Most people think of email as private, like a sealed letter. In reality, ordinary email is closer to a postcard. The people who run your email service can read what you write, and so can the people who run the recipient's service. Here is who can actually see your messages and what you can do about it.
What your email provider can see
When you send an email through Gmail, Outlook, or any mainstream provider, your message travels through the provider's servers. The provider can see the full content of your message, the subject line, the sender and recipient, and the time it was sent. They also see metadata: your IP address, the device you used, and the recipient's IP address.
Most providers scan email content for spam detection, malware, and — in some cases — advertising targeting. Google has stated it no longer scans Gmail for ad personalization, but the technical ability to read messages remains. Microsoft and other providers have similar capabilities.
The postcard problem: standard email is not encrypted end-to-end
Standard email uses TLS encryption in transit between providers, which means a third party cannot read it while it is traveling. But TLS does not protect the message from the provider itself. The provider holds the keys to decrypt it, and it stores the message on its servers in a readable form.
True end-to-end encryption — where only you and the recipient can read the message — requires additional tools. The most common is PGP (Pretty Good Privacy), which encrypts your message before it leaves your device. PGP is not widely used because it requires both parties to manage encryption keys, which most people find complicated. A newer option is Proton Mail or similar services, which encrypt messages between their own users automatically and offer encrypted communication with external users on a best-effort basis.
What encryption actually protects
With standard TLS encryption (which covers most email today):
- Protected in transit: a third party cannot read your email while it is being sent.
- Not protected from the provider: the provider can read the message.
- Not protected from the recipient's provider: the recipient's provider can also read it.
- Not protected after delivery: once the recipient's provider stores it, their security policies apply.
With end-to-end encryption (PGP or Proton-style):
- Protected from both providers: neither your provider nor the recipient's can read the message.
- Protected in transit: the message is encrypted before it leaves your device.
- Not protected if the recipient's device is compromised: end-to-end encryption protects the message only until it is decrypted on the recipient's device.
Metadata: what you reveal without meaning to
Even if the content of your email is encrypted, the metadata surrounding it is usually visible. Your email provider can see:
- Who you email and how often (the "to" and "from" fields).
- The subject line (often not encrypted).
- The time and date of every message.
- Your IP address and device information.
- The size of attachments.
This metadata alone can reveal a lot about your life — who your contacts are, when you are active, and which services you use — without anyone reading a single word.
What you can do to reduce exposure
- Assume your provider can read your messages. Choose a provider with a strong privacy policy, and do not include sensitive information in email that you would not post on a public forum.
- Use end-to-end encryption for sensitive messages. If you must send sensitive data, consider PGP or use a service like Proton Mail that encrypts by default between its users.
- Encrypt attachments before sending. For documents, photos, and files, zip them with a password (sent separately) or use a secure file sharing service. Our secure file sharing guide covers the options.
- Be aware of metadata. The "to" and "from" fields, subject lines, and timestamps are visible to your provider. Keep subject lines generic and consider that metadata alone is revealing.
- Use a separate email for sensitive accounts. Keep one inbox for financial accounts, work, and recovery, and another for newsletters, signups, and shopping. Our email account security guide covers securing the primary inbox.
- Delete old emails that contain sensitive information. Old messages with passwords, account numbers, or scanned documents are a risk if your account is ever compromised. The Google account privacy checkup walks through deleting old activity.
Quick answers
Can my email provider read my messages? Yes — unless you use end-to-end encryption (PGP or a service like Proton Mail), the provider can read the content of your messages.
Is TLS encryption enough for privacy? TLS protects your email from third parties in transit, but it does not protect the message from the provider itself. It is like a sealed envelope that the post office is allowed to open.
How do I send an encrypted email? The most accessible option is to use a service that encrypts by default, like Proton Mail, or to use PGP if both parties are comfortable with key management. For most people, the simpler option is to avoid including sensitive information in email.
What is metadata and why should I care? Metadata is the information around your messages — who you email, when, how often, and from where. It can reveal a lot about your life even if the content of the messages is encrypted.
Sources and further reading
Written by Hassan Arshad, founder of UsefulOrbit. Last updated August 31, 2026.