How to Password Protect an Email in Gmail

Does Gmail Support Password-Protected Email?

Gmail does not let you create a separate custom password for an individual message. If you are looking for a Gmail password protected email, the closest built-in option is Confidential mode. It can require recipient verification, set an expiration date, and limit common sharing actions.

The statement “Gmail is not password protected” can be misleading. A Gmail account is protected by its normal sign-in security, while Confidential mode adds controls to a particular message. Its passcodes are created and delivered by Google; the sender does not choose the code.

Confidential mode does not guarantee complete security. It disables certain actions inside supported email interfaces, but a recipient could still photograph the screen, capture information another way, or use unauthorized software. Confirm the recipient carefully and avoid sending information that should never leave your control.

Use Gmail Confidential Mode

On a computer, start a new message in Gmail and add the intended recipient, subject, message, and any attachments. At the bottom of the compose window, select the Confidential mode icon, which looks like a lock with a clock. If Confidential mode is already active, select Edit near the bottom of the draft.

1. Select an expiration setting.
2. Choose whether recipient verification will use an SMS passcode.
3. Select Save to apply the settings to the draft.
4. Review the recipient address and message before selecting Send.

The settings apply to both the message text and its attachments. If the Confidential mode control is missing from a work or school account, the organization’s administrator may have disabled the feature. The sender should contact that administrator rather than assume the message is protected.

Choose a Passcode Option

Gmail presents two passcode choices. Despite its name, “No SMS passcode” does not always mean that no verification code is used. Recipients using Gmail can generally open the message directly. Recipients who do not use Gmail receive a passcode by email and use it to view the protected content.

With “SMS passcode,” Google sends a code by text message. The sender must provide the recipient’s mobile phone number, including the correct country information when requested. Enter the recipient’s number, not the sender’s. Confirm the number through a trusted method before sending sensitive material.

You cannot type a custom password, reuse a shared secret, or tell Gmail which code to send. Therefore, describing Confidential mode simply as “Gmail password protected” leaves out an important distinction: Google controls the verification process, while the sender chooses only the available passcode option.

Set an Expiration Date and Access Controls

Confidential mode requires the sender to select an available expiration setting. Gmail shows the choices in the Confidential mode window. The recipient can view the message and attachments only while access remains active.

The sender can end access sooner:

1. Open the Sent folder in Gmail.
2. Open the confidential message.
3. Select Remove access.

If access was removed by mistake, the same sent-message view may offer an option to renew it. Check the current control shown in Gmail before telling the recipient to try again.

While the message is available, Gmail disables options to forward, copy, print, or download its text and attachments. These controls reduce casual sharing, but they do not prevent every form of copying. They also do not erase information that a recipient recorded before access ended.

Open a Protected Gmail Message

What the recipient sees depends on the passcode setting and the email service being used. A Gmail recipient may see the confidential content directly in Gmail when “No SMS passcode” was selected. If SMS verification is required, the recipient requests the code, receives it at the phone number supplied by the sender, and enters it in the verification screen.

A recipient using another email provider may receive a notice rather than the full confidential message in the inbox. They select the button provided in that notice to view the message. With the non-SMS setting, Google sends the required passcode to the recipient’s email. With the SMS setting, the code arrives by text.

The recipient should open the notice sent to the exact address named by the sender. They should not forward it to another address or share a verification code. Access can fail if the recipient uses a different account, the message has expired, or the sender has removed access.

What to Do If Verification Fails

Start with the delivery method chosen by the sender. Then work through the checks that match the problem:

• There is no email passcode: Check spam, junk, and filtered folders. Confirm that the protected-message notice was delivered to the expected address. Request another code from the viewing screen if that option appears, and use the newest code received.

• The SMS code does not arrive: Check that the phone has service and can receive text messages. Ask the sender to confirm the number and country information they entered. Do not send the sender a code that has already arrived.

• The phone number is wrong: The recipient cannot correct it from the message. The sender should remove access to the original message and send a new confidential message using the verified number.

• The code is rejected: Enter the latest code exactly as delivered and avoid extra spaces. Request a fresh code if the screen permits it. Older codes may no longer be usable after a newer request.

• Access has expired or was removed: Only the sender can restore access or send the content again. Contact the sender through a communication method you already trust.

• The message will not open: Confirm that the device is online, reopen the original notice, and try a current supported browser or the Gmail app. Work or school restrictions may require help from the organization’s administrator.

Never share a verification code with someone who claims they need it to troubleshoot the message. The code is intended for the recipient’s verification screen.