Gmail encrypts every message in transit with TLS and encrypts stored data at rest, and Google states it doesn’t scan message content to show ads. What Gmail doesn’t give you by default is end-to-end encryption, so the padlock in your inbox means the hop was protected rather than the mailbox.

The rest of this page is the settings that move the needle, and the ones that stopped existing. Two of the most repeated pieces of Gmail security advice on the internet are now wrong, and both get corrected below.

Is Gmail Secure? What Google Actually Publishes

Google publishes three separate encryption tiers for Gmail, and most people only ever see the weakest one. Its Gmail encryption page sets them out by icon.

Indicator	What Google says it means	Who gets it
Gray lock	Google calls this standard encryption, and says all Gmail messages use TLS automatically	Google says all Gmail accounts
Green lock	Google calls this enhanced encryption, delivered by hosted S/MIME	Google says work or school Gmail accounts
Blue shield	Google calls this additional encryption, using client-side encryption	Google says your organization holds the only copy of the key
Red open lock	Google says the message is unencrypted and you shouldn’t send sensitive information	Google says to tell the sender their message is unencrypted

TLS needs both ends to cooperate. Google states that “For TLS to work, the email providers for both the sender and recipient must use TLS.”

So a red open lock usually points at the recipient’s provider rather than at your account.

The Padlock Does Not Mean End to End

Google’s own transparency documentation is explicit about where TLS stops:

What TLS doesn’t do is encrypt data at rest, that is to say, it does not encrypt email while it is stored on a server.

Google adds on that same page that email “is not only vulnerable in transit, it can also be snooped on after it’s delivered.” A gray padlock describes one leg of the trip.

The green lock isn’t end to end either. Hosted S/MIME means Google holds a copy of the key, and only the blue shield describes a setup where Google can’t read the message.

Does Google Scan Your Gmail to Show You Ads?

No, and Google says so in one sentence on its Gmail ads page:

We will not scan or read your Gmail messages to show you ads.

The change has a date. Google announced on June 23, 2017 that consumer Gmail content “will not be used or scanned for any ads personalization” after the change.

That brought consumer Gmail in line with what G Suite already did.

Don’t over-correct, though. Consumer Gmail still shows ads, and Google says they’re based on “your online activity while you’re signed into Google” rather than on your messages.

Workspace is a different product. Google states there’s no advertising in the Google Workspace Core Services and that it doesn’t collect, scan or use that data for advertising.

One nuance most write-ups miss: Google does scan Gmail content for security. Its Advanced Protection admin documentation describes “Enhanced pre-delivery scanning of incoming email” to catch phishing, which sits alongside the ads promise without contradicting it.

Most Gmail security breaches happen on the user side, through weak passwords, phishing attacks, malware, or forgetting to log out on a shared device. While Google stores emails in secure data centers with extensive protections, the biggest security gains come from strengthening your own account habits. This guide covers 17 actionable steps across four categories: password and authentication practices, account monitoring and recovery, device and software hygiene, and email-level protections. For a broader overview, see our complete guide to email security best practices.

What Password and Authentication Practices Protect Your Gmail Account?

Quick Answer: Use a strong, unique password with mixed character types. Change it at least annually. Never share it with anyone. Enable 2-factor authentication. For high-risk accounts, enroll in Google Advanced Protection with a physical security key.

Choose a strong, unique password. A strong password includes a mix of upper-case letters, lower-case letters, numbers, and special symbols in combinations that are hard to guess. Avoid predictable patterns like your birthday or sequential numbers (1234). Each additional character increases difficulty by an order of magnitude, so longer passwords are significantly more secure. Use a password for Gmail that you do not reuse across other accounts. You can read up on password best practices here for a detailed refresher.

Change your password regularly. Even a strong password becomes a liability over time. For average users, updating your Gmail password annually is a reasonable baseline. Professionals handling sensitive information should consider changing it every 3 months. Always use a different password for each account, if one account is compromised, the others remain protected.

Never share your password. No one from Google will ever ask for your password, not via email, not via phone, not under any circumstances. If you receive a message requesting your password, even if it appears to come from Google, it is a phishing scheme. Ignore it.

