What is end-to-end email encryption, in plain English?

End-to-end email encryption means a message is scrambled on your device before it is sent, and can only be unscrambled by the person you sent it to. Nobody in between — not your email provider, not theirs — can read the contents.

The sealed-envelope analogy

Standard email is like a postcard: the postal service can read it as it passes through. End-to-end encryption is like sealing the message in an envelope only the recipient has the key to open. The post office still carries it and can see the address, but not the words inside.

How it works, briefly

Each person has a pair of keys: a public key others use to encrypt messages to them, and a private key, kept on their device, that decrypts them. Because the private key never leaves the device, the provider storing the email cannot read it.

What it protects, and what it doesn't

E2EE protects the content of your messages and attachments. It does not hide metadata — the fact that you emailed someone, when, and the subject line in many implementations. It also can't protect a message after the recipient decrypts it and, say, forwards it in plaintext.

Why it used to be hard

Classic PGP required managing keys by hand, which is why almost nobody used it. Modern tools automate key exchange and do the encryption in the background, so you get the protection without the homework, which is how ProtectMyMail works inside Gmail and Outlook.