Encrypt your Gmail Email!

Picture of Encrypt your Gmail Email!
If you want to be sure that your email can be read by no one but you, then it needs to be encrypted. You'd be surprised to find out who might want to read your email. I was.

One of the best encryption systems is called GPG encryption which is an open-source version of PGP encryption. PGP stand for Pretty Good Privacy and is actually an understatement made by a programmer who didn't want to be too optimistic about how secure it is. However, as it turns out, PGP is has actually proven itself to be extremely good. It's been around for many years, being maintained by the best coders in the world and it hasn't been cracked.

In this Instructable, I'll walk you through the simple process of setting up GPG and then installing a Firefox plugin that will make it easy to encrypt your Gmail.
Remove these adsRemove these ads by Signing Up

Step 1: How it works

The principle behind GPG encryption is easy. Anyone who wants to play creates a public key and a private key. Your public key is the part of the encryption that you make public. Your private key is the part of the encryption that you never share with anyone under any circumstance.

The two keys work together so that you need both to decrypt anything. To send an encrypted message to someone you lock the message with their public key and when they get it, they can unlock it with their private key. If they want to respond, then they encode the message with your public key and you can read it with your private key.

Of course, this only works so long as you can trust that you have been given the right public key and that you know who you are talking to. One of doing this is by having a key signing party with your close friends. You all show up at a given location at a given time and exchange public keys. Then you have a list of trusted public keys with which you can communicate. This is often referred to as a web of trust.

Step 2: Install GPG on your Operating System

Like I said before, getting your email protected is a two-step process. First, we have to get GPG installed on our operating system. Getting Gmail set up is on the next step.

I got GPG working on Mac OS X without too much trouble. I used the instructions and downloads at and summarized the process below. If you're on OS X, open that link in another window and get ready. For other operating systems, you can check the links on

Now, start downloading and installing! I've adapted the information from the Mac GPG FAQ, so you can also go there for more details. Here are the things I downloaded (you should got to the downloads page and get the latest):

First, open the DMG for GPG that you downloaded and run the installer. I just used all the defaults. This is the actual encryption engine that everything else runs on.

Once the installation is complete, open a Terminal window and type gpg, then hit [Return]. My installation gave me a "Go ahead and type your message ..." which I think means that GPG was up and running, so I ctrl-C'd out of that and closed the Terminal window.

Next, I installed GPG Preferences. That put a GPG icon in my System Preferences pane; I didn't change anything.

Finally, I installed GPG Keychain Access. This was easy: just unzip the ZIP file and drag the application into your Applications folder.

By the way, you can also do all of this from the command line. Here's a great tutorial for that.

Next up: Set up Gmail and start sending seeekrit messages!

Step 3: Generate Some Keys

Then, I ran the app and it had me generate my two keys (one public, one private). I typed in my secret passphrases which, of course, I will never tell anyone.

The last step with my keys was to select my public key and export it to a text file. Once you do this, you can attach it or copy and paste the contents into an e-mail to send to you PGP/GPG wielding friends.

Step 4: Open an anonymous Gmail account

Picture of Open an anonymous Gmail account
Before you can encrypt anything, you need to make sure that you open a Gmail account that by no means can be traced back to you. This means that you have to be liberal about giving them your real name and address when you sign up. You should also always use a TOR server.

Step 6: Encrypt Anything!

Picture of Encrypt Anything!
Encrypting your Gmail is just an example. Now that you have GPG installed, there are a whole bunch of programs you can use to encrypt and sign stuff. For example:

GPGDropThing - This is a simple program which lets you encrypt text to people whose public keys are on your keyring, and also allows you to decrypt messages that they have written. GPGDropThing is especially useful when writing encrypted mail to your friends as some clients don't have GPG support built in. So far only Apple Mail and Mulberry have GPG support. Your can encrypt text on your hard drive, this way, or even paste encrypted snippets into your IMs.

GPGMail - For encrypting your email going through Apple's
1-40 of 58Next »
tsaltzman1 month ago

Sounds good, but I don't care if the government/hackers reads my emails.

istevee5 months ago

I could also recommend . It's free, has trusted lists, comes with encryption for emails, files and even SMS if you use the mobile version.

tinja7 months ago
I tired Galaxkey thanks for telling me about it, its really great! so easy to use.

rejoraju1 year ago
Find out how to encrypt your mail in Chrome and Mozilla in a very simple steps, no need to be tech savvy to do this work.

