Gmail is hard to break into. Google says it blocks more than 99.9% of spam, phishing attempts, and malware before they reach you, and a passkey or security key makes your account very difficult to steal. That makes Gmail secure against many common threats, but not necessarily private.
Security and privacy answer different questions:
- Security asks whether a criminal can get into your inbox.
- Privacy asks who else can read it, including the company that runs it.
Gmail is not end-to-end encrypted by default, meaning messages aren’t encrypted in a way that only you and the recipient can decrypt. Google holds the keys to your stored messages, processes their contents to run spam filtering and features like Smart Compose, and ties your account to the same Google profile that powers its advertising business. So the short answer: Gmail is relatively secure, but it is not a private email service.
- Is Gmail encrypted?
- Is Gmail secure?
- Is Gmail private?
- How to make Gmail more secure and private
- A safer alternative to Gmail
Is Gmail encrypted?
Yes, but not end to end. Standard Gmail uses TLS in transit and encryption at rest. Business customers on some paid Google Workspace plans can add stronger options.
| Encryption type | What it protects | Available on | Can Google read the message? |
|---|---|---|---|
| TLS | Email traveling between mail servers, when the other server supports it | All accounts | Yes |
| Encryption at rest | Stored email, against stolen drives and some infrastructure attacks | All accounts | Yes |
| Hosted S/MIME | Email between users who both have S/MIME certificates | Enterprise Plus, Frontline Plus, and Education plans | Yes: certificates and private keys are uploaded to Gmail |
| Client-side encryption (CSE) | Email encrypted in the browser with keys the organization controls | Enterprise Plus, Frontline Plus, Education Standard and Plus | No, but the organization can |
In personal Gmail, true end-to-end encryption requires a third-party PGP extension such as Mailvelope, and your recipient also needs PGP (software that follows OpenPGP, an open standard for end-to-end encryption).
Does Gmail’s confidential mode encrypt email?
No. Confidential mode lets you set an expiration date, revoke access, require an SMS passcode, and stop recipients from forwarding, copying, printing, or downloading a message. Recipients can still take screenshots or photos of your emails. Confidential mode limits what the recipient can do, but doesn’t keep the message private from Google.
Is Gmail secure?
Yes — against stolen passwords, phishing, spam, and malware, Gmail is one of the stronger email services available, especially once you replace your password with a passkey or security key. Here’s why:
Encryption in transit and at rest
Gmail encrypts messages with TLS (Transport Layer Security) while they travel between mail servers, so your emails are protected in transit as long as the email provider on the other end of the line also supports TLS. If you see a red open lock icon next to a message, it means the email isn’t encrypted.
Once your email lands on Google’s servers, it is encrypted at rest. Google’s Workspace encryption whitepaper(new window) lists Gmail messages and attachments as encrypted with AES using a 128-bit or stronger key, which is generated and managed by Google.
Both protections stop outsiders, such as someone tapping a network link or stealing a hard drive from a data center. However, because Google holds the keys, it retains technical access to your emails. That is the difference from end-to-end encryption, where only the sender and recipient can decrypt the message.
Two-factor authentication and passkeys
Google supports two-factor authentication (2FA). You can confirm sign-ins with a Google prompt on your phone, an authenticator app, a passkey, a physical security key, or a code sent by text or call. Verification codes sent by text or call are vulnerable to phone number-based attacks, and a Gmail spokesperson told Forbes in February 2025(new window) that Google wants “to move away from sending SMS messages for authentication.” Passkeys, Google’s default sign-in option, are stronger since they can resist online attacks like phishing.
For people at elevated risk, Google offers the Advanced Protection Program. It requires a passkey or security key to sign in, allows only Google apps and verified third-party apps to access your account data, and runs stricter checks on downloads. It doesn’t change how Gmail encrypts email, so Google can still read your messages.
Spam, phishing, and malware protection
Gmail filters incoming mail automatically. The company says it blocks nearly 10 million spam emails every minute, and that a newer AI model introduced in late 2024 blocks 20% more spam than before. Gmail also:
- Refuses risky attachment types, such as executable files, and warns you before you download a dangerous attachment.
- Shows warning banners on suspicious messages, unsafe content, and deceptive links.
- Requires anyone sending to Gmail to authenticate their domain using SPF or DKIM, send over TLS, and keep spam rates below 0.3%. Senders of more than 5,000 messages a day must also use both SPF and DKIM, plus DMARC and one-click unsubscribe. Emails that don’t meet these requirements are rejected or sent to the spam box.
