You are about to send a contract, a payslip, a set of login details, or a private medical note, and a small voice says: what happens to this email after it leaves my outbox? Once a normal message lands in someone else's inbox, you have lost control of it completely — they can forward it to anyone, print it, screenshot it, or leave it sitting in a mailbox that gets breached two years later. Gmail confidential mode is Google's built-in answer to that anxiety: a way to send email that expires on a schedule, blocks the obvious ways to copy it, and can even demand a texted passcode before it opens.
The catch is that almost nobody uses it correctly, and plenty of people trust it to do things it simply cannot. Confidential mode is genuinely useful for the right job and quietly useless for the wrong one, and the difference comes down to understanding exactly what it locks and what it leaves wide open. This guide walks the whole feature end to end for 2026 — how to switch it on across desktop and mobile, how expiration and SMS passcodes really behave, how to pull a message back after you have sent it, and the hard limits that mean confidential mode is a privacy convenience, not a vault.
What Gmail Confidential Mode Actually Is
At its heart, Gmail confidential mode is a sending option that changes how a single message behaves after you hit send. Instead of delivering a plain email the recipient owns forever, Google wraps the content in a set of controls: the message can be set to expire after a chosen period, the recipient is blocked from using Gmail's forward, download, copy, and print buttons, and you can require a one-time passcode sent by SMS before the message will even open. It has been part of Gmail for years, but Google has leaned on it harder in 2026 as data-loss and phishing worries push people toward anything that limits how far a sensitive message can travel.
Under the hood, confidential mode does something subtle that trips a lot of people up. When you send to another Gmail or Google Workspace user, they see the message inline as normal, just with the toolbar buttons greyed out and an expiry note at the bottom. When you send to a non-Gmail address — an Outlook, Yahoo, or company mailbox — the recipient does not receive your actual text. They receive a short notification email with a link, and clicking that link opens your message on a Google-hosted page. In effect, confidential mode keeps the real content on Google's servers and only ever shows it through a controlled viewer, which is how it enforces expiry and the copy restrictions in the first place.
That architecture is the key to understanding both its strengths and its ceiling. Because the content lives with Google rather than in the recipient's mailbox, you keep a lever to pull — you can expire or revoke it later. But because the recipient can still see the message on their screen, confidential mode can never stop a determined person from reading, memorising, or photographing what is in front of them. Hold that idea; the rest of this guide keeps coming back to it.
How to Turn On Confidential Mode on Desktop
Switching on confidential mode from a computer takes about ten seconds once you know where the button hides. It lives in the compose window, not in Settings, so you enable it per message rather than as an account-wide default:
- Open a new message. Click Compose in Gmail on the web to bring up the message window.
- Find the confidential mode icon. Along the bottom toolbar of the compose window, look for a small padlock with a clock over it. Hover to confirm it reads "Turn confidential mode on/off," then click it.
- Set your controls. A panel opens where you choose an expiration period and decide whether to require an SMS passcode. Pick your options and click Save.
- Write and send as normal. Finish your subject, body, and recipients, then send. A coloured banner at the foot of the draft confirms confidential mode is active and shows the expiry you chose.
Two details are worth flagging. First, if you already added an attachment, confidential mode changes how it is delivered — recipients view attachments through the same protected viewer and cannot download them, which is often exactly the point. Second, you can still edit the settings after clicking Save: reopen the confidential mode panel from the banner at the bottom of the draft and adjust the expiry or passcode before you send. Once the message is gone, though, the expiry is set at send time, and while you can shorten a recipient's access by revoking early, you generally cannot extend it — so choose a window with a little breathing room.
Using Confidential Mode on Android and iPhone
The mobile Gmail app carries the same feature, tucked one layer deeper into a menu. The steps are nearly identical on Android and iPhone because both run Google's own app:
- Tap Compose to start a new message in the Gmail app.
- Open the overflow menu. Tap the three-dot icon in the top-right corner of the compose screen.
- Choose Confidential mode. Tap it, then set the expiration period and the passcode requirement.
- Save and send. Confirm your settings, return to the message, and send as usual.
