You just hit send on an email with a client contract attached. Then it hits you. That email is sitting on a hotel Wi-Fi network, bouncing through servers you have never seen, and landing in an inbox you cannot control.
If you work remote, this happens more than you think. No office firewall. No IT team watching your back. Just you, your laptop, and whatever network you happen to be on that day.
Outlook can fix this. It has built-in tools to lock a message so only the right person can read it. Most people never turn them on because the settings are scattered across three different versions of Outlook and nobody explains them in plain language.
This guide answers the question of how to encrypt email in Outlook and walks through every version. Desktop, web, new Outlook, iPhone, Android. No jargon. Just the steps.
What Email Encryption Actually Does in Outlook
Think of a normal email like a postcard. Anyone who handles it along the way can flip it over and read it.
Encryption turns that postcard into a locked box. The message gets scrambled into unreadable text. Only someone with the right key can unlock it and read the real content.
Outlook gives you two ways to build that lock:
- Microsoft Purview Message Encryption: This is the easier option. It works through your Microsoft 365 account and does not need any extra software installed on your computer.
- S/MIME: This is the older, more technical option. It needs a digital certificate installed on your device before it works.
Most remote workers only need Purview. S/MIME is worth learning if your company already issues certificates or you handle information that needs a stricter paper trail, like legal or financial records.
Do You Need a Microsoft 365 Subscription to Encrypt Email in Outlook?
Yes, in almost every case. If you have a Microsoft 365 Family or Personal subscription, Microsoft confirms that Outlook includes built-in encryption features for sharing confidential information without the message ever leaving Microsoft 365.
If you use Outlook through a job or school account, your organization needs a plan that includes Microsoft 365 Message Encryption, such as an E3 or higher business license. If your admin has not turned this on, the Encrypt button may not show up at all. That is not something you can fix on your own. You would need to ask your IT department to enable it.
Free Outlook.com accounts without a paid subscription do not get these encryption options.
Encrypt vs Do Not Forward: Which Option Should You Pick
When you turn on encryption in Outlook, you usually get two choices. They sound similar but behave very differently.
- Encrypt: The message stays locked and only opens for people who are meant to read it. The recipient can still forward it, print it, or copy the text to someone else.
- Do Not Forward: The message stays locked, and the recipient cannot forward, copy, or print it. Office attachments like Word or Excel files keep this protection even after they are downloaded.
If you are sending something routine but private, like a personal update, Encrypt is enough. If you are sending a contract, a salary detail, or anything you do not want passed along, choose Do Not Forward.
How to Encrypt Email in Outlook 365 (Classic Desktop App)
This is the standard Outlook app most people already have installed on Windows.
- Open a new message: Click New Email like you normally would.
- Go to the Options tab: You will find this along the top ribbon.
- Click Encrypt: Look for the padlock icon. A dropdown will appear with your available options.
- Choose your protection level: Pick Encrypt-Only for a locked message the recipient can still forward, or Do Not Forward for the stricter version.
- Write and send your email: Once selected, everything works the same as a normal email.
If the Encrypt option is greyed out, your account may not have a qualifying subscription, or your admin has not switched the feature on yet.
How to Encrypt Email in Outlook on the Web (OWA)
Outlook on the web works almost the same way, though the button can be harder to find.
- Compose a new message: Click New Message in the browser version of Outlook.
- Open the options menu: Click the three dots at the top of the message window.
- Select Encrypt: If you do not see it right away, look under a menu labeled Permissions or Encryption Options.
- Pick Encrypt or Do Not Forward: Choose based on how strict you need the protection to be.
- Send as usual: The recipient will see a note that the message is protected.
If the option never appears in the toolbar, some browser versions of Outlook let you pin it manually. Drag the Encrypt icon from the settings menu into your main toolbar so it stays visible going forward.
How to Encrypt Email in the New Outlook for Windows
Microsoft has been shifting everyone toward the new, simplified Outlook app. The steps are close to the web version.
- Start a new email: Click New Mail in the new Outlook interface.
- Find the Encrypt button: It sits in the message ribbon, marked with a lock icon.
- Choose Encrypt or Do Not Forward: Same two options as before.
- Send the message: The recipient experience does not change.
