the message is encrypted exclusively for the sender and recipient with keys unavailable to the providers.
Gmail’s security details identify standard encryption. A red open lock warns about unencrypted delivery; check the details before sending sensitive material. Your browser’s connection security and the mail providers’ transfer security are separate checks.
Hosted S/MIME adds certificate-based protection
Eligible work or school accounts can use hosted S/MIME when their organization enables and configures it. It uses certificates and encryption keys for message protection and can provide digital signatures. Google’s user guidance describes hosted S/MIME as enhanced encryption, with Google hosting a copy of the key.
A digital signature and encryption are related but distinct. Signing a message does not establish that every reply will be encrypted if the required recipient certificate is unavailable. Personal Gmail accounts do not obtain hosted S/MIME simply by changing a compose preference.
Client-side encryption changes key management
With Gmail client-side encryption, the organization manages the keys and Google does not access the private keys or decrypted message content. The body, inline images, and attachments receive additional encryption; headers including the subject, recipients, and timestamps do not receive that additional encryption.
Availability depends on the Workspace edition and administrator setup. External-recipient workflows also vary: Google’s Assured Controls instructions include a beta-access condition for sending without setting up S/MIME. Do not assume every enabled organization has that route.
Additional encryption has feature restrictions and a 5 MB upload limit for attachments and inline images. It cannot be combined with confidential mode. Choose the approved protection before drafting sensitive content, and ask the administrator about required recipient compatibility and key management rather than treating all three labels as interchangeable.
Browse Gmail & Google Account help
References
- Learn how Gmail encrypts your emails
- Check your email security
- Learn about Gmail Client-side encryption
Reviewed against the linked official and developer guidance on October 27, 2026. Available options and screen labels can vary by account, device, region, and organization policy.