One thing to double-check on mobile: make sure you are composing inside the official Gmail app rather than a third-party mail client. Confidential mode is a Gmail feature, so apps like Apple Mail, Outlook, or Spark do not expose the toggle, and a message you compose there will go out as an ordinary, uncontrolled email. If you rely on a non-Gmail app day to day but occasionally need to send something sensitive, the simplest fix is to open the Gmail app just for that one message. Keeping a clean, dedicated inbox for sensitive correspondence is a habit that pays off — it is one reason people who run outreach or client work lean on separate, well-established aged, phone-verified Gmail accounts rather than mixing everything into a single overloaded address.
Setting an Expiration Date That Makes Sense
The headline feature of Gmail confidential mode is expiry: the message stops being viewable once the clock runs out. Google gives you a fixed menu of windows rather than a free-form date picker, and in 2026 the choices are one day, one week, one month, three months, or five years. When the period elapses, the recipient can no longer open the content — a Gmail user sees the body disappear, and a non-Gmail user finds the viewer link no longer works.
Choosing the right window is more of an art than people expect. Too short, and you create friction: the recipient opens your message, gets pulled away, comes back after the weekend, and finds it already gone, so now they are emailing you asking for a resend. Too long, and you have defeated the purpose — a five-year expiry on a password reset note is barely different from a normal email. A useful rule of thumb is to match the window to how long the information stays sensitive and how long the recipient realistically needs to act on it. A one-time code or a document for signature might warrant one day to one week; a reference file someone needs to consult occasionally might justify a month or three.
Keep one behaviour in mind: expiry is enforced by Google's viewer, not by deleting anything from the recipient's device. If the recipient screenshotted or transcribed the content while it was live, the expiry does nothing to that copy. Expiration is best understood as "how long the original stays accessible," not "when the information is guaranteed destroyed." That distinction becomes critical in the limits section below, and it is the single most common misunderstanding about confidential mode.
The SMS Passcode Layer, Explained
Beyond expiry, confidential mode offers a second control: requiring the recipient to enter a passcode before the message opens. You choose between "No SMS passcode" and "SMS passcode" when composing. With the passcode on, Google texts a one-time code to the recipient's phone, and they must enter it to view the message — a lightweight form of two-factor protection wrapped around a single email.
This is powerful precisely when you are worried about the wrong person reaching the inbox. If a recipient's email account is compromised, or if you have a nagging fear you might fat-finger the address and send to the wrong contact, the SMS passcode means merely receiving the email is not enough to read it — an attacker would also need the recipient's phone. There is a practical catch, though: you have to supply the recipient's phone number when you compose, and Google uses that number to send the code. If you get the number wrong, or you do not have it, the recipient cannot open the message. For Gmail-to-Gmail sends, Google can sometimes use the number already on the recipient's account; for external recipients, you typically must enter it yourself.
Because of that dependency, the SMS passcode is best reserved for genuinely high-stakes messages where you already know the recipient's mobile number and the extra step is worth it. For routine "please don't forward this" emails, expiry plus the copy restrictions is usually enough, and skipping the passcode avoids the awkward support loop that starts when a code does not arrive. If your concern is broader account takeover rather than a single message, the more durable fix is hardening the accounts themselves — the same logic that drives people to lock inboxes down against session hijacking and cookie theft rather than trusting any one message-level control.
How to Recall or Revoke a Message Early
One of the most useful and least-known powers of confidential mode is that you can cut off access before the expiry date arrives. This is not the same as Gmail's ordinary "Undo Send," which only works for a few seconds after sending and genuinely pulls the message back before delivery. Confidential mode revocation works after the recipient already has the message, because the content still lives on Google's servers behind the viewer.
To revoke access, open your Sent folder, find the confidential message, and open it. You will see a "Remove access" option. Click it, and the recipient can no longer open the content, even if the expiry you set is still days or months away. This is your emergency brake for the classic mistakes: you sent to the wrong "John," you attached the wrong version of a file, or a deal fell through and you would rather the other side no longer had the numbers. It will not un-ring a bell someone has already read — but it slams the door on anyone who has not yet opened it, and on future re-opens by those who did.
The reverse is also true and worth remembering: if you revoked too hastily, you can usually restore access from the same sent message, which reopens the viewer for the recipient. Treat "Remove access" as a reversible switch rather than a permanent shredder. And because revocation only reaches what Google still controls, it reinforces the golden rule one more time — the protection ends the instant a human has the content on their screen. If your worry is that a message might be spoofed or tampered with in transit rather than over-shared afterward, that is a different problem better handled by sender authentication, which is where Gmail's "be careful with this message" warnings and SPF/DKIM checks come in.