Enable 2-factor authentication. Two-factor authentication (2FA) adds a second verification step beyond your password. The second factor is typically a code sent to your phone or a physical USB security key. It adds a few seconds to the login process but makes it nearly impossible for someone to access your account with just your password. Get started with Google 2-step verification here. If you later decide to disable it, see our guide on how to turn off 2-step verification in Gmail.

Enroll in Advanced Protection for high-risk accounts. Google Advanced Protection is designed for users at elevated risk of targeted attacks, politicians, activists, journalists, and executives handling sensitive data. It requires a physical USB security key for authentication, limits third-party app access to your Gmail data, and adds extra verification steps during account recovery. It provides the highest level of Gmail security Google offers.

How Do You Monitor Your Gmail Account for Suspicious Activity?

Quick Answer: Run a Google Security Checkup to review signed-in devices and third-party access. Set up recovery phone numbers and backup email addresses. Act immediately on suspicious activity notifications. Check last account activity in the bottom-right corner of your Gmail desktop window.

Run a Google Security Checkup. Google offers a free Security Checkup tool that shows how many devices are signed into your account, recent security events, your sign-in and recovery methods, and which third-party apps have access. It alerts you to any detected suspicious activity and confirms when no issues are found. Run it periodically to catch potential problems early. While you’re there, open Gmail’s Filters and Blocked Addresses tab and delete any rule you didn’t create, using this guide to reading and editing Gmail filters.

Update your account recovery options. Set up a backup phone number and a secondary email address through the account recovery settings. If your account is compromised, these backup methods allow you to prove your identity and regain access. In the Accounts and Import section of Gmail Settings, click “Change password recovery options” to update this information. Set up multiple backups in case more than one account is compromised in a single attack. For more on protecting your data, see our guide on how to backup Gmail.

Take action on suspicious activity notifications. Google monitors for unusual account activity, such as sign-ins from new devices, password changes, or unfamiliar email sending patterns, and sends alerts to your secondary accounts. If you receive one of these notifications for an action you did not initiate, treat it seriously. Start the account recovery process and change your password immediately. A false alarm is not worth the risk of ignoring a real breach.

Check your last account activity. In the bottom-right corner of your Gmail desktop window, you will see a snippet showing the last time your account was accessed. Check this each time you log in to spot unfamiliar activity. Click “Details” for a more detailed view showing how, when, and on which devices your account was used.

Spyware can capture your password as you type it, so keep your browser and operating system updated. If you suspect spyware on your device, remove it before you change the password. Review Android’s Smart Lock settings too, since a trusted place or device keeps the phone unlocked.

Can You Send a Secure Email from Gmail?

Gmail gives you three options, and they aren’t equally available. Confidential mode works on every account, and the two real encryption features need specific Workspace editions.

Feature	What Google says it does	Editions Google lists
Confidential mode	Google says it disables forward, copy, print and download for the recipient	Google says it’s available in all Google Workspace editions
Hosted S/MIME	Google calls it enhanced encryption and shows a green lock	Google lists Frontline Plus, Enterprise Plus, Education Fundamentals, Education Standard and Education Plus
Client-side encryption	Google says your organization holds the only copy of the key	Google lists Frontline Plus, Enterprise Plus, Education Standard and Education Plus

Notice the two lists aren’t identical. Google includes Education Fundamentals for hosted S/MIME and leaves it out for client-side encryption, which is worth checking before you promise a school district anything.

What Confidential Mode Does Not Do

Google’s limitation is printed on all three platform tabs of its confidential mode article:

Although confidential mode helps prevent the recipients from accidentally sharing your email, it doesn’t prevent recipients from taking screenshots or photos of your messages or attachments.

Google’s admin-facing page words this differently, saying Gmail “always tries to block screenshots” of confidential messages while third-party apps might still copy them. Those two statements aren’t the same claim, and the user-facing one is the safer assumption.

The passcode option changes name by platform too. Google’s Computer tab calls the setting “No SMS passcode” and the Android and iOS tabs call the same setting “Standard.”

SMS passcodes are also regional. Google says they work only for numbers in North America, South America, Europe, Australia, and in Asia only India, Korea and Japan.

