Gmail can limit an attachment or encrypt the message; a one-time link keeps the file out of Gmail altogether.
In the compose window, choose the padlock-and-clock icon, set an expiry and optionally require an SMS passcode. Recipients cannot forward, copy, print or download. The attachment still sits in Gmail until the expiry, and Google can read it.
Save the document as a password-protected PDF, or put it in an encrypted ZIP or 7z archive, and attach that. Send the password by another route, never in the same email.
From a free LinkPilot account, attach the file to a secret. It is encrypted in your browser, stored as ciphertext, and destroyed after the first download. Paste the link into the Gmail message.
Confidential mode suits Gmail-to-Gmail. A password-protected file suits a recipient who will keep the document. A one-time link suits anything that should not live in a mailbox and any recipient on any provider.
No account needed. Free forever plan.
Encrypted in your browser before anything is sent. Burn after read is on for every anonymous secret.
One URL. The key after the # stays in the browser and never reaches our servers.
The first open burns the ciphertext. A second visit, by anyone, meets the destroyed page.
Browser-side encryption shipped on 29 September 2026. Secrets created before that date were stored as plaintext until they expired, and a file's name, size and type are still visible to us. Read the full security model.
Gmail encrypts mail in transit when the other server supports it, and Google Workspace customers on certain plans can turn on S/MIME or client-side encryption, which needs setup on both sides. For a personal Gmail account the practical choices are confidential mode and a protected file. Neither removes the attachment from the mailbox: confidential mode holds it until the expiry you set, and a protected file stays as long as the message does.
A protected PDF or archive is only as safe as the password and where it travels. Put the password in a one-time link rather than a second email, so the message and the key are never in the same place. Use a long passphrase; short PDF passwords are routinely cracked.
If the file is a scan of an ID, a signed form with personal data, or anything with credentials inside, the cleanest result is that no copy exists in Gmail at all. A one-time link does that: the email holds a URL, the file is encrypted on your device with AES-GCM-256, and the first download destroys the stored copy. A free account lets you set an expiry and revoke the link; Pro adds a passphrase and the audit timeline. The file's name, size and type are visible to LinkPilot; its contents are not.
Pro, $29 a month, adds a passphrase on every secret, a custom expiry date and time, and the audit timeline that records each view, burn and revoke. See plans.