Ask whether Gmail is safe and you get two answers at once. Attackers will find the inbox itself hard to crack. The archive behind it keeps no secrets from Google. My answer, as the person behind AliasFleet, an email-alias service, is to split the question: keep Gmail as the inbox everything lands in, and stop giving the Gmail address itself to websites.
That split carries the whole piece: on security, Gmail's engineering is hard to fault, while on privacy its position is poor. Hold both halves in view and the fix stops looking like a compromise.
Gmail's security is the strong half
Security first, since that is the half Gmail wins. Google's number: Gmail stops more than 99.9% of spam, phishing attempts and malware before they reach you. Its AI filters stop nearly 10 million spam emails every minute, yet remember that the 99.9% is Google's own figure, which nobody independent has audited. The direction of travel still holds: Gmail's filtering leads the field, and a small provider's filtering sits far behind. The Safety Centre Gmail page lists the same protections: Safe Browsing warnings on dangerous links, plus proactive alerts before you download a risky attachment.
Filtering is only the outer wall. Behind it comes account protection, with Gmail watching for sign-ins that look suspicious. Google has steered users toward passkeys, which became the default sign-in option for personal Google Accounts in October 2023. A passkey proves the device is in your hands. Nothing to type, nothing to steal by phishing. Passwords and 2-step verification still work next to it. People facing targeted attack, journalists, activists, executives, get the Advanced Protection Program, with tougher sign-in rules. Google has written up these phishing defences for years: machine learning detection, Safe Browsing warnings, risk-based sign-in challenges and attachment malware scanning, all in a 2017 post on protecting users against phishing.
People overclaim on encryption. Inside Google's infrastructure, Gmail encrypts messages at rest and in transit. Mail moving to third-party providers gets TLS, when possible or required by configuration. That last clause does heavy lifting. TLS guards one hop at a time. Each leg of the journey gets protection, and each server along the way holds a readable copy. Call it transport encryption, because that is what it is.
Real end-to-end encryption exists in Gmail. Probably not for you, though. Client-side encryption belongs to paid Google Workspace: Enterprise Plus, Education Plus, Education Standard and Frontline Plus. It scrambles the body, inline images and attachments in the browser, before Google stores anything. The header, subject, timestamps and recipients still travel unencrypted. Free consumer Gmail gets none of it. Both the editions and the header limit are spelled out on Google's client-side encryption help page. Security verdict: strong filtering, strong login options, ordinary transport encryption, zero end-to-end encryption for free users.
Google still holds the whole archive
Privacy next. Google's Privacy Policy states that it collects the content you create, upload or receive. Email you write and receive counts. Automated systems analyse that content, the policy adds, to provide tailored results, personalised ads, or other features, and to catch abuse such as spam, malware and illegal content. Read that twice: machines do the analysing, and features and abuse detection are the purposes. No person reads your mail, and nor is it ads scanning. Your mail is no sealed box, though. Google processes it.
On advertising, the same policy draws a line: personalised ads based on your content from Drive, Gmail or Photos are ones Google does not show, information that personally identifies you stays away from advertisers unless you ask Google to share it, and your personal information is not for sale. The Google Privacy Policy carries all of that. A 2020 Google post stated the ads point bluntly. The company does not use information in apps where you primarily store personal content, such as Gmail, Drive, Calendar and Photos, for advertising purposes, period. That post, Keeping your private information private, also concedes the retention half. Gmail, Drive and Photos are designed to store your personal content, so default auto-delete periods skip them. Plainly, Gmail keeps your mail until you delete it, so receipts, password resets, travel bookings and private conversations from years back all live in one searchable archive.
Metadata comes next. Nobody needs to read a word of your mail. The headers alone sketch your life in outline. Who writes to you, when, how often, through which services. Google's systems see every bit. Third-party apps you once granted access to see it too, though that door has narrowed. Criticism in 2018 over apps reading inbox data pushed Google to restrict Gmail API access from January 2019. Only apps that directly enhance email functionality qualify now, such as email clients, backup services and productivity tools, with re-verification mandatory and selling harvested data banned. ZDNet's reporting on the new rules covers the deadlines and the assessment requirements. Bulk inbox harvesting grew harder, though it never became impossible, and apps you approved yourself sit outside those rules.
Privacy verdict, then: Google sells none of your mail, targets no ads from it, and still keeps a deep, permanent, analysable archive. Want no single company holding your correspondence? Gmail fails that test, while a reader who wants no advertisers reading their mail gets a pass, since that practice ended in 2017.
The ads-scanning question, settled with a date
Does Google still scan mail for ads?
No. Of all the outdated claims about Gmail, this one circulates most, and it needs a date pinned to it. Before 2017, Google scanned consumer Gmail content to personalise ads. June 2017 brought the announcement: consumer Gmail would follow the business version, already free of ads personalisation, and after the change its content would go unused and unscanned for any ads personalisation. Settings, not mail content, would drive ads. Google's blog still carries the original 2017 announcement. Current Gmail Help repeats it more plainly: ads show based on your online activity while signed into Google, and "we will not scan or read your Gmail messages to show you ads". That wording comes from the How Gmail ads work page, which also explains the opt-out. Switch off Ads Personalisation and ads keep showing, only no longer based on personal data Google has tied to your account.