According to Microsoft’s own support documentation, new Outlook supports Message Encryption as long as your email server carries at least an Office 365 Enterprise E3 license. If it does not, you can still encrypt messages using S/MIME once you have a certificate set up, which we cover further down.
How to Encrypt Email in Outlook on iPhone and Android
The mobile app mirrors the desktop workflow closely, which makes it one of the easier versions to use once you know where to look.
- Open the Outlook app and start a new message: Tap the compose icon like normal.
- Tap the three dots in the toolbar: This opens the extra options menu.
- Select Encrypt: Choose the protection level you need from the list.
- Finish and send: The message locks the same way it would on desktop.
The Outlook mobile app for iOS and Android supports Purview Message Encryption for both sending and reading, and the interface mirrors the desktop compose screen closely. S/MIME is also available on mobile, but it only works with a work or school account, not a personal Microsoft account.
How to Encrypt an Email Attachment in Outlook
You do not need a separate step for attachments. When you encrypt the email itself, any file you attach gets wrapped into that same protection.
There is one detail worth knowing. If you choose Do Not Forward, Office files such as Word or Excel documents stay locked even after the recipient downloads them. A PDF or an image file does not carry that same restriction once it leaves the encrypted message, so keep that in mind if the attachment itself is the sensitive part.
How to Set Up S/MIME in Outlook
S/MIME takes more effort to set up, but it gives you tighter control and works well if your company already manages certificates for its team.
Step 1: Get a Digital Certificate
You need a certificate tied to your exact email address. This usually comes from your company’s IT department or a certificate provider. Once issued, you will download a file, often with a .p12 or .pfx extension, along with a password you create during setup. Keep that password somewhere safe. Losing it means losing access to your encrypted mail.
Step 2: Install the Certificate in Classic Outlook
- Open Outlook and go to File, then Options: This opens the settings window.
- Click Trust Center, then Trust Center Settings: You will find this near the bottom of the options list.
- Select Email Security: This tab manages everything related to S/MIME.
- Click Import/Export under Digital IDs: Choose the option to import an existing Digital ID from a file.
- Browse to your certificate file and enter your password: Outlook will confirm once the import is successful.
- Set your default hash and encryption algorithm: Use SHA256 for the hash and AES 256-bit for encryption, since older defaults can cause compatibility issues with other email clients.
Step 3: Set It Up in New Outlook for Windows
The new Outlook app does not pick up your certificate automatically, so you need to import it manually inside the app’s own settings. Go to Settings, then Mail, then S/MIME, and click Import. Select the certificate you already installed on Windows, then confirm.
Once installed on either version, you can turn on encryption the same way described earlier, through the Encrypt button in a new message.
S/MIME vs Microsoft Purview Message Encryption: What Is the Real Difference
These two options solve the same problem in different ways.
- S/MIME requires a certificate on your device. The recipient needs a matching certificate on their end to unlock the message. Without one, they simply cannot read it, no matter what mail client they use.
- Purview Message Encryption works through your Microsoft account instead of a local certificate. Per Microsoft’s support page, it can be read directly inside new Outlook, Outlook on the web, Outlook for iOS and Android, and recent versions of Outlook for Windows. If the recipient uses a different mail service entirely, they get on-screen instructions for opening the protected message instead.
For most remote workers, Purview is the more practical choice. S/MIME makes more sense if your organization already has a certificate system in place, or if you need message authenticity proof through a digital signature, not just privacy.
How to Encrypt All Outgoing Emails in Outlook by Default
If you send sensitive information often, checking the Encrypt button every single time gets tiring. You can set encryption to apply automatically instead.
For S/MIME, go back to Trust Center, then Email Security, then Settings. Check the box for Encrypt contents and attachments for outgoing messages. Every email you send afterward will be encrypted without you needing to click anything.
For Purview Message Encryption, default encryption is usually set at the organization level by an admin through a mail flow rule, not by an individual user. If you need every message from your account encrypted automatically and you are on a work account, this is a request for your IT team rather than something in your personal settings.
How to Know if Your Email Is Actually Encrypted in Outlook
It helps to have a visible confirmation, especially the first few times you use this.
- Look for a small lock icon: This appears near the subject line or sender information once encryption is applied.