Learn how to Encrypt your mail in Gmail using Chrome

and also see how you can encrypt your mail in Mozilla
bradleybc6 years ago
Hasn't been cracked? C'mon, a cipher cracking util run on the fastest desktop PC would take about 22,000 years to decipher. On the other hand, the NSA's "BrainChild" supercomputer can solve it in about 20 minutes. So, it really depends on who you are trying to hide information from...
muzac bradleybc5 years ago
Actually, agents from the Secret Service themselves are admitting that if something is encrypted with PGP, it's pretty much impossible even for them to crack (mentioned in this article). The NSA may be able to crack it, but I've seen no published cases on this. It seems like if someone encrypts with PGP, anyone (including the government) wanting to decrypt the info tries to just find ways to swipe the key from somewhere, instead of a "brute force" method.
The thing is, with enough time anything can be cracked but without knowing how long the original passphrase was it's pretty hard to do anything. My passphrase is in the neighborhood of 16+ characters which means they would have to make a list of all the possible strings that are 16 characters long, 17 characters long, etc until they cracked it. Without knowing that my passphrase is 16 characters at least though, you'd have to run through all the 1 character, 2 character, 3 character, 4 character, etc. passwords possible and finally be able to crack the passphrase. It'd take a wicked long time but eventually anything can be bruteforced. Just me $.02
If you were a suspect for a crime, they would probably just install malware on your computer, steal your password and not have to brute force anything. Or they can force you to reveal your passwords with torture or sever criminal penalties.

Its all about reducing your odds. The best method for decrypting hashes is rainbow tables but that was solved by adding salt to the hash's. Private Public key crypto is much more complex by requiring multiple factors required to decrypt ans since gpg is an opensource crypto its been reviewed publically by many its very difficult to decrypt anything gpg related without two things your private key and your passphrase. You'd really have to try hard to replicate either of these things.
For all we know, they could already have cracked it a long time ago, and they already read everything encrypted or not. They just aren't telling us to give us a false sense of security.
jacktrades2 years ago
You can also try:

It's a browser extension for Gmail, PGP like.
kpatel182 years ago
Yup now a days gmail has 2 step security features also so no 1 can hack your mail.
< a href=””>
pabloreyas2 years ago
This is the beast service for Secure Encripted Email!
Yeah is true, i use this service from 11 month and is really Excellent!
they have also a very good support.
For who want know more go here
bfarnsworth2 years ago
It is discontinued.
bijikenyot3 years ago

-nokia PIN
Mark Regan5 years ago
But I thought that gmail automatically appends your IP address. Therefore, "big brother" can easily trace any encrypted message back to your computer and, with or without a search warrant, even via a "black bag job", find out what you typed even before it was encrypted. There is no easy, reliable method of ensuring that anything is confidential anymore.
If u use TOR to surf gmail, u essencially cant be traced
psssst......voice down
si6 years ago
FWIW, I use a combination of a Truecrypt (Windows/OSX/Linux) encrypted volume to store a Keepass (Windows) database to maintain my passwords. There are similar password managers to Keepass for OSX and Linux. This means I only ever have to know one (very strong) password, all my other passwords are generated using Keepass, and are typically 30 random characters (including non alpha-numeric characters) or whatever the maximum number and type allowed by the particular system. This means I don't know my own Gmail password, and because the password database is double encrypted (Truecrypt volume + Keepass db) with AES, I can safely keep it on my USB flash drive, and not be worried if I lose it. The other nice thing about Keepass is you can attach files, so I also have my PGP keys stored in there as well. Yes, it's putting all your eggs in one basket, but it's a redundant, strong and secure basket!
But aren't you hooped if you lose the usb key? You'd never be able to open your email again.
Ah...yes, you are correct, but there was one other tool I didn't mention as I didn't want to get too geeky :) I also use a version control system - Subversion - which I use to store (amongst other things) the Keepass database on. This means I can have a (working) copy of the encrypted keepass file in multiple areas, on my usb key, on my home pc, etc. and I use Subversion to keep these up to date. Subversion by default does not transfer or store securely, there are ways around this, but it's not necessary since my Keepass db is encrypted with AES.
vov35 si3 years ago
hmm... an 'ible on secure subversion perhaps?
or just an explanation...
eecharlie si4 years ago
So, does this mean that your USB stick holds, in addition to your keepass db in a truecrypt volume, stand-alone & multi-platform versions of both keepass and truecrypt?  Otherwise, wouldn't you only be able to access your passwords (and gmail) if you're on a computer with all that already installed?