- Displays a verified logo (Brand Indicator for Message Identification, or BIMI), which looks like a blue checkmark, next to brands that have verified their domain and logo. This makes impersonation harder.
Filters reduce the risk but don’t remove it. Microsoft detected about 8.3 billion email-based phishing threats(new window) in the first quarter of 2026, and attackers have abused Google’s own systems: In April 2025, phishers sent fake alerts(new window) from no-reply@google.com that passed Gmail’s authentication checks.
Gmail’s spam filter also has exceptions, and Google decides who gets them. Since September 2026, the Gmail Verified Sender Program lets registered US political committees bypass the filter if they send from verified domains and keep complaints below 0.3%. Political emails Gmail would previously have caught as spam now land in your inbox, and filtering them out again is left to you.
Account security features
Google’s account tools catch many takeover attempts early:
Security Checkup gives personalized recommendations, such as removing old devices or adding a recovery method.
Security alerts notify you by phone or email if someone signs in on a new device or if your account sends an unusual number of emails. Scammers imitate these alerts: In 2024, fake recovery prompts paired with AI voice calls(new window) were used to take over accounts. Check an alert by opening your Google Account directly instead of clicking its links.
Device management lets you see every signed-in device and sign out remotely. Use it after any malware scare: In 2024, researchers(new window) found infostealers that kept access to Google accounts even after a password reset by reusing stolen session tokens. Google said signing out of the affected browser, or revoking it from the devices page, cuts that access off.
Recovery phone and email help you get back in if you’re locked out.
Enhanced Safe Browsing adds more protection against phishing and malware across Chrome and Gmail.
Gmail security incidents and attacks
Here are a few known Gmail security incidents. Note that these started on the user’s side, through phishing, malware, or leaked passwords, rather than a breach of Google’s systems.
- In January 2026, a researcher found an exposed database of 149 million stolen credentials(new window), about 48 million of them for Gmail. Google said the logins were harvested by malware on users’ own devices, not taken from Google.
- In August 2025, hackers known as ShinyHunters stole data from a Google Salesforce database: contact details and notes on small and medium businesses. No Gmail data was involved.
- In July 2025, researchers(new window) showed that hidden text in an email could trick Gemini’s “Summarize this email” into displaying a fake security warning.
- In April 2025, phishers sent fake alerts(new window) from no-reply@google.com that passed Gmail’s authentication checks, linking to a fake support page on Google Sites.
- In October 2024, scammers used AI-generated voice calls posing as Google support(new window) alongside fake account recovery prompts to take over Gmail accounts.
- Between October and December 2018, two Google+ bugs exposed profile data of up to 500,000 and then 52.5 million users. Google shut Google+ down and tightened third-party access to Gmail.
Is Gmail private?
Not really. Gmail protects you well from outsiders, but Google itself can access your messages, collects data about how you use them, and links that data to your Google account. Privacy-focused email providers that use end-to-end and zero-access encryption are designed so they can’t do that.
Gmail is not end-to-end encrypted by default
To index your inbox for search and suggest replies, Google’s servers work with your emails in readable form. That is only possible because Google, not you, holds the encryption keys.
Only paid Google Workspace through client-side encryption provided end-to-end encryption. With end-to-end encryption, a message is encrypted on the sender’s device and only decrypted on the recipient’s. The provider stores scrambled data it has no key for.
What data does Google collect from Gmail users?
Google’s Privacy Policy applies to Gmail as it does to Search, Maps, and YouTube, so your activity across all of them adds to what Google knows about you. It names these categories:
| Category | Examples from Google’s privacy policy |
|---|---|
| Things you create or provide | Name, password, phone number, payment information, and content, including emails |
| Apps, browsers, and devices | Unique identifiers, browser and device type, operating system, crash reports |
| IP address and location | IP address(new window), GPS, nearby devices, and location inferred from your activity |
| Activity in Google services | Searches, videos watched, purchase activity, and communications, depending on your settings |
As of October 2026, the Gmail app’s iOS App Store privacy label lists the data it collects as “Data Linked to You,” including purchases, coarse location, contacts, emails and other user content, search history, user and device IDs, and advertising data.
Change your Google privacy settings to pause Web & App Activity, turn off personalized ads in My Ad Center, stop location tracking, and more.
