How to Password Protect an Email in Gmail and Outlook

To password protect an email, use Gmail's confidential mode with an SMS passcode, Outlook's Encrypt option, or put the sensitive content in a password-protected PDF or zip file. None of these stops the recipient copying it. For short text like logins, a one-time link that self-destructs after reading keeps the content out of both inboxes.

Can you actually password protect an email?

Not the way you can lock a PDF. Standard email has no password field, and a normal message sits in readable form in your Sent folder, the recipient's inbox and on the mail servers in between.

What Gmail and Outlook offer instead are wrappers. The message is held on the provider's servers, and the recipient has to prove who they are, usually with a code sent by text or email, before they can read it.

That gives you three practical routes: Gmail confidential mode, Outlook encryption and a password-protected attachment. A fourth, a one-time link, takes the sensitive text out of the email altogether. Each one stops different things, so it's worth knowing the limits before you rely on them.

How to password protect an email in Gmail

Gmail's version is confidential mode. It works in Gmail on the web and in the Gmail app, and the recipient doesn't need a Gmail account to open it.

Steps in Gmail on the web

1. Click Compose and write your message.
2. At the bottom of the compose window, click the padlock-and-clock icon (Turn confidential mode on).
3. Set an expiry: 1 day, 1 week, 1 month, 3 months or 5 years.
4. Under Require passcode, choose SMS passcode. Gmail will ask for the recipient's phone number when you send.
5. Click Save, then Send.

In the Gmail app, tap the three-dot menu on the compose screen and choose Confidential mode.

If you choose No SMS passcode instead, recipients on Gmail open the message directly and everyone else gets a passcode by email. That protects very little, because anyone who can read their inbox gets the code too.

What confidential mode doesn't do

• It hides the forward, copy, print and download options, but the recipient can still screenshot or photograph the screen. Google says as much in its own help pages.
• It isn't end-to-end encryption. Google stores the content and can access it like any other Gmail message.
• The subject line shows up in the notification email, so keep anything sensitive out of it.
• A Google Workspace admin can switch the feature off, in which case the icon simply won't appear.

The useful part: you can open the message in your Sent folder and choose Remove access to cut it off before it expires.

How to password protect an email in Outlook

Outlook's option is message encryption through Microsoft 365. Whether you see it depends on your plan and, at work, on what your IT team has turned on. Many business plans include it, and Outlook.com users with a Microsoft 365 Personal or Family subscription get a version too.

Steps in Outlook

1. Start a new email.
2. Open the Options tab (or the options menu in Outlook on the web).
3. Click Encrypt and choose Encrypt or Do Not Forward. Menu names vary slightly between new Outlook, classic desktop and the web version.
4. Send as normal.

Recipients on Outlook usually open the message as normal. People on other providers get an email with a link, and to read the message they sign in with a Microsoft account or request a one-time passcode sent to that same address.

Where Outlook encryption falls short

• The one-time passcode goes to the recipient's inbox, so it proves they control the mailbox, not that they're the right person.
• Plain Encrypt still lets the recipient copy, forward and save the content. Do Not Forward restricts that, but screenshots still work.
• Recipients outside Microsoft often find the extra portal confusing, and the passcode email can land in spam.
• The message stays in your Sent folder and the recipient's mailbox until someone deletes it.

Outlook also supports S/MIME, which encrypts mail between sender and recipient, but both sides need certificates set up first. For a one-off message to a client, that's rarely practical.

Can you password protect an email attachment instead?

Yes, and it works with any email provider. You put the sensitive content in a file, lock the file, attach it and send the password separately.

• Word or Excel: File > Info > Protect Document (or Protect Workbook) > Encrypt with Password.
• PDF: in Adobe Acrobat, use the Protect tool and encrypt with a password. Free PDF tools vary, so check that yours encrypts the file rather than just blocking edits.
• Zip: 7-Zip can create archives with AES-256 encryption. Avoid the older ZipCrypto method, which is weak.

