How to Encrypt a Message Before Sending It: Methods, Security Levels, and Best Practices
How to Encrypt a Message Before Sending It: Methods, Security Levels, and Best Practices
Photo via Pexels
The Three Questions That Determine the Right Method
Before picking a tool, it helps to answer three quick things about the message itself.
Is this a one-off or an ongoing conversation? A single password or account number is a different problem than an ongoing relationship where you'll be sending sensitive things regularly.
Does the recipient already have a secure channel with you? If you're both on the same encrypted messaging app already, that's usually the simplest path — no new tool required.
Who, specifically, are you trying to keep this from? A curious platform employee, a network eavesdropper, and someone with physical access to a device all call for different defenses.
Choosing a Method: A Quick Decision Path
Start from what you're sending, not from a general desire to "encrypt something" — the right tool follows directly from the answer.
The diagram above is the short version of this entire article: figure out which of the three branches you're on, and the rest of the decision mostly makes itself. The three method sections below walk through each branch in more detail.
Method 1: Send It Through an Already End-to-End Encrypted App
If you and the recipient already share an end-to-end encrypted messaging app, this is usually the least effort for the most protection — there's no new tool to introduce, and the encryption happens automatically in the background. The catch is confirming the app actually offers end-to-end encryption by default for the conversation type you're using, since some apps only encrypt certain chats or require it to be turned on manually.
Confirm the specific conversation — not just the app in general — shows as end-to-end encrypted, since group chats and backups sometimes work differently than direct messages.
Turn off or secure chat backups separately, since an unencrypted cloud backup can undo the protection the app itself provides.
Method 2: Use a Self-Destructing Secret Link for One-Off Secrets
For a single password, API key, or account number that doesn't need an ongoing encrypted conversation, a secret-link tool is often the more practical choice — it doesn't require the recipient to install anything, and it removes itself after one view instead of sitting in an inbox indefinitely.
Look specifically for client-side encryption and one-time viewing, not just a randomly generated URL, since the randomness alone isn't what makes it secret.
Send the link and any passphrase through two different channels so a single compromised inbox isn't enough to expose both.
This method — and the properties that make a link genuinely one-time and encrypted — is covered in more depth in our guide to creating a secure secret link.
Method 3: Encrypt a File or Note Yourself Before Sending
Sometimes what you're sending is a document rather than a short message, and neither an E2EE chat nor a secret link is the natural fit. In that case, encrypting the file yourself before it ever touches an email or upload is the more reliable option, though it does take a bit more setup.
A password-protected compressed archive (most operating systems and archive tools support this natively) works for one-off documents, as long as the password travels through a separate channel.
Dedicated encrypted note or file tools add a layer of client-side encryption specifically, which is generally stronger than relying on a document editor's built-in password protection alone.
For recurring, higher-stakes correspondence — legal or journalistic work, for example — a public-key method like PGP is worth the setup cost, though it has a real learning curve for both sides of the conversation.
Methods That Look Like Encryption But Aren't
A "Confidential" email label or banner — this is a display setting, not encryption; the message content is unchanged and still readable in transit and storage the same as any other email.
A password-protected document sent by the same email as the password. If both arrive in the same compromised inbox, the password protection adds essentially no real barrier.
Deleting a message after sending it. This removes it from view, not from every server, backup, or device it already reached — it isn't a substitute for encrypting it in the first place.
A screenshot of sensitive text sent instead of the text itself. This doesn't encrypt anything and often makes things worse, since the image can end up backed up to a camera roll or cloud photo library indefinitely.
Security Levels at a Glance
E2EE messaging app
Minimal effort once set up, strong protection for both parties, but only for conversations the app fully covers.
Effort: low · Protection: highSelf-destructing secret link
Minimal effort, strong protection for a single item, but not built for back-and-forth conversation.
Effort: low · Protection: highEncrypted file or archive
Moderate effort, solid protection, but depends heavily on sending the password through a separate channel.
Effort: medium · Protection: medium-highPublic-key methods like PGP
Higher effort and setup on both ends, but strong, well-understood protection for recurring sensitive correspondence.
Effort: high · Protection: highStandard email or chat
No real effort, but only protects against network interception, not against the provider itself or a compromised inbox.
Effort: none · Protection: lowFrequently Asked Questions
Do I need to encrypt every message I send?
No — most everyday conversation doesn't need special handling beyond the standard protections most apps already provide. Reaching for one of the methods above makes the most sense specifically for passwords, financial details, health information, or anything else you'd consider genuinely sensitive.
Is it safe to just use my email provider's built-in encryption?
It depends what that encryption actually covers. Many providers encrypt messages in transit and at rest, but that's different from end-to-end encryption — the provider itself can often still read the content, so check specifically which type of protection is being offered.
What's the easiest method for someone who isn't very technical?
A self-destructing secret link is often the simplest for a one-off secret, since the recipient just clicks a link and reads it — no app to install and no encryption concepts to understand on their end.
Does encrypting a message also hide who I'm sending it to?
Generally not on its own. Most encryption methods protect the content of the message, but metadata like sender, recipient, and timing is often still visible to the platform carrying it, even when the content itself isn't.
There's no single "most secure" way to encrypt a message — there's only the method that matches what you're actually sending, to whom, and how often. Start from the content and the relationship, not from a general instinct to encrypt something, and the right tool from the three above usually becomes obvious on its own.