Does Google use your Gmail data for ads?
Google says it doesn’t use the content of your emails to target ads. It stopped in 2017, when it said “Consumer Gmail content will not be used or scanned for any ads personalization.” Its Privacy Policy now states: “We don’t show you personalized ads based on your content from Drive, Gmail, or Photos.”
Your inbox is still part of Google’s ad business in other ways. For instance, Gmail shows ads based on “your online activity while you’re signed into Google,” such as your searches and YouTube history. In 2025, France’s data protection authority fined Google €325 million(new window), partly for inserting ads between emails in the Promotions and Social tabs without consent. Google appealed, and no ruling has been reported as of October 2026.
Does Gmail use your emails to train AI?
Google says no. In November 2025, a spokesperson told Tom’s Guide(new window): “We do not use your Gmail content for training our Gemini AI model.”
However, if you let Gemini read your Gmail, the email content it pulls into a chat follows Gemini’s rules, where Google can use your prompts and responses for AI training while Gemini activity is saved. Chats that human reviewers look at are kept for up to three years.
Gmail’s smart features settings power Smart Compose, package tracking, and summary cards. Google says that if you turn them on, “we may also process your Workspace Content & Activity to improve these features.” Turning Gemini off in Gmail, however, disables other useful AI-powered features, too, such as inbox categories and Smart Reply.
Gmail privacy lawsuits and violations
Google has been fined and sued repeatedly over how it handles Gmail users’ data. Here are some examples:
- In November 2025, Thele v. Google(new window) alleged Google turned on Gemini for Gmail, Chat, and Meet without consent. A judge dismissed it with leave to amend in July 2026, and an amended complaint is pending.
- In September 2025, CNIL fined Google €325 million(new window) for showing ads between emails in Gmail’s Promotions and Social tabs without consent, and for cookies set at account creation. CNIL says 53 million people saw the ads. Google appealed.
- In July 2018, the Wall Street Journal reported(new window) that employees at third-party email apps had read users’ Gmail messages. Google responded that “no one at Google reads your Gmail” except with consent or for security, and that users grant those apps access. Later in October, it limited Gmail API access to apps “directly enhancing email functionality.”
- In 2013 and 2014, users sued over Gmail scanning email content to target ads(new window). The class action failed and most plaintiffs settled individually. Google stopped ad scanning in 2017.
How to make Gmail more secure and private
These steps make your account much harder to take over and reduce what Google collects. None of them stops Google from accessing your messages.
- Use a passkey or security key. Set one up in your Google Account under Security. Passkeys resist phishing in a way passwords and SMS codes don’t.
- Turn on two-factor authentication and prefer Google prompts or an authenticator app over text messages.
- Use a unique password generated by a password manager, so a leak from another website can’t unlock your Gmail.
- Review your devices and sign out of any you don’t recognize.
- Remove third-party apps you no longer use from your account’s list of connected apps, especially any with permission to read your email.
- Run Security Checkup and add a recovery phone and email you control.
- Turn off smart features in Gmail settings if you don’t want Google processing your email for Smart Compose, summary cards, and cross-product features, and review your activity controls in your Google Account’s Data & privacy settings.
- Learn to spot phishing. Be suspicious of urgent security alerts, even ones that appear to come from Google.
- Don’t send highly sensitive information. Use private and secure email for this.
A more private and secure alternative to Gmail
If you want a more secure and private Gmail alternative, look for a service with end-to-end encryption and zero-access encryption built in. Proton Mail gives you both, along with the everyday features you expect from Gmail, on free and paid plans.
Emails you send to other Proton users or to recipients who use PGP are end-to-end encrypted, including the message body and attachments. For other cases, you can add password protection. That way, only you and the person you’re writing to can read those emails. In the unlikely event of a breach of Proton’s servers, your email content remains protected. The same is true if Proton receives a court order.
Proton is funded by subscriptions, not by data about you. We never show ads, track you, sell your data, or use it for AI training. Like all Proton apps, Proton Mail is protected by Swiss privacy laws, among the strongest in the world.
You can move over from Google with Easy Switch. It imports your Gmail messages, contacts, and calendars, forwards new emails to Proton Mail, and lets you keep sending from your Gmail address while you get used to your new inbox. When you’re ready to leave Google behind for good, you can make the full switch and delete your Gmail account, an important step toward deGoogling your life.