The catch is that the locked file sits in both mailboxes indefinitely. Anyone who later gets into either account can copy it and try to guess the password offline, with unlimited attempts. A short or reused password won't hold up, and the email body, subject and file name aren't protected at all.

You also still have to deliver the password. Sending it in the next email defeats the point, which is covered in how to email a password securely.

Gmail confidential mode vs Outlook encryption vs a locked attachment

Here's how the options compare for a typical sensitive email to a client or colleague.

A simple rule: if it's a document, lock the attachment. If it's a short piece of text that shouldn't live in anyone's inbox, don't put it in the email at all.

How to protect an email with a password using a one-time link

Every option above leaves a copy somewhere. A one-time link flips that: the email carries only a link, and the sensitive text sits behind it until it's read, then it's destroyed.

With SecureNotes, each note is encrypted with AES-256 using its own random key before it's stored, and you decide when it disappears. It's free and needs no account.

1. Paste the text. Go to SecureNotes and create a self-destructing note. Paste only the sensitive part: the login, the account number, the alarm code. Notes are text only, up to 10,000 characters.
2. Choose when it self-destructs. Pick a view limit (1, 3, 5 or 10 views), a time limit (1 hour, 24 hours, 7 days or 30 days), or both, whichever comes first. One view suits most messages.
3. Add a passcode. It's optional, but for email it's the step that matters. If someone else gets into the recipient's inbox, the link alone won't open the note.
4. Send the link. Paste it into your Gmail or Outlook message, or let SecureNotes email it to the recipient for you. Turn on the read notification if you want to know when it's opened.
5. Send the passcode another way. Text it, say it on a call or message it in Teams. Never put it in the same email thread.

Most people skip step 3. In SecureNotes data, 69% of notes are set to self-destruct after a single view, but only 18% carry a passcode. For a link that travels by email, the passcode is worth the extra 20 seconds. There's more on choosing and delivering one in when passcode-protected notes make sense.

Worked example: handing over a client's website logins

Maya is a freelance web developer finishing a site for Dan, who runs a small physiotherapy clinic. She needs to send him the WordPress admin login and the hosting account password. She uses Gmail; Dan uses Outlook at work.

Confidential mode would work, but she doesn't want two live passwords sitting in Dan's mailbox for months. So she writes a normal email with the handover notes, the site address and links to the documentation. No credentials.

The credentials go into a SecureNotes note. She sets it to 1 view or 7 days, whichever comes first, because Dan might not check email until Monday. She adds a passcode and turns on the read notification, then pastes the link into her email with one line: Your logins are behind this link. It opens once. I'll text you the passcode.

Dan clicks the link, enters the passcode from Maya's text and sees both logins. He saves them in his password manager and changes both passwords. If he tries the link again later, it no longer works. Maya gets an email saying the note was read, and nothing sensitive is left in either mailbox.

Had the link been dead before Dan opened it, that would have told them both something was wrong, and Maya would have reset the passwords straight away.

What can still go wrong when you password protect an email

• Sending the code through the same inbox. Gmail without SMS, Outlook's emailed passcode and a PDF password in the follow-up email all assume the inbox is safe. If it isn't, they protect nothing.
• Sensitive details in the subject line. Subjects appear in notifications, previews and search results, and the options above generally don't hide them. Your new login is fine as a subject; the login itself isn't.
• Treating expiry as deletion. When a confidential Gmail message expires, the recipient can't open it, but that doesn't mean every copy is gone from your account. Check your Sent folder if it matters.
• Weak attachment passwords. A locked file can be attacked offline forever. Use a long random password, not the client's name and the year.
• Forgetting the screenshot. Nothing stops someone photographing their screen. These tools limit accidental spread, not a determined recipient.
• Autocomplete to the wrong person. Check the address before you send. A passcode sent by another channel helps here, because the wrong recipient won't have it.
• Emailing payment details at all. When you send bank details for an invoice, the bigger risk is a fake email swapping them. Confirm by phone using a number you already have.

Email has weak points that no setting fixes. Why email isn't secure enough for sensitive information covers the rest.