Gmail vs Proton Mail vs Tuta: Who Gets End-to-End Encryption?

What PCWorld argued, and what Google's documentation says​

Alaina Yee's PCWorld piece makes a simple case. Google technically offers end-to-end encrypted email, but anyone who wants that protection as a consumer should look at Proton Mail or Tuta. Her reasoning is that personal Gmail only encrypts mail in transit and at rest, so Google can still read it. She also describes the stronger option as an enterprise feature that an IT team has to configure.

Google's own documentation supports the core of that argument. It also adds detail that changes the "most expensive plan only" framing.

Personal Gmail: strong transport security, but not end-to-end​

Google's help pages say Google Workspace encrypts data at rest and in transit between its facilities, and Gmail uses TLS to communicate with other email providers. That protects mail from interception on the wire and from theft of disks. It doesn't hide message content from the provider.

The stronger option is client-side encryption (CSE). Google describes it as encryption handled in your browser before any data is transmitted or stored in Google's cloud storage.

Confidential Mode is not encryption​

Gmail's Confidential Mode is often mistaken for encryption. Google's help page describes it as access control. It lets a sender set an expiry date, revoke access, and disable forwarding, copying, printing and downloading. It can also require an SMS passcode. Google itself warns that recipients can still photograph or screenshot a message, and that malicious software may copy or download it.

CSE and Confidential Mode don't mix, either. When additional encryption is on, Confidential Mode is one of the features Gmail switches off.

Who can actually use Gmail CSE​

Google states that client-side encryption isn't available with a personal gmail.com account. Its setup documentation adds that consumer Google Account users can't access client-side encrypted content, send encrypted email, or take part in client-side encrypted meetings.

For organizations, Google's current documentation lists Enterprise Plus, Education Plus, Education Standard and Frontline Plus as the supported Workspace editions. PCWorld's "most expensive plan" shorthand was closer to the situation when the feature launched. Google's February 2023 announcement made it generally available for Enterprise Plus, Education Plus and Education Standard customers. The current help pages now include Frontline Plus as well.

What setup involves​

Administrators do the work, not users. Google says a super administrator has to:

• choose a key service, or build one using the Workspace CSE API
• connect an identity provider
• assign the key service to organizational units or groups
• turn CSE on for the users who need it

For S/MIME messages there's an optional extra step. It involves creating a Google Cloud project, enabling the Gmail API and uploading users' keys. Google notes that step requires experience with APIs and Python scripts.

The Assured Controls route​

One newer path removes some of that friction. Google's pages say that organizations with the Assured Controls add-on can send end-to-end encrypted email to anyone without setting up S/MIME. The Gmail help page describes this as a beta.

External recipients can use an existing Google account, or administrators can force them to create a guest account. A guest account may mean signing in to a third-party service to read the message. That is still a workable path, but it is a managed, organizational one, not something a person at home can switch on.

Limits on Gmail CSE​

Google documents several trade-offs:

• Metadata stays exposed. The body, inline images and attachments get additional encryption. The header, including subject, timestamps and recipients, does not.
• Attachment cap. Attachments and inline images are limited to 5 MB.
• No virus scanning. Encrypted attachments can't be scanned for viruses, and Gmail blocks many executable and script file types.
• Lost features. Delegated accounts, email signatures, printing, emojis, multi-send, Google AI products and smart features for Gmail are all unavailable.

For a Windows admin, one detail stands out. The hardware-key option relies on a Workspace Hardware Key application installed on users' Windows devices, and Google notes that part requires PowerShell experience. Viewing or editing CSE content also needs Chrome or Edge (Chromium).

Proton Mail: the Gmail-friendly option​

Proton's help documentation says messages between Proton Mail addresses are always end-to-end encrypted. Mail to other providers is encrypted in transit with TLS. After that, it isn't end-to-end encrypted by default, so the recipient's provider may be able to read it. To send end-to-end encrypted mail to a non-Proton address, Proton points senders to its password-protected email feature.

Proton also says that mail arriving from non-Proton senders is encrypted with zero-access encryption once stored. The sender's own provider may still keep a copy, unless it uses end-to-end encryption.