Receiving a Confidential Email
It helps to see the feature from the other side, because how you experience an incoming confidential message depends entirely on where you read it. If you are a Gmail or Google Workspace user, a confidential message arrives in your inbox looking almost normal, with the body visible inline. The tell is that the forward, download, print, and copy buttons are greyed out, and a line at the bottom notes that the content is confidential and when it expires.
If you use a non-Gmail service, the experience is different. You receive a short notification email — often just a subject and a line saying someone sent you a confidential message — with a button to view it. Clicking through opens the real content on a secure Google-hosted page in your browser. If the sender required a passcode, you enter the code texted to your phone first. When the expiry passes or the sender revokes access, that link stops working and shows a message that the content is no longer available. None of this requires a Google account on the recipient's part, which is why confidential mode works to any address at all.
For recipients, two practical tips matter. First, if you need to keep the information, act while the message is live: with downloads blocked, your legitimate options are to note the key details, act on them, or reply to ask the sender for a durable copy — not to rely on the confidential message being there next month. Second, be alert that scammers occasionally mimic the look of a "you have a confidential message, click to view" email as a phishing lure. A genuine confidential mode notification links to a google.com domain; anything asking you to log in with your email password on an unfamiliar page is a red flag, the same instinct that protects you from broader inbox scams.
What Confidential Mode Does Not Protect Against
This is the section that saves people from a false sense of security, so read it before you trust Gmail confidential mode with anything truly critical. The feature restricts convenience, not capability. Here is what it explicitly cannot stop:
- Screenshots and photos. Nothing prevents a recipient from taking a screenshot on their computer, or simply photographing the screen with a second phone. The moment content is visible, it is capturable.
- Manual copying. The copy button is disabled, but a recipient can retype what they read or read it aloud to someone else. Confidential mode blocks the shortcut, not the human.
- Google's own access. Because the message is not end-to-end encrypted, it sits on Google's servers in a form Google can process. Confidential mode is not a shield against Google, lawful requests, or a server-side breach in the way true encryption would be.
- A compromised recipient device. If malware is on the recipient's computer or phone, it can read what the recipient reads. The controls live in Gmail's interface, not on the recipient's hardware.
- Determined forwarding of the gist. A recipient who wants to leak your information can describe it, dictate it, or share their screen. The feature raises friction, not an impassable wall.
None of this makes confidential mode worthless — raising friction genuinely reduces casual oversharing, and expiry plus revocation are real, useful controls. But it does mean you should never treat it as a substitute for encryption when the stakes are high. If leaking a piece of information would be catastrophic, confidential mode is the wrong tool, and the next section explains what to reach for instead.
Confidential Mode vs Real Encryption
The most important mental model is this: confidential mode is access management, not encryption. It controls who can open a message and for how long, but it does not make the message unreadable to anyone who isn't the intended party at a cryptographic level. Standard emails, including confidential mode messages, are encrypted in transit and at rest by Google in the ordinary sense, but Google holds the keys and can therefore process the content. That is fine for most correspondence and inadequate for the rare message that must be secret from everyone, Google included.
When you genuinely need content that no intermediary can read, you want end-to-end encryption, where only the sender and recipient hold the keys. Google Workspace has expanded client-side encryption options for business and enterprise tiers in 2026, and outside Gmail there are dedicated encrypted-email services and tools like PGP for the technically inclined. The trade-off is friction: real end-to-end encryption usually requires both parties to be set up for it, which is exactly the hurdle confidential mode was designed to avoid. Think of it as a spectrum — confidential mode for "please handle this carefully and don't spread it around," true encryption for "this must be mathematically secret."
There is also a privacy angle worth naming. Confidential mode does not opt your message out of Google's normal processing. If your concern is Google's AI reading and learning from your mail, that is a separate setting entirely, covered in our guide to turning off Gmail's Gemini AI features. And if you simply want to compartmentalise which address different types of correspondence flow through, Gmail's aliases and address-masking tricks solve a different slice of the same overall privacy puzzle. Confidential mode is one tool in that kit, not the whole kit.
When to Use It — and When Not To
Put together, the picture of where Gmail confidential mode earns its keep becomes clear. It shines for everyday sensitive-but-not-secret messages where you want a reasonable guardrail without asking the recipient to install anything or learn anything. Good fits include:
- Sharing a document for review that you would rather not have forwarded around an organisation without your knowledge.