The scanning that remains differs in kind. Gmail scans for spam, phishing and malware. It scans to run features like categorisation and Smart Reply. It scans to catch abuse. Ads get none of it. The distinction counts, because believers in the old claim take the wrong step. They leave Gmail for a provider whose phishing filtering is worse, then hand the new address to every site that asks. They swapped the strong half for the weak half and fixed nothing.
Two Gmail features sit inside this confusion. Both deserve a straight description. Confidential mode sets an expiry date, revokes access, and disables forwarding, copying, printing and downloading. Google's own help page warns that recipients can still grab screenshots or photos, and that malicious programs can still copy or download messages. Access control, not encryption. The confidential mode help page states the limits plainly. For real encryption, client-side encryption, covered above, costs money and lives on Workspace plans.
Confidential mode controls what the recipient can do inside Gmail. It does not encrypt the message, and a screenshot defeats it in seconds, so use it to set an expiry date rather than to send anything that must stay unreadable in transit.
Keep Gmail, hide the address
Aliases earn their place right here. Keep Gmail. Best filtering, best login options, and the inbox you already live in: all yours already. Websites stop getting the Gmail address. Each site gets its own alias instead, a forwarding address that lands in your Gmail inbox. One alias means one managed, persistent identity for one relationship. It lives as long as you want. Pause or delete it when the relationship ends, or when junk starts arriving on it.
Simple mechanism. Different breach math. A site leaks, and the leaked address is that site's alias. No other site held that alias, so the leaker names itself. Kill the alias and the channel dies with it, while your real inbox stays untouched and every other alias carries on. Phishing sent to the dead alias reaches nobody. An attacker's password reset against the alias never arrives as a reset on your Gmail address. Nothing you wanted is lost. The alias existed only to let that one site reach you.
The privacy half gets an answer here, with no need to abandon the security half. Mail that arrives still sits with Google. Aliases leave that untouched. What shrinks is the circulation of your Gmail address, the linkability of your accounts, and the damage one breach can do. A sock shop's breach should never hand attackers the address behind your bank, your cloud storage and your password resets. With aliases, it cannot.
New to the alias idea? Begin with what an email alias is and continue with how to set up an email alias. Setup takes minutes, and the habit takes a week to form. Weighing whether aliases are safe in themselves? Are email aliases safe takes the risks and limits head on.
The part Gmail cannot fix
Some things Gmail cannot fix for you: it guards the inbox, while the address gets no such guard. Each site handed your Gmail address holds a copy of the key to your inbox. One breach later, your address sits in a file beside your name, and sometimes beside your password, phone number or payment details. Attackers then run two plays. Credential stuffing tests the leaked password, or its near cousins, against your Gmail and every other account. Phishing sends mail that knows your name, knows your service, and links to a forged login page. Gmail's filters catch the bulk of it. Bulk is not all. The message that slips through is the one built from your real details.
That is why "is Gmail safe" asks the question in the wrong shape: a safe inbox and an overexposed address coexist easily, and a strong front-door lock helps little once two hundred shops hold copies of the key. Find out whether your address already circulates, at Have I Been Pwned. A hit there is no failure of Gmail's. It is the price of one address everywhere. The phishing playbook built on leaked email shows how attackers shape a leaked address into a convincing lure.
Five moves that get you both halves
No need to rebuild your digital life. Five moves, done once, then a habit.
First, lock the Gmail account: switch on a passkey, leave 2-step verification running, and run Google's Security Checkup over devices, recent activity and third-party access, then drop apps you fail to recognise. Ten minutes, highest value in this piece: every later step assumes a locked-down inbox.
Second, switch off Ads Personalisation in your Google account settings, if activity-shaped ads are not for you. Gmail still shows ads. They stop drawing on personal data Google has tied to your account. Google's own help page describes the setting in exactly those terms.
Third, set auto-delete on the activity Google lets you expire. Web and App Activity offers it. Location History offers it. Gmail offers no auto-delete, so treat the inbox as permanent storage and clear mail you would rather not keep.
Fourth, put signups on aliases. New account, new alias. For existing accounts, swap the email for an alias whenever you visit, beginning with shopping, newsletters, loyalty programmes and forums, the categories that leak most and matter least. Reserve the Gmail address for people, your bank, and the handful of accounts where the address forms part of your identity.
Fifth, measure your exposure. Put your Gmail address through Have I Been Pwned. Each breach that returns means a password change on that service, plus an address swap to an alias wherever the service allows, so the next breach of the same service lands on the alias.
Your moves this week
Gmail is safe in the sense most askers mean, and unsafe in the sense they actually fear. Hardened inbox. Deep archive. Overexposed address. Fix the third, keep the first two.
Order of work: passkey on, Security Checkup done, Ads Personalisation off if you want it, aliases on every signup from today, one old account a day moved across. That is the whole programme. It turns "is Gmail safe" from an unresolvable debate into an answer you can act on.
Top comments (0)