Email Encryption Explained: In Transit vs. End-to-End

Category: Security & Privacy

PNWritten by Priya Nair, Security & Privacy Editor · Last reviewed Aug 2026

Quick answer: Most providers encrypt mail while it's traveling between servers, but can still read it once it's stored on their systems. End-to-end encryption (like ProtonMail's) means nobody but you and the recipient can read it, ever — including the provider itself.

"Is email encrypted?" doesn't have a single yes-or-no answer — it depends on which layer you're asking about, and the difference actually matters if privacy is something you care about.

Encryption in transit

This is the standard today across virtually every major provider — Gmail, Outlook, Yahoo, all of them. It means your message is scrambled while it travels across the internet between mail servers, so it can't be intercepted and read in transit by someone sitting on the network in between. This is a genuinely meaningful protection against a real category of attack.

What it doesn't cover: the message isn't encrypted while it's sitting in storage — on the sending server, on the receiving server, or in your inbox. Your provider technically has the ability to access the content, and in principle so does anyone who obtains proper legal authority over their systems.

End-to-end encryption

This is a fundamentally different guarantee. The message is encrypted on the sender's device before it ever leaves, and only decrypted on the recipient's device after it arrives — nobody in between, including the email provider running the servers, ever has the ability to read the actual content. This is the core of what ProtonMail is built around, and it's a meaningfully stronger privacy guarantee than transit-only encryption.

The tradeoff: full end-to-end encryption generally only works cleanly between two users of the same encrypted service, or requires both sides to set up compatible encryption tools. Sending an end-to-end encrypted message to someone on a regular Gmail account, for instance, typically falls back to a different mechanism, like a password-protected link, rather than true end-to-end encryption all the way through.

What this actually means for you

For most everyday use, transit encryption (which you already have with any major provider) protects against the most common real-world threat — interception over the network.
For genuinely sensitive content — legal, medical, financial, or anything you specifically don't want a third party ever able to access — end-to-end encryption is a meaningfully different level of protection, and worth considering a provider built around it.

Encryption protects the content of your message from being read by others — it doesn't protect your account from being logged into if your password is compromised. Those are two separate concerns; see our piece on two-factor authentication for the account-access side of things.