- Check for a red certificate badge: This shows up on sent messages when S/MIME encryption or signing was used successfully.
- Read the confirmation banner: Purview encrypted emails usually show a short note at the top of the message stating that it is protected.
If none of these show up after you send, the message likely went out unencrypted. Go back and check your Trust Center or Encrypt settings before resending anything sensitive.
Can the Recipient Reply Securely to an Encrypted Outlook Email?
Yes. Whether you choose Encrypt or Do Not Forward, the recipient can still reply to you, and that reply stays protected too. The Do Not Forward setting only blocks them from passing the original message along to someone else. It does not block normal back and forth conversation between you and them.
Does Outlook Encryption Work for Gmail or Yahoo Recipients?
It does, but the experience looks different on their end. If someone opens the message using Gmail, Yahoo, or another email client outside Outlook, Microsoft explains that they get a link with a few extra steps to confirm their identity before the message opens. This usually means signing in with a one-time code sent to their address, or logging into a secure portal briefly.
It is a small extra step for them, but it is what keeps the message safe if it lands somewhere outside Microsoft’s own ecosystem.
How to Open an Encrypted Email You Received in Outlook
If someone sends you a protected message and you are using Outlook, you usually do not have to do anything different. Open it the same way you would open a normal email. Outlook recognizes the protection and displays the content automatically for versions that support Purview.
If you are opening it somewhere other than Outlook, you will likely get a message with a link and instructions to verify your identity first.
Common Problems When Encrypting Email in Outlook
Why Can’t I Find the Encrypt Button in Outlook?
This usually comes down to one of three things. Your account may not have a qualifying Microsoft 365 subscription. Your organization’s admin may not have turned the feature on. Or the button exists but has not been added to your visible toolbar yet. Check your options menu or the three dot icon for a hidden Encrypt or Permissions option before assuming it is missing entirely.
How Do I Fix “Invalid Certificate” in Outlook?
This error means Outlook is trying to use S/MIME settings, but it cannot find a valid certificate tied to your account. A few fixes usually work. Go to Trust Center, then Email Security, then Settings, and confirm the correct certificate is selected under Encrypted Email. If you were not trying to use S/MIME in the first place, uncheck the box for Encrypt contents and attachments for outgoing messages, since this setting can get switched on accidentally during an update.
If the problem is specific to sending encrypted mail to one recipient, the more likely issue is a missing certificate on their end, not yours. Outlook needs their public certificate available before it can encrypt a message meant for them.
Frequently Asked Questions
Can I encrypt email in Outlook without a certificate?
Yes. Microsoft Purview Message Encryption does not require a certificate on your device. Certificates are only needed for S/MIME encryption.
How do I send an email as confidential in Outlook?
Use the Do Not Forward option under Encrypt. It locks the message and stops the recipient from forwarding, copying, or printing it.
How to encrypt email in Outlook subject line?
Some organizations set up a mail flow rule where typing a specific word, like [Encrypt], into the subject line automatically triggers Purview encryption. This is configured by an admin, not something you turn on yourself, so check with your IT team if you want this set up.
How to encrypt email in Outlook when replying?
Encryption is not automatic on replies unless the original message was protected or your account has default encryption turned on. To protect a reply manually, open the Encrypt option from the ribbon or three-dot menu before sending, the same way you would with a new message.
How to encrypt email in Outlook with password?
Outlook does not use a simple password you type in yourself. Instead, non-Microsoft recipients often get a one-time passcode sent to their email, which acts like a temporary password to unlock the protected message through a secure portal.
How to encrypt email in Gmail?
Gmail handles this differently than Outlook. Regular Gmail accounts can use Confidential Mode, which sets an expiration date and blocks forwarding, though it is not full encryption. Google Workspace accounts with S/MIME configured can send properly encrypted email, similar to how S/MIME works in Outlook, but the setup happens inside Gmail’s own admin settings rather than Outlook’s.
Make This Part of How You Work, Not a One-Time Fix
Encryption only protects you if you actually use it. The next sensitive email you send, whether it has a contract, a payment detail, or anything you would not want forwarded around, take the extra ten seconds and click Encrypt before you hit send. Set your default S/MIME settings once, and you will not have to think about it again.
