Is Gmail Confidential Mode Actually Secure?

"Is Gmail Confidential Mode actually secure?" is a reasonable question, and the feature name makes it harder to answer than it should be. The word "confidential" implies something close to end-to-end encryption — a message that only the intended recipient can read. That is not what Confidential Mode delivers.

Gmail introduced Confidential Mode to give senders a set of recipient-side controls: an expiration date, a block on forwarding and printing, and an optional SMS passcode for non-Gmail recipients. Those controls are real and in some situations genuinely useful. What they do not add is any cryptographic protection on the message itself. This post explains exactly what the controls cover, where they stop, and when Confidential Mode is still the right tool to reach for — and when it is not.

The short answer#

Gmail Confidential Mode is not end-to-end encrypted. Google's servers receive and process your message in the same way as any standard Gmail message. The feature adds recipient-side restrictions: it removes the forward, print, and download options from the recipient's Gmail interface, and it lets you set a date after which the message link stops working. It does not prevent Google from accessing the message content, and it does not prevent a recipient from capturing what they can see on their screen.

Three things Confidential Mode cannot do, regardless of how it is configured:

• Stop Google from processing the message. The message passes through and is stored on Google's infrastructure as normal. Both the sender's and recipient's copies are subject to Google's standard data handling.
• Prevent a recipient from capturing the content. A recipient can take a screenshot using their device's built-in tools, photograph the screen, or copy text using applications that operate outside the Gmail interface. No browser-based control can block this.
• Fully restrict non-Gmail recipients. Recipients on Outlook, Apple Mail, or any other client receive a link to a Gmail-hosted web view rather than the message body. If the SMS passcode option is not enabled, there is no additional verification step before the message loads.

What confidential mode actually protects — and what it does not#

The clearest way to evaluate Confidential Mode is to map it against specific threats. The table below shows where it helps, where the protection is only partial, and where it offers no protection at all.

How the restrictions work in practice#

Think of Confidential Mode as a set of interface controls applied to the recipient's Gmail session, not as a lock on the message content itself. When a recipient opens a Confidential Mode email in Gmail, the forward, print, and download buttons are absent. The message text is still rendered in the browser — which means it is still visible, still capturable at the screen level, and still fully processed by Google on both ends.

For non-Gmail recipients the mechanism works differently. Gmail does not embed the message body in the notification email it sends. Instead, the notification contains a short prompt and a link to a Gmail-hosted web page where the recipient can read the message. If you enabled the SMS passcode option, the recipient must enter a code sent to their phone before the page loads — and a new code is sent each time they open the link.

How to send a confidential mode email in Gmail#

The steps below apply to Gmail on the desktop web interface. The Gmail mobile app follows nearly the same flow; differences by platform are covered in the table that follows.

1. 1

   Open a new message

   Click Compose in Gmail. Write and address your email as you normally would. You apply Confidential Mode settings before you click Send, not before you write.

2. 2

   Click the lock icon in the compose toolbar

   At the bottom of the compose window, click the icon labelled Turn on confidential mode — it shows a padlock overlaid with a clock face. If you do not see it immediately, look in the three-dot overflow menu at the right end of the toolbar row.

3. 3

   Set an expiration date

   Choose when access to the message expires. The available durations are 1 day, 1 week, 1 month, 3 months, and 5 years. After the expiry date, the recipient's link to the message stops loading. Screenshots and copies already taken before that date are unaffected by expiry.

4. 4

   Choose a passcode setting

   Select No SMS passcode if the recipient uses Gmail — they authenticate through their Google account before the message opens. Select SMS passcode if the recipient is on a non-Gmail address, then enter their phone number on the next screen. Gmail sends them a one-time code each time they open the message link.

5. 5

   Save the settings, then send

   Click Save. The compose window shows a Confidential Mode banner confirming the settings are active. Send the message as normal. Non-Gmail recipients receive a notification email with a link rather than the message body directly in their inbox.

How confidential mode behaves differently by platform#

The sender experience is consistent across Gmail surfaces. The recipient experience depends on which client they use to open the message and how their organisation's Workspace account is configured.

What to do when confidential mode does not behave as expected#

Several failure modes come up regularly when users rely on Confidential Mode for sensitive communications.

The recipient says they received an empty or blocked email. Non-Gmail recipients receive a notification email containing only a link, not the message body. Some corporate mail filters, security gateways, or older mail clients strip or block external links, making the notification appear blank or unclickable. Ask the recipient to open the email in a standard web browser and click the View email button from there.

The SMS passcode never arrives. Verify that the phone number includes the correct international dialling code. Carrier filtering occasionally blocks automated SMS messages, particularly from numbers associated with large cloud providers. Ask the recipient to wait a few minutes and try opening the link again, which triggers a new code. If the problem persists, you can resend the email without the SMS passcode option to confirm the link itself is working, then add it back.

The message is still accessible after the expiry date. Expiry propagation can take a few minutes across Google's infrastructure, so a small delay is expected. If the message remains accessible well past the expiry date, check the Sent folder entry — a Confidential Mode banner with the expiry date should be visible. If it is not, the settings may not have saved correctly before you sent.

Confidential Mode is greyed out or absent from the compose toolbar. Google Workspace administrators can disable the feature at the organisation level. If you cannot access it, contact your IT department or Workspace admin to confirm whether it has been turned off for your account.

A faster way: consistent control before the message leaves your outbox#

Confidential Mode addresses what a recipient can do with a message after it arrives. It does not change what happens on the sender's side: the message is composed and processed on Google's infrastructure, it sits in your Sent folder with no cryptographic protection on the content, and there is no record of what happened to it after delivery.

If you send sensitive material regularly — contracts, client decisions, internal information with limited distribution — the more durable approach is a client that puts controls at the composition stage: who approves a draft before it sends, what the AI is authorised to do on your behalf, and what audit trail exists for every action. We build AI Emaily, an AI-native email client with Copilot mode where you approve every AI action before it runs, a full audit log, and a privacy model that does not train on your email content. A 7-day free trial is available at aiemaily.com — see aiemaily.com/pricing for what each tier includes.