Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Gmail provides an SSL connection and also encrypts the entire session by default. But if you send a mail, once it leaves gmails servers, it can be read at any point on the internet. But what about Gmail to Gmail paths (i.e. I send an email from my gmail account to somebody elses gmail account). Is that encrypted too, within gmails own servers? Also the same question for gmail chat (chatting with another gmail user).

share|improve this question
That's a question for Google, not us (and I'd be very alarmed if they'd answer it!). They could do it, or not: there are good reasons for them to go either way. My money would be on them not doing it, but I've no way of knowing. –  Graham Hill May 3 '12 at 10:51
When in doubt, PGP. –  Iszi May 3 '12 at 12:35
Related: security.stackexchange.com/a/13222/953 –  Iszi May 3 '12 at 12:36
Ah, thanks Iszi, that gives me an idea of an answer. –  Graham Hill May 3 '12 at 13:46
thanks, I just found this one, which answers it very well...except for Google Chat security.stackexchange.com/questions/6489/… –  Mark May 3 '12 at 18:08

1 Answer 1

While we have no visibility of Google's internal security measures, there is a more general answer.

There are two common approaches to securing an email.

  • You can encrypt the contents at one client, and decrypt them at the other client.
  • You can set up secure channels and send the mail over that.

Both work in theory, but in practice it is very difficult to be sure that the channel stays encrypted over the whole of it's journey, because you usually don't control each step of the way.

In addition, even if Google were encrypting their internal traffic, they decrypt it at various points so they can read the contents (so they can target adverts at you) so they, or an internal attacker, can access your mail regardless.

So as a general rule, if you need to email confidential information, you should encrypt it at the client.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.