And maybe you throw a couple firefox plugins on there while you're at it?
I think it's discontinued.
Really glad for this helpful and useful guide. I'm using a PC and I'm sure many others are too. Can we get a guide for using GPG on our boxes? Thanx.
gumper1 Lampoon4 years ago
Thanks for that link Lampoon. If I install Gpg4win as the website says, can I send it to someone on a Mac to decrypt it or would I need to install a different product or encryption engine?
Also does this also encrypt images, attachments or do I need to do something separate for that?
It isn't much different... Find the GPG software for your operating system;
install the software (instructions on the GnuPG site)
install the Firefox plug-in
create your key-pair
send your public key to your friends and/or conspiratos
keep your pass phrase Long and Private

that is about it.

When your friends send their keys open it with GPG or save it to a file and double-click to install
REAL65 years ago
The easy way to Encrypt your gmail is this:

WHen you are on your gmail account, in the address bar, where it says http, type an S after http. now its encrypted.

so it would look like this
juno2800 REAL64 years ago
Hey, yeah, chumby32 (below) has it right. There are two kinds of encryption at work here. Using httpS will encrypt the connection between your web browser and gmail's servers. This is good! It means nobody on the network can see what you are looking at or typing while you are logged in to gmail. This is especially good if you are checking your email from somewhere public like a cafe. However, once the email leaves your outbox it is still sent in the clear over the internet (through intermediate email servers, routers, etc.) until it reaches its destination. This means it is possibly stored on other servers too. All of the computers that handle the message en route see your email plain as day, and it could be read by anyone with access.

PGP uses encryption slightly differently - it scrambles the actual contents of your message. This means that when you scramble a message all of the intermediate servers transmit the scrambled version as well. The only person (hopefully!) that can see the unscrambled message is the recipient at the end who decodes it using their key.

Don't get me wrong - HTTPS is good and you should use it! But it only encrypts your current connection, not all of your emails.

I believe there is a setting inside your gmail preferences to always turn on HTTPS.
chumby32 REAL65 years ago
What you are suggesting as a solution does not encrypt the email. It only encrypts one's connection to the gmail website.

Using your method, any server that stands between gmail and the email's recipient can read the email you sent.

The point of the Instructable is to prevent anyone except for the recipient from reading the email.
Guanabana5 years ago
This might sound like a stupid question ...but does the encryption work for the Gmail chat as well? If not, please tell me what is the best way to encrypt gmail chats?
To encrypt chats check out the "Off The Record" (OTR) plugin for Pidgin. Pidgin works on linux, mac, and windows, and lets you use all of your other types of chat accounts - msn, google talk, etc. It's cool!
dawcee6 years ago
what about the terrrists? like: im in ur airport 'kriptin up my emailz. this 'ible along with the pneumatic sniper rifle 'ible is bound to cause a terror chain reaction unravelling democracy as we know it. I mean I'm with Jorge Arbusto, there must be some WMD's out there somewhere. Oh wait, this is probably just for sending the illegal kind of porn to illegal-porn-lovin' friends. Also I'll probably try it out for myself ;) thanks w1n5t0n (Thw1n5t0n).
markf dawcee6 years ago
That's probably why encryption software (like GPG) is classified as weaponry under US federal law. That way it can, hypothetically, be regulated the same way that guns are. If an American sends a copy of GPG to a buddy in another country, they are breaking the law by illegally exporting "firearms". More reason than ever to support the ACLU, EFF, and NRA.
DeepWater markf5 years ago
When they pry my private key from my cold dead fingers...
barf_malak5 years ago
this will not work on my computer!!! i am running xp and ubuntu! plz helppp
orken5 years ago
Nice guide. But, it might be worth to point out that you really don't need anything else than the GPG software itself and FireGPG if all you're gonna do is encrypt your GMail (at least on Windows, not sure how that works out on Mac and Linux). Also, if you're a Thunderbird user, do check out the excellent Enigmail plugin which removes pretty much all of the annoyance that comes with managing the keys for your contacts everytime you send or receive a mail.
fotoflo5 years ago
Hey, Check out gwebs' new MailCloak, Much easier then firegpg, also works on yahoo, MSN, etc.
1-40 of 58Next »