You don't need Protonmail, Tutanota, or any paid encrypted-email provider to send a message that only one specific person can read. PGP (Pretty Good Privacy) has done this since 1991, works with the Gmail or Outlook account you already have, and the only thing you're missing is probably a key pair and somewhere to paste ciphertext. Here's the actual process, not the marketing version.
What PGP protects, and what it doesn't
Get this straight before you start, because it changes what PGP is useful for. PGP encrypts the body of your message (and attachments, if you encrypt them separately) so that only the holder of the matching private key can read it. It does not hide who you're emailing, when you sent it, the subject line (unless you strip it separately), or the fact that an encrypted message exists at all. Your email provider, and anyone intercepting traffic, still sees the metadata — sender, recipient, timestamp, size. If metadata exposure is your threat model, PGP alone doesn't solve it; you'd need something like Signal or a metadata-resistant remailer on top. If your threat model is "I don't want this message body readable if the account or server is compromised," PGP does exactly that.
Step 1: Generate a key pair
You need a public key (share it with anyone) and a private key (never share it, ever). Two practical routes:
- GnuPG (command line, free, cross-platform):
gpg --full-generate-key, choose RSA 4096 or, if your recipient's software supports it, Ed25519/Curve25519 for a smaller, faster key with equivalent security. - Browser-based (no install): tools like this one let you generate or import a key pair entirely client-side — the private key is generated in your browser and never transmitted anywhere.
Set an expiration date on the key (1–2 years is common) rather than "never expires." An expired key can still decrypt old messages you sent yourself and, per the OpenPGP spec, can still encrypt new outgoing messages if you choose to use it anyway — expiration mainly signals to others that they should check for a rotated key before trusting it for new correspondence.
Step 2: Share your public key
Publish it somewhere your correspondent can find it: attach the .asc file to an email, post it on a public keyserver (keys.openpgp.org is the most reliable and privacy-respecting one currently, since it requires email verification and doesn't leak third-party signatures), or set up Web Key Directory (WKD) if you control your domain's DNS. For most people emailing one or two contacts, just sending the key file directly is simpler and just as secure — the security of PGP doesn't depend on the key being publicly discoverable, only on the recipient having the correct key and being able to verify it's really yours (usually by comparing the key fingerprint over a second channel, like a phone call or a different messaging app).
Step 3: Encrypt the message
With GnuPG: gpg --encrypt --armor --recipient their@email.com, type or pipe in your message, and it outputs ASCII-armored ciphertext you paste into the email body. With a browser tool: paste the recipient's public key into the encrypt pane, type your message, and copy the encrypted block it produces. Paste that block as the entire body of your email — the recipient's key is the only thing that can turn it back into readable text.
The two failure modes that actually happen
Line-break corruption. ASCII-armored PGP output is sensitive to how it's reformatted. Some webmail clients (older Outlook web versions especially) silently convert line endings or insert soft wraps when you paste long blocks of text, which breaks the armor and makes decryption fail with a generic "no valid OpenPGP data found" error. If decryption fails on a message that looks fine, try sending it as a plain-text attachment (a .asc file) instead of pasting it inline — that sidesteps the reformatting entirely.
Expired or revoked key confusion. If your recipient hasn't rotated keys in a while, you might encrypt to an expired key by mistake. Most software will warn you and ask if you want to proceed anyway — an expired key can still be decrypted correctly by its owner, so this usually isn't fatal, but it's worth a quick message confirming they still hold that private key before sending anything time-sensitive.
Where to keep your private key
Never store it in an email draft, a note-taking app synced to the cloud, or an unencrypted USB stick you carry around. A password-protected key file on an encrypted disk (FileVault on macOS, BitLocker on Windows) with a strong passphrase on the key itself is the standard baseline. If you lose the private key, there is no recovery — messages encrypted to that key are permanently unreadable, which is the entire point of the design, but it means backups matter as much as security.
Try it without installing anything
If you want to test the whole flow before committing to GnuPG on your machine, EasyPGP's encrypt tool runs entirely in your browser — nothing you type is sent to a server, which you can confirm yourself by checking your browser's network tab while you use it. Paste a public key, type a message, and see the encrypted output in seconds. The decrypt pane works the same way in reverse once you receive a reply.