One thing Google never publishes is the list of expiry durations. Every Google page says “Set an expiration date” and none of them enumerates the options.

Any 1 day to 5 years list you read elsewhere is unsourced.

Does Gmail Have Virus Protection?

Yes. Google says attachments in Gmail messages you send and receive are automatically scanned for viruses. You don’t turn the scan on, and Gmail has no setting to turn it off.

Google documents one failure state. When the error “Gmail virus scanners are temporarily unavailable” appears, Google says to try the download later or open the attachment at your own risk. Wait and retry.

How Often Should You Change Your Gmail Password?

Never, on a schedule. The current federal standard tells verifiers not to force periodic changes at all, and most published advice is running years behind it.

NIST SP 800-63B-4, published July 2025, is direct about it:

Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically. However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised.

The length rules changed too, and they now depend on whether the password stands alone. NIST requires a 15-character minimum for a password used as single-factor authentication.

Passwords used inside a multi-factor setup can drop to an 8-character minimum, per NIST. Verifiers should also permit at least 64 characters.

Composition rules are out. NIST states that verifiers “SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types)” for passwords.

Two affirmative rules most guides skip: NIST says verifiers SHALL check passwords against a breached-password blocklist, and SHALL allow password managers and autofill.

Even Microsoft Contradicts Its Own Old Advice Here

Microsoft’s current guidance for Microsoft 365 says “The recommended setting is for passwords to never expire” for cloud-only accounts. Its archived Windows security baseline page still says to set maximum password age “between 30 and 90 days.”

The archived page even undercuts itself, noting the Microsoft security baseline omits password expiration because it’s less effective than modern mitigations. That stale page is a large part of why the 90-day rule refuses to die.

Which MFA Method Should You Use on Gmail?

CISA publishes an explicit ranking, and its table caption is the whole answer. Its October 2022 fact sheet is titled “MFA Forms, Strongest to Weakest.”

Rank	Method	What CISA says
Strongest	FIDO and WebAuthn, including passkeys and security keys, plus PKI	CISA calls phishing-resistant MFA the gold standard
Second	Authenticator app or hardware token codes, and push with number matching	CISA places these above push notifications without number matching
Third	Push notification without number matching	CISA ranks this below number-matched push
Weakest	SMS or voice call codes	CISA says these are vulnerable to phishing, SS7 and SIM swap attacks

CISA’s wording on SMS is unusually blunt. It states that this form of MFA “should only be used as a last resort MFA option.”

NIST reaches the same place by a different route. It designates the phone network for out-of-band authentication as the single restricted authenticator, and says manually entered codes can never count as phishing-resistant.

Don’t let perfect beat good, though. CISA also states that “Any form of MFA is better than no MFA.”

SMS on your Gmail account still beats nothing while you get a passkey set up.

One relevant NIST line for an email article: it states that email “SHALL NOT be used for out-of-band authentication.” Your inbox is the thing being protected, so it can’t also be the second factor.

How Do You Protect Individual Emails and Manage Third-Party Access?

Quick Answer: Use Gmail’s Confidential Mode to require SMS passcodes and set expiration dates for sensitive emails. Reduce third-party app access to your account by reviewing and revoking permissions for apps you no longer use. Only install add-ons from established, reputable publishers.

Use SMS passcodes for sensitive emails. Gmail’s Confidential Mode lets you add extra security to individual emails. Click the lock/clock icon in the compose window to access it. You can require an SMS passcode to view the email, you specify the recipient’s phone number, and they must enter the code to read the message. This is useful when an email contains sensitive information that warrants protection beyond standard delivery.

Set sensitive emails to expire. The second Confidential Mode feature is an expiration date. You can set an email to expire in a day, a week, a month, or on a specific date. When the email expires, it disappears from the recipient’s inbox automatically. This limits the window during which sensitive information can be accessed.

Reduce third-party app access. With many third-party apps available for Gmail productivity, it is tempting to install as many as possible. However, each app with API access to your account introduces a potential vulnerability. Any security issue with any connected app could expose your account. Review your third-party access in Google Security Checkup and revoke permissions for apps you no longer actively use.

Consider security-focused add-ons carefully. Add-ons like SecureGmail by Streak (which encrypts emails before they reach Google’s servers) and Ugly Email (which notifies you when incoming emails contain tracking pixels) can add useful security layers. However, installing apps from unfamiliar or non-established publishers may introduce more vulnerabilities than they solve. Only explore third-party security tools if you feel your account is at exceptionally high risk. For most users, Gmail’s built-in features, 2FA, Confidential Mode, and Security Checkup, are sufficient. For more ideas, see our full list of Gmail apps, add-ons, and extensions and our guide to email security best practices.

Gmail Security Settings That No Longer Exist

Four pieces of standard Gmail security advice now point at controls Google removed. If a guide tells you to do any of these, it hasn’t been checked since 2024.

1. Less Secure App Access Is Gone, and Google Gives Three Different Dates for It

Google’s Workspace admin page states the final position:

Starting May 1, 2025, Google Workspace accounts no longer support less secure apps, third-party apps, or devices that ask you to sign in to your Google Account with your username and password.

Google also says the less secure apps enforcement setting is no longer available in the Admin console at all. So there’s nothing left to turn off.

Three live Google pages give three different shutdown dates. The Gmail Help page says January 2025, a Workspace transition page says March 14, 2025, and the admin page above says May 1, 2025.

Two of those pages both print a last-updated stamp of 2026-07-29 and still disagree with each other. Treat May 1, 2025 as the real one, since it’s the page that documents the setting’s removal.

2. Turning IMAP Off Is No Longer a Security Step

Google removed the toggle. It states that “IMAP access is always enabled over OAuth and your current connections will not be impacted,” and that no user action is needed.

The same change ended password-only access for CalDAV, CardDAV, IMAP, SMTP and POP. Google specifically names Microsoft Outlook and the iOS and macOS mail apps among the clients affected.

3. App Passwords Are Discouraged, Not Recommended

Google’s own app passwords page opens with a warning that “App passwords aren’t recommended and are unnecessary in most cases.”

They also disappear under Advanced Protection. Google states that enrolling revokes any current app passwords and blocks apps that use them.

4. Security Questions Are Retired

Google states plainly that “Additional security questions are no longer available.” NIST agrees with the direction, saying verifiers SHALL NOT prompt subscribers to use knowledge-based authentication.

Google Advanced Protection: What Changed in 2024

The requirement everybody still quotes is out of date. Google wrote on July 10, 2024 that “Traditionally, users were required to have two physical security keys to enroll in APP.”

Passkeys now satisfy that requirement, so no hardware purchase is needed.

Google’s current enrollment options are two passkeys or security keys, one of each, or one passkey or security key plus recovery options. That’s a much lower bar than buying two hardware keys.

Google publishes no percentage for how well it works. Its strongest claim is categorical, and it sits on a Google Meet page rather than any Advanced Protection page:

we’ve yet to see people successfully phished if they participate in APP, even if they are repeatedly targeted.

Enrollment costs you convenience. Google says you need your passkey or security key to sign in on any new device.

Google also says some apps that need sensitive data stop working, and that account recovery takes extra steps.

Google’s own APP article has only Android and iPhone tabs and no Computer tab. If you’re setting this up at a desk, Google is documenting the phone flow at you.

The New Setting Almost Nobody Has Written About

Google now auto-removes sign-in methods it distrusts. Its at-risk sign-in methods page says a suspicious method gets restricted and you get an email alert:

If you take no action to verify the at-risk method, Google automatically removes it after 30 days.

Re-enabling one has a hard prerequisite. Google says you must have a trusted passkey or security key to turn an at-risk sign-in method back on.

Does 2-Step Verification Actually Stop Account Takeovers?

Google published a measured result rather than a model, and it’s the better of the two vendor figures. Its February 2022 security blog reported auto-enabling 2SV for over 150 million people and requiring it for over 2 million YouTube creators.

Google’s stated outcome was “a 50% decrease in accounts being compromised” among those users. That’s an observed drop across a real cohort, not a projection.

Microsoft’s number is modelled and it has moved. Its current Entra documentation says research shows MFA “can block more than 99.2% of account compromise attacks.”

