Gmail Introduces End-to-End Encryption for Android and iOS

Google has announced that Gmail now offers end-to-end encryption (E2EE) on all Android and iOS devices. This feature allows enterprise users to securely read and compose emails without the need for additional tools.

Encrypted messages will now be delivered as regular emails to Gmail recipients’ inboxes if they are using the Gmail app. For those who do not have the Gmail mobile app and use other email services, they can still read the encrypted messages in a web browser, regardless of the device and service they are using.

Google stated, “For the first time, users can compose and read these E2EE messages natively within the Gmail app on Android and iOS. No need to download extra apps or use mail portals. Users with a Gmail E2EE license can send an encrypted message to any recipient, regardless of what email address the recipient has.”

This new feature is available for all client-side encryption (CSE) users with Enterprise Plus licenses and the Assured Controls or Assured Controls Plus add-on. Admins can enable the Android and iOS clients in the CSE admin interface via the Admin Console to start using this feature.

To send an end-to-end encrypted message, Gmail users need to turn on the “Additional encryption” option by clicking the Lock icon when composing the message.

In addition to this, Gmail enterprise users can now send end-to-end encrypted emails to recipients on any email service or platform. The E2EE feature is powered by the client-side encryption (CSE) technical control, allowing Google Workspace organizations to use encryption keys they control to protect sensitive documents and emails.

Google introduced Gmail CSE in December 2022, starting with a beta test on the web. It later reached general availability for Google Workspace Enterprise Plus, Education Plus, and Education Standard customers in February 2023. The new end-to-end encryption (E2EE) model for Gmail enterprise users was rolled out in beta in April 2025.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Get Your Copy Now