Google brought end-to-end encryption in Gmail to Android and iOS, letting users compose and read encrypted messages in the app with no additional software. The feature works even when the recipient uses a different email provider.
The headlines were some version of "Gmail now has end-to-end encryption". Two qualifications turn that into something much narrower, and both were in the announcement.
Who can actually use it
This is client-side encryption (CSE), a Google Workspace feature. Using it requires Workspace Enterprise Plus with the Assured Controls add-on.
That is not a consumer product and is not close to one. A personal Gmail account cannot send an end-to-end encrypted message, and neither can most business Workspace accounts — it sits at the top enterprise tier with a further paid add-on. Desktop CSE arrived in April 2025; the mobile version followed about a year later.
So the accurate headline is that a small set of large organisations can now send encrypted mail from their phones. That is a real improvement for them and changes nothing for everyone else.
What it encrypts, and what it does not
CSE encrypts the message in the Gmail client, before it reaches Google's servers, with keys held by the customer organisation rather than by Google. Google cannot read the contents — which is the whole point, and is a genuine architectural claim rather than a policy promise.
But the subject line is not encrypted, and neither are the sender and recipient addresses.
That exclusion deserves more attention than it gets. Metadata is frequently more revealing than content: who corresponded with whom, when, how often, and under what subject is enough to reconstruct a great deal without reading a single message. "Résignation" in a subject line between two known addresses tells you what happened. An encrypted body does not hide it.
This is not a flaw unique to Google — it is a property of email itself. SMTP routes mail using those fields, so a mail system that encrypted them would stop being email. It is a reason to be precise about what the protection covers.
How it reaches someone outside
If the recipient is not on Gmail, they receive an invitation to read and reply through a secure web portal in any browser. This is the standard approach for encrypted mail across provider boundaries and it works, with the usual trade-off: the recipient is now trusting a link in an email, which is precisely the reflex security training spends years trying to suppress.
What this is actually for
Read the requirements and the purpose becomes clear. Enterprise Plus plus Assured Controls is the compliance tier — organisations with data-residency obligations, regulated industries, government contractors. The feature exists so that an administrator can tell an auditor that message contents are encrypted with keys the cloud provider does not hold.
That is a legitimate and useful thing. It is also the reason it will not arrive on consumer Gmail: key management is the hard part of end-to-end encryption, and an organisation with an IT department can run it in a way that a billion individual users cannot.
If you want encrypted messaging today
For individuals the realistic options are unchanged, and none of them are email. Signal encrypts content and minimises retained metadata. WhatsApp encrypts content end-to-end by default, with metadata retained by Meta. For files, encrypting before sending — a password-protected archive, with the password sent by another channel — works regardless of the mail provider at either end.
Sources: Google Workspace's announcements; PCWorld; TechRadar; The Next Web; Droid Life; and Prothom Alo's original report.