That page links to a Microsoft blog whose own URL still says 99.9 percent.

Use 99.2 if you cite Microsoft. The 99.9 figure that saturates search results traces to a 2019 post Microsoft has since revised downward.

Start Here: Six Steps in Priority Order

1. Add a passkey to your Google Account, since CISA ranks FIDO and WebAuthn methods as the strongest form of MFA.
2. Move off SMS codes if you’re on them, because CISA says that form should only be used as a last resort.
3. Run the Security Checkup at myaccount.google.com and clear the recommended actions it surfaces.
4. Set a long unique password and stop rotating it, since NIST tells verifiers not to require periodic changes.
5. Review your linked apps and remove access for anything you don’t recognize or no longer use.
6. Enroll in Advanced Protection if you’re a journalist, activist, campaign staffer or admin, which is Google’s own list of who it’s for.

Security settings protect the account, and they say nothing about what your team is doing inside it. EmailAnalytics is a SaaS tool that visualizes team email activity in Gmail and Outlook.

Our page on the OAuth scopes we request and the ones we don’t spells out what that access covers.

Frequently Asked Questions About Gmail Security

Does Gmail have virus protection?

Yes. Google says attachments in Gmail messages you send and receive are automatically scanned for viruses. If the scanners are temporarily unavailable, Google says to retry later or open the file at your own risk.

How secure is Gmail by default?

Gmail stores emails in Google’s data centers with extensive physical and digital protections, and encrypts emails in transit using TLS. However, most security breaches occur on the user side, through weak passwords, phishing, malware, or leaving accounts signed in on shared devices. The biggest gains come from strengthening your own habits.

What is the single most effective step to secure a Gmail account?

Enabling 2-factor authentication (2FA). Even if someone obtains your password, they cannot access your account without the second factor, a code sent to your phone or a physical security key. If you later need to disable it, see our guide on how to turn off 2-step verification in Gmail.

How do you run a Google Security Checkup?

Visit myaccount.google.com/security-checkup. The tool shows signed-in devices, recent security events, recovery methods, and third-party app access. It alerts you to suspicious activity and confirms when no issues are found.

What makes a strong Gmail password?

A strong password combines upper-case and lower-case letters, numbers, and special symbols in hard-to-guess combinations. It should be long (each additional character increases difficulty by an order of magnitude), unique to Gmail (not reused on other accounts), and free of predictable patterns like birthdays or sequential numbers. Read more on password best practices.

How often should you change your Gmail password?

Not on a schedule. NIST SP 800-63B-4, published July 2025, states that verifiers “SHALL NOT require subscribers to change passwords periodically,” and should force a change only on evidence of compromise. Readers concerned about security gain far more from a passkey and a long unique password than from any rotation schedule.

Change it right away if you get a suspicious activity notification from Google.

What is Gmail Confidential Mode?

A built-in feature accessed via the lock/clock icon in the compose window. It offers two protections: requiring an SMS passcode (sent to a phone number you specify) to view the email, and setting an expiration date after which the email disappears from the recipient’s inbox automatically.

What is Google Advanced Protection?

Google Advanced Protection is a high-security program for users at elevated risk of targeted attacks. It requires a physical USB security key, limits third-party app data access, and adds extra verification during account recovery. It provides the highest level of Gmail security Google offers.

Should you use third-party security add-ons for Gmail?

Tools like SecureGmail by Streak and Ugly Email can add useful layers, but every third-party app with API access is a potential vulnerability. Only use established publishers, and only if your account is at exceptionally high risk. For most users, Gmail’s built-in 2FA, Confidential Mode, and Security Checkup are sufficient. See our full list of Gmail apps and extensions.

What We Checked, and When

Every Google, Microsoft, NIST and CISA claim on this page was read from the primary source on August 6, 2026. Google Help Center pages print no last-updated date, so none is implied for any of them.

Two figures were deliberately left out. Google runs a live TLS share dashboard that renders client-side and returned nothing readable, so no encryption percentage is quoted here.

The other absence is Confidential mode expiry durations, which Google has never enumerated on any page. Both gaps are stated rather than filled with a number from somewhere else.