Your email travels through servers that can read it in plaintext before re-encrypting it for the next hop. Even at rest on Gmail or Outlook servers, the provider holds the encryption key and can access your messages. Google scans emails to some degree, and email providers hand over messages to law enforcement when required.
End-to-end encryption (E2EE) keeps emails readable only on your device and the recipient's device, using the recipient's private key to decrypt. No server provider, hacker, or law enforcement can view the content as it travels. However, metadata like subject lines and email addresses may remain visible, and forwarding encrypted messages breaks the encryption.
If you use Gmail, Outlook, or Apple Mail, you can layer encryption on top with third-party tools. PCMag recommends PreVeil, SecureMyEmail, and Virtru (Gmail-only in Chrome). Mailvelope works as a browser add-on in Chrome, Firefox, and Edge. FlowCrypt integrates with Gmail and Google Workspace on desktop and mobile.
Gmail's Confidential Mode and Outlook's Encrypt feature are not true E2EE, since Google and Microsoft still manage the encryption keys.
Proton Mail and Tuta offer native end-to-end encryption built in. By default, encryption only works between users on the same service. To send an encrypted email from Proton to a Gmail user, you must set up password protection and share the password through another secure channel. Proton's Gmail integration allows E2EE only if both Gmail parties use the Proton integration.