When adding an account on a mail client, the SSL/TLS is usually turned off and the encryption method is 'none' (see Outlook example below).

Outlook POP account creation

Is the password safely sent through the internet when authenticating using the default settings?

It's hard for me to believe that reputable mail clients, such as Outlook, allow sending passwords in clear text over the internet without any warnings. Is password encryption automatically enforced?

  • What version of Outlook does the screen shot show? Have you tried to use an existing mail server? Most mail clients perform auto discovery or have a database of the mail settings and plain text connection are in my opinion outdated and I would be really surprised if Outlook really suggest them for an existing mail server.
    – Robert
    Mar 11, 2022 at 22:14
  • @Robert The version of my Outlook is the latest and is provided by my company: "Microsoft® Outlook® for Microsoft 365 MSO (Version 2202 Build 16.0.14931.20116) 64-bit". Can't be more updated. When entering my password in the next page, there is no warning whatsoever when trying to connect to the mail server without SSL/TLS encryption.
    – chckx592
    Mar 12, 2022 at 6:33

1 Answer 1


Without a secure connection between your mail client and the mail server, your authentication credentials are sent in the clear - just the same as they would be if you logged into a web site using http instead of https.

This is why many mail providers (such as gmail) only allow the client to proceed with authentication if the client is connected to the server through a secure connection.

Edit in response to comment:

As an example, see the transcript below of an SMTP session with smtp.gmail.com, where the client tries to authenticate with smtp.gmail.com over an insecure connection:

$ telnet smtp.gmail.com 25
Trying 2607:f8b0:4023:1407::6d...
Connected to smtp.gmail.com.
Escape character is '^]'.
s->c: 220 smtp.gmail.com ESMTP i12-20020a926d0c000000b002c3fa6cf756sm4341516ilc.25 - gsmtp
c->s: ehlo test
s->c: 250-smtp.gmail.com at your service, [2001:4801:7822:103:be76:4eff:fe11:923a]
s->c: 250-SIZE 35882577
s->c: 250-8BITMIME
s->c: 250-STARTTLS
s->c: 250-PIPELINING
s->c: 250-CHUNKING
s->c: 250 SMTPUTF8
s->c: 530 5.7.0 Must issue a STARTTLS command first. i12-20020a926d0c000000b002c3fa6cf756sm4341516ilc.25 - gsmtp

As you can see, the client sent AUTH LOGIN to signal to the server that it wants to attempt to authenticate, but the server responded with a 530 error, 'Must issue a STARTTLS command first'. smtp.gmail.com only allows the client to proceed with authentication if a) the client connects to the server securely by TLS (on port 465), or b) the client connects initially over an insecure connection on port 25 or 587, then upgrades the insecure connection to a secure connection using the STARTTLS command.

  • Just to be sure. Before the password is sent through the internet (even in clear text), is a successful connection to the mail server required first? That is: search for mail server -> server found -> initiate connection -> connection established -> send username/password. Is it possible that the mail client allows sending the password in clear text to gmail or is it stopped before?
    – chckx592
    Mar 11, 2022 at 11:28
  • Yes, that is the correct flow. Please see the edit that I made to my answer for more info.
    – mti2935
    Mar 11, 2022 at 13:09
  • Thanks, this answers my question.
    – chckx592
    Mar 11, 2022 at 13:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .