How to Send Secure Email in Outlook in 2026

What “secure email” means in Outlook

Outlook.com already sends mail over TLS whenever the other provider supports it. Microsoft calls this opportunistic TLS. Microsoft is plain about the limit: “TLS encrypts the connection, not the message.” Once the email reaches the other provider, it may sit there unencrypted.

Message encryption goes further. The message stays locked until the right person opens it.

Outlook has two ways to do this. Microsoft Purview Message Encryption is the Encrypt button. S/MIME uses certificates on both ends. With Purview, Microsoft manages the encryption keys by default, so this protects you from the recipient’s provider, not from Microsoft.

Step 1: Use Outlook’s built-in encryption for free

At work or school: Options, then Encrypt

In new Outlook, open a new message, choose Options, then Encrypt. Pick Encrypt, or Do Not Forward if the recipient shouldn’t copy or forward it. Classic Outlook for Windows works the same way: Options › Encrypt.

Which one to pick? Encrypt keeps the message encrypted, and recipients on Outlook.com or Microsoft 365 can download attachments without encryption. Do Not Forward also blocks copying and forwarding, and Word, Excel and PowerPoint files stay encrypted after download. For a one-off document to an accountant, Encrypt is usually enough. For something you don’t want passed on, use Do Not Forward.

Avoid File › Encrypt in classic Outlook. Microsoft’s own note (updated 02/19/2026) says recipients couldn’t open Encrypt-Only mail sent that way and tells you to use the Options ribbon.

Whether the button is there depends on your organization’s plan. Microsoft’s FAQ lists Microsoft 365 Business Premium, Office 365 and Microsoft 365 E3 and E5, among others. Business Basic and Business Standard need an add-on, Azure Information Protection Plan 1. The limit is 25 MB per message, attachments included.

On a personal Outlook.com account

Here the button costs money. Microsoft’s help page opens with a note: “To use encryption, your account must have a qualifying Microsoft 365 subscription.” The plans it names are Microsoft 365 Personal and Family. The address must end in @outlook.com, @hotmail.com, @live.com or @msn.com.

With a subscription, the path is the same as at work: Options › Encrypt, then Encrypt or Do Not Forward. To turn it off, pick No permission set.

What your recipient sees

People on Outlook read the message as usual. Everyone else gets an email with a link. Gmail users select Read your message, sign in with Google, and the message opens in a new browser tab, not in Gmail. On other services, the recipient asks for a one-time passcode by email.

The passcode expires after 15 minutes. Replies come back encrypted too, unless the sender blocked replies.

If the option isn’t there

• Free Outlook.com account. There’s no free Encrypt option. I started a free Outlook.com account on 10/09/2026 to check the menu myself, but Microsoft’s sign-up stopped at a press-and-hold human check.
• You pay for Microsoft 365 and still don’t see it. A Family subscriber wrote on Microsoft Q&A (03/10/2024) that there was “no option to encrypt messages” on outlook.com or in desktop Outlook. Check that you’re signed in with the Outlook.com address the subscription is on.
• S/MIME. It works with work and school accounts. You need a certificate first. Actalis gives one S/MIME certificate free for the first year, then €6.00 a year before tax (10/09/2026). Your recipient must also have S/MIME and install your certificate. One Outlook.com user got the error “S/MIME isn’t currently supported for your account” (Microsoft Q&A, 05/01/2020).

Step 2: When Outlook’s encryption isn’t enough

It costs $99.99 a year if you don’t have it through work. On 10/09/2026, Microsoft 365 Personal was $99.99/year or $9.99/month, and Family was $129.99/year. That’s a lot for an occasional tax form.

Recipients get stuck on passcodes. On Microsoft Q&A, a Gmail user wrote in 2022: “The one-time passcode never arrives.” Another wrote in April 2026: “The passcode never hits my inbox, spam, junk or any other folder.”

Microsoft’s own FAQ says to check the junk folder first, and notes that passcode emails often end up in quarantine at the recipient’s organization. In November 2025 a recipient got “Something went wrong and your encrypted message couldn’t be opened.” A Microsoft external-staff moderator answered that it’s “not caused by anything you are doing wrong.”

Microsoft keeps the keys. By default Microsoft manages the root key for this encryption. Organizations can choose to bring their own key instead.

Do Not Forward has gaps. Word, Excel and PowerPoint attachments stay encrypted. Microsoft notes that PDFs and images “can be downloaded without encryption.”

Step 3: Send a password-protected email with Proton Mail

When you don’t have Encrypt at work and don’t want to pay $99.99, a free Proton Mail account does the same job for one-off sensitive emails. I used Proton for this step because its free plan includes password-protected emails to any address, Outlook included.

Create a free account

On 10/09/2026, Proton’s sign-up asked for a username and a password, then a human check: a puzzle or a code sent to another email address. I used the email code.

Next comes a pop-up for Mail Plus at $1 for the first month, renewing at $4.99. No, thanks keeps you on the free plan. Proton then asks you to save a recovery phrase, which Proton calls the only way to recover everything if you’re locked out.

Create your free account on Proton’s site:

Create a free Proton Mail accountAffiliate link · how it works →

Write the message and set a password

Write the email as usual and click the lock icon in the composer’s bottom toolbar. Proton calls it external encryption. Enter a password and an optional hint, then click Set encryption.

A lock appears next to the recipient, and a banner shows the expiry date. Proton caps it at 28 days. Tell the recipient the password another way, by phone or text, never in the same email.

Keep the hint vague. In my test, the hint showed in plain text in the notice email the recipient got, so anyone who sees that inbox sees the hint too. A hint like “the street we met on, plus 4 digits” works. The password itself or a birthday doesn’t.

What the recipient sees

I sent the test to an inbox at another provider. It arrived as a notice from Proton with the expiry date, my hint and a button to open it. The text itself wasn’t in the email.

That button opened a Proton page asking for the password. After Read message, the email showed in the browser with a Reply securely button. Proton allows up to five replies per message.

One catch from Proton’s help page: when you reply to their secure reply, encryption is off by default. Click the lock again each time.

Limits of the free plan

• Storage. Our new free account showed 500 MB. Proton’s pricing page said 1 GB on 10/09/2026.
• Sending. 150 messages a day, attachments up to 25 MB.
• Outlook app. You can’t use the free plan inside the Outlook app. That takes Proton Mail Bridge (IMAP/SMTP), which is paid only, and Proton says it doesn’t work with new Outlook for Windows.

Mail Plus was $4.99 a month, or $47.88 billed every 12 months (10/09/2026). It adds 15 GB and Bridge.

If you’d rather use another service

• Tuta sends password-protected email to people outside Tuta on its free plan. Its guide, dated 11/06/2025, says recipients can reply with the same protection.
• Mailfence has password encrypted messages for people who don’t use PGP keys, plus OpenPGP for those who do.

I haven’t run either one, so there’s no score for them yet.

Which way fits your situation

Is it worth paying? See what’s actually free

For an occasional sensitive email, Proton’s free plan covered everything in my test. Pay only if you need more space or want Proton inside a desktop email app. More: what Proton Mail’s free plan includes · Proton Mail pricing · Proton Mail review · best secure email providers.

See also

• How to send encrypted email in Gmail
• Best secure email providers

What we checked

• Microsoft's help pages on encryption in Outlook.com, new and classic Outlook, S/MIME and opening encrypted mail, plus Microsoft Learn pages on Purview Message Encryption — read 10/09/2026
• Microsoft 365 US plan prices — captured 10/09/2026. We have no Microsoft 365 subscription, so the Encrypt menu itself wasn't tested by us
• Free Outlook.com sign-up: started 10/09/2026, stopped at Microsoft's press-and-hold human check
• Proton Mail: free account created 10/09/2026, password-protected test message sent to a test inbox at another provider, opened and read there
• Owners: 6 Microsoft Q&A threads (2018–2026) on missing Encrypt buttons and passcodes. Reddit blocked our connection
• Where the run stopped: Outlook side from Microsoft's help and plan pages (we have no Microsoft 365 subscription, and a free Outlook.com sign-up stopped at Microsoft's press-and-hold check); Proton Mail free account run end to end

FAQ