- Sending a temporary credential, invite code, or reference number that should stop working after a short window anyway.
- Emailing lightly sensitive personal information — a form, an ID number for a one-off verification — where a short expiry limits the exposure if the recipient's inbox is later breached.
- Correspondence you might need to retract, where the ability to revoke access after sending is genuinely valuable.
Equally, there are moments to skip it. Do not use confidential mode when the recipient needs a permanent copy — a receipt, a signed contract, anything they must file — because the expiry and download block will just annoy them into asking for a resend. Do not use it as your only defence for information that would be devastating to leak; reach for real encryption there. And do not assume it makes you anonymous or hides anything from Google. Used with those boundaries in mind, confidential mode is a smart, low-effort upgrade over sending sensitive things as plain email. Misunderstood, it becomes a comfort blanket that gives you confidence you have not actually earned. If your broader goal is running clean, secure, and separated inboxes for business or outreach, pairing good habits like this with properly aged, well-recovered accounts — the kind we cover across our Gmail security guides — is what actually keeps your correspondence safe.
Frequently Asked Questions
Does Gmail confidential mode actually stop the recipient from saving my email?
It stops the easy methods but not the determined ones. Confidential mode disables the forward, download, copy, and print buttons in Gmail's interface, which prevents casual resharing. It does not — and cannot — stop a recipient from taking a screenshot, photographing their screen with another device, or simply retyping what they read. Treat it as a way to raise friction and signal that a message is sensitive, not as a technical guarantee that the content can never leave the recipient's hands. For information that would be catastrophic to leak, you need true end-to-end encryption, not confidential mode.
Can I recall a confidential email after I have sent it?
Yes, and this is one of its best features. Because the content stays on Google's servers behind a viewer, you can open the message in your Sent folder at any time before it expires and click "Remove access." The recipient can then no longer open it, even if the expiry date is still far off. This is different from "Undo Send," which only works for a few seconds after sending. Revocation is reversible too — you can restore access from the same message — but it cannot undo anything the recipient has already read or captured while the message was live.
Is Gmail confidential mode the same as encryption?
No. Confidential mode is access management, not end-to-end encryption. It controls who can open a message and for how long, but the content still sits on Google's servers in a form Google can process, and Google holds the keys. Standard Gmail encrypts messages in transit and at rest, but that is not the same as being secret from Google itself. If you need a message that no intermediary can read, look at Google Workspace's client-side encryption on business tiers, a dedicated encrypted-email service, or PGP — and expect more setup on both ends than confidential mode requires.
What happens when a confidential email expires?
When the expiry period you chose runs out, the message stops being viewable. A Gmail recipient sees the body disappear from the message, and a non-Gmail recipient finds that the "view" link no longer opens anything, showing instead a notice that the content is no longer available. Importantly, expiry only affects the copy Google still controls through its viewer — it does not reach into the recipient's device to delete a screenshot or notes they made while the message was live. Expiration means "the original is no longer accessible," not "the information is guaranteed destroyed everywhere."
Do non-Gmail recipients like Outlook users get confidential mode messages?
Yes, but they see it differently. Instead of the message appearing inline, a non-Gmail recipient receives a short notification email with a link. Clicking it opens the real content on a secure Google-hosted page in their browser, and if you required an SMS passcode, they enter the texted code first. When the message expires or you revoke access, that link stops working. No Google account is needed on their end, which is why confidential mode works to any email address — though it does mean the experience involves an extra click compared with a normal email.
Why is the confidential mode padlock icon missing when I compose?
Almost always because you are not in the official Gmail app or web interface. Confidential mode is a Gmail feature, so third-party clients like Apple Mail, Outlook, or Spark do not show the toggle — a message composed there sends as an ordinary, uncontrolled email. On the web, look for the padlock-with-a-clock icon in the compose window's bottom toolbar; on mobile, tap the three-dot menu in the Gmail app's compose screen. If a Workspace administrator has disabled the feature for an organisation, it can also be hidden, in which case you would need to ask your admin to enable it.
Want inboxes built for secure, separated correspondence — with real recovery details and clean sending histories so features like confidential mode sit on a solid foundation? If you run outreach, client work, or any operation where privacy and deliverability both matter, explore our aged, phone-verified Gmail accounts. Have a specific question about confidential mode or Gmail security? Message us any time on Telegram at @mixgmail — we answer real questions from real users every day.