Subject lines​

Proton says subject lines aren't end-to-end encrypted. It attributes this to following the OpenPGP standard, where the subject sits in an unencrypted header packet. Proton says getting at subjects would require a court order approved by a Swiss judge. It also suggests using generic subject lines. That advice is simple and useful, and it applies to any provider that leaves subjects visible.

Pricing​

Proton's pricing page, as captured, lists a free tier with 1 GB of storage and one encrypted address. Mail Plus is 15 GB, 10 encrypted addresses and one custom domain. It shows a promotional first-year price, then a renewal of $47.88 per year. Prices and promotions change often, so check the live page before buying. PCWorld's page also carries a $1 Proton promotion, which isn't editorial advice.

Keeping your Gmail address​

PCWorld highlights that Proton lets you connect a Gmail account. That is a real convenience for people with years of mail history, but it needs a caveat. Connecting your Gmail address makes mail between you and other Proton users end-to-end encrypted. It doesn't encrypt everything sent to or from that Gmail address, because the protection still depends on who the recipient is. Mail passing through Gmail on its way in still passes through Google.

Proton's guidance, as summarized in the research notes, adds some practical limits. Google Workspace and custom-domain addresses aren't supported for this connection. It only fetches messages that land in Gmail's Inbox, so filters that skip the Inbox can leave mail behind. Free users can connect one Gmail account, and paid plans can connect up to three.

Tuta: the streamlined alternative​

PCWorld describes Tuta as a leaner, German-based option. It offers mail and calendar, a free tier with 1 GB of storage, and paid plans from €36 per year. Tuta's own support material says messages between Tuta users are encrypted end to end automatically.

For external recipients, Tuta uses a password-protected message. The sender shares the password through a separate channel. Tuta stores it with the contact for reuse. The recipient opens a Tuta web page, enters the password and can reply confidentially. The convenience of one password per contact is the main practical difference from Proton's approach.

The same caveat applies. If you send to a non-Tuta address without the password-protected flow, the message is not end-to-end encrypted. Tuta also says email addresses aren't encrypted.

Tuta's support page describes AES-256 with RSA-2048 or ECC, and mentions Kyber-1024 as a quantum-safe algorithm. Those are provider claims, not an independent security audit.

Side-by-side comparison​

Reading the claims critically​

• Jurisdiction isn't a guarantee. PCWorld says Swiss and German privacy laws are stronger, and it notes that Swiss authorities can still compel Proton to hand over identifying details such as IP and billing information. Treat country-level privacy claims as context. They don't make a service categorically safer, and the primary sources I reviewed don't prove them.
• A promotion sits on the page. The PCWorld article carries a Proton offer. That doesn't invalidate its comparison, but it's a reason to rely on the documented facts above.
• Endpoints still matter. No email encryption stops a recipient from photographing a screen. Weak passwords, shared devices and compromised accounts also undermine the whole scheme.
• The other side counts. If the person you're writing to uses a standard provider, you're back to a transport-level baseline unless you use passwords or PGP.

What this means for Windows users​

1. Personal Gmail user: don't expect Confidential Mode to protect you from your provider. It controls access, not encryption.
2. Gradual switch: Proton's Gmail connection lets you test the service without abandoning your address. Review your Gmail filters first, since mail that skips the Inbox won't come across.
3. Work account: ask your IT team whether your Workspace edition includes CSE and whether it's configured. If it isn't there, that's usually an administrative decision, not a missing setting.
4. Admins: budget for the setup. You need key services, an identity provider and possibly scripting, and users lose features such as signatures, printing and AI tools.
5. Sensitive messages: keep subject lines generic, share passwords for external recipients through a different channel, and don't put the secret in the same message.

Bottom line​

PCWorld's recommendation holds up on the main point. A personal Gmail account can't do end-to-end encrypted email at all, and Google's version needs an administrator and an eligible Workspace plan. Proton and Tuta bring that protection to individuals, but only fully between their own users, or when external recipients go through password or PGP routes. Pick based on who you actually email, not on the logo.