How to Set Up PGP Encryption in Gmail: FlowCrypt, Mailvelope

The first thing to know about how to set up PGP encryption in Gmail is that Gmail cannot do it alone. Google encrypts your mail with TLS in transit and reserves S/MIME for paid Workspace accounts, but neither is PGP, and neither keeps the message content out of Google’s hands on a free account. Adding real end-to-end encryption to Gmail means installing a browser extension. The two mature options are FlowCrypt and Mailvelope, both take about ten minutes, and this guide walks through each, then shows you how to confirm the encryption actually happened.

If PGP itself is new to you, read what PGP encryption is and how it works first. The one-line version: you publish a public key anyone can use to encrypt mail to you, and you keep a private key, protected by a passphrase, that is the only thing that can decrypt it.

The Threat Model: What This Does and Doesn’t Protect

PGP in Gmail is worth the setup effort if any of these describe you:

1. You don’t want your provider reading message content. A PGP-encrypted message stored in Gmail is ciphertext to Google. Only your correspondent’s private key can open it.
2. You worry about mailbox compromise. If someone gets into your Gmail account (through a phishing kit, a leaked password, or an ex who knows your recovery answers), your encrypted messages stay unreadable, because the private key lives in the extension on your device, not in the mailbox.
3. You occasionally send genuinely sensitive attachments such as contracts, medical records, or tax documents to a specific person who is willing to spend ten minutes on setup too.

What it does not do: hide who you email or when. The EFF’s Surveillance Self-Defense guide is blunt that end-to-end encryption protects only the content of your communication, not the fact that you are communicating. Sender, recipient, timestamps, and, in PGP’s case, the subject line all remain visible. If your threat model is hiding relationships rather than content, PGP is the wrong tool.

Why Gmail Needs an Extension at All

Google’s own encryption options top out below PGP for personal accounts. Per Google’s documentation, every Gmail message gets TLS automatically, which protects mail in transit but not from Google itself. Work and school accounts can add hosted S/MIME, where Google keeps a copy of the encryption key, or client-side encryption, where the organization holds the keys, but both require a Workspace admin to switch them on. A personal @gmail.com address gets neither. Hence the extension route.

Both extensions below implement OpenPGP, so they interoperate with each other and with any other OpenPGP client your correspondent uses, including Thunderbird or Proton Mail.

Method 1: FlowCrypt (the Easy Path)

FlowCrypt is purpose-built for Gmail and is the option to pick if you want the least friction. The vendor advertises setup in about a minute, which is marketing, but the flow is genuinely short:

1. Install the FlowCrypt extension from the Chrome Web Store (an Android app exists as well; the desktop extension is the primary experience).
2. Click the extension icon and authorize it to connect to your Gmail account.
3. Choose New encryption key, then set a passphrase. Make it long and memorable: a string of unrelated words beats a short jumble of symbols, and it should live in your password manager.
4. A Secure Compose button appears in Gmail. Use it instead of Gmail’s normal compose window whenever you want encryption.

FlowCrypt looks up your recipient’s public key automatically. When the recipient has no PGP key at all, Comparitech’s walkthrough notes that FlowCrypt falls back to protecting the message with a one-time password you share over a separate channel, say Signal or a phone call. That fallback is weaker than real key-based PGP, but it means you can start using the tool before all your contacts have caught up.

Method 2: Mailvelope (the Open-Source Path)

Mailvelope is fully open source and independently audited, per the project, and works across Gmail, Outlook.com, and several other webmail providers in Chrome, Firefox, and Edge. It is the option to pick if auditability matters more to you than polish; the setup asks slightly more of you:

1. Install the Mailvelope extension for your browser and click its lock icon in the toolbar.
2. Choose Generate key, enter a display name, your Gmail address, and a strong passphrase, then create the key pair. You can optionally upload the public key to Mailvelope’s key server so others can find it; the server sends a confirmation email to verify you control the address.
3. Confirm Gmail is on Mailvelope’s list of authorized domains (it is by default).
4. In Gmail, compose with the Mailvelope editor, the small icon that appears in the compose window. Write the message there, pick the recipient, and encrypt before sending.

To email someone, you need their public key. Mailvelope checks its key server; if your correspondent isn’t on it, import their key manually under Import Keys after they send you the key file or post it somewhere you trust.

Verify It Worked

Do not trust the padlock icon; run the test. Send an encrypted message to your own address, then open it somewhere the extension isn’t running, such as the Gmail app on your phone or an incognito window. You should see a block starting with -----BEGIN PGP MESSAGE----- followed by ciphertext. If you can read the message body there, it went out unencrypted. Back in your extension-equipped browser, the same message should decrypt after you enter your passphrase.

Second test: check what remains readable. The subject line will be, which is why both Comparitech and the tools’ own docs advise keeping subjects vague on encrypted threads.

The Catch

The honest catch with PGP-in-Gmail is social, not technical: encryption only happens when both ends participate, and most people you email will never install anything. Expect to use Secure Compose for a handful of contacts and normal Gmail for everyone else. The EFF’s assessment that PGP tools take technical expertise to operate securely and have fallen out of common use is fair warning about the maintenance burden too: lose the passphrase or the private key and the mail is gone for good.

If you want encrypted-by-default mail without herding correspondents, moving the sensitive traffic to a provider that handles PGP transparently is the lower-effort answer; our Gmail to Proton Mail migration guide covers that path. If the mailbox in question is a work account on Microsoft 365 rather than Gmail, PGP is not the supported mechanism there either — how to encrypt email in Outlook covers S/MIME and Purview instead. And since encrypted content is only one layer of email risk (phishing and account takeover don’t care about your keys), our sister site Tech Sentinel tracks the broader email-security news worth watching.