Safer email: account protection, archiving and message encryption

Email is often the key that recovers every other account. Protect the mailbox itself first with a unique password, two-step verification and a check of automatic forwarding. The HTTPS lock does not mean the message body is end-to-end encrypted. Anyone who reaches your inbox can usually reset passwords for social networks, shops and cloud storage too.

Set up and keep two-step verification with the two-factor authentication and recovery guide. If you see signs of a break-in, follow recovering a compromised account.

Lock down the account itself first

The password should belong only to this mailbox and should live in a password manager. Put two-step verification on an authenticator app or a security key, not on SMS alone. After you turn it on, write backup codes somewhere other than this same inbox; if you rely only on this email, you will have no path when it locks.

1. Create a fresh unique password and store it in a password manager.
2. Turn on two-step verification from that account’s security page.
3. Review the recovery email and phone number and remove anything you do not recognize.
4. Print the backup codes or keep them in an encrypted place.
5. Read signed-in devices on that same security page and close an unfamiliar session.

Open forwarding and filters today

After stealing a sign-in, an attacker often adds a forwarding rule or a filter so security mail goes somewhere else or is deleted. You may see nothing for months while password resets for other accounts run through this inbox.

1. In Gmail open the gear, See all settings, and read the Forwarding and POP/IMAP tab. If there is a forwarding address that is not yours, delete it.
2. Open Filters and Blocked Addresses. A filter that deletes or archives mail and that you did not create is suspicious.
3. On the Accounts tab, see whether you have delegated access to someone else.
4. In Outlook on the web, open Mail settings and review forwarding and rules. Delete an unfamiliar rule.
5. Repeat this review after every password change or after a sign-in from a new device.

Devices and connected apps

1. In a Google account open Security and read Your devices and recent security activity.
2. Open third-party apps with account access and cut access you no longer need.
3. In a Microsoft account review the same device list and app permissions.
4. Revoke an old app password if you no longer use it.
5. If you see an unfamiliar app with permission to read mail, remove it and change the password.

HTTPS does not hide the message from the provider

The browser lock means the path from you to the mail server is encrypted. That is good and it should be the case: sign in only at the official web address or in the official app. The provider itself can usually process the text in readable form, unless the service offers real end-to-end encryption between sender and recipient. Search, backup and spam filtering also usually run on that readable text.

For material that should not sit with the provider, use an end-to-end messenger or a service and method that explicitly encrypt that message end to end. Encrypting an attachment and then sending the password in a separate message on the same path is almost useless; tell the password through another channel.

Gmail: several important paths

1. Settings, General, Images: ask before displaying external images. A remote image can report that a message was opened.
2. Confidential mode adds an expiry and can limit forwarding, but it is not end-to-end encryption and it does not stop a screenshot.
3. If you are at higher risk, read Google’s Advanced Protection Program on the account security page; it wants a security key and closes some weaker access paths.
4. Try search with your own filters once to see that mail is not being hidden.

Microsoft, Apple and other services

1. In Outlook on the web, periodically read app permissions and forwarding as well as rules.
2. In an Apple ID open Sign-In & Security, review devices, and use Hide My Email for low-trust sign-ups if you need it; Apple still ties that address to the same Apple ID.
3. Mail Privacy Protection on Apple reduces remote-content loading and tracking; leave it on if you use Apple Mail.
4. Every service you use has a security page and a rules or filters section; put those two on a recurring list.

Display names, CC and Reply All

1. A sender display name is easy to forge; look at the real address, not only a familiar name.
2. Before you reply all, read the recipient list.
3. If someone should see the message quietly, use BCC, not CC, which reveals the address to everyone.
4. Do not put people’s addresses in the main To field of a large group message if they do not know one another.
5. Keep a phone number and home address out of the signature unless they are needed.

Suspicious mail and attachments

1. Do not open a password-reset link from unexpected mail; open the site from your own bookmark.
2. Do not open an office file with macros or an executable from a sender you were not expecting.
3. Never send a sign-in code in reply to someone who claims to be support.
4. Do not tap unsubscribe on suspicious mail; that click may confirm the address. Mark it as junk or create a filter instead.
5. If you are unsure, check with the sender through another channel.

Remote images and tracking

1. Turn off automatic image loading so a tracking pixel does not learn that the message was opened.
2. In Gmail use the setting that asks before displaying external images.
3. In Outlook and Apple Mail look at privacy options or blocking remote content.
4. This does not replace care with links.

Archives and local copies

Mail lives on the server and on every device synced with IMAP. Deleting it from one phone does not necessarily delete it everywhere. A computer backup that also grabs the mailbox keeps the same text somewhere else.

1. See which devices are connected to the mailbox and disconnect one you no longer use.
2. For a long-term work archive, choose the storage location deliberately and encrypt it if the material is sensitive.
3. Exporting a mailbox creates a large file that is no longer inside webmail’s protection; treat that file like a sensitive document.
4. Review an automatic reply for travel or internal details, and turn it off when you return.

Encrypting a message when the server should not read it

Some services encrypt mail end to end between their own users and send an outside recipient a password-protected message. Classic public-key encryption is for people who can set up the tools and exchange keys correctly on both sides; that is not simple, and a mistake creates a false sense of safety. If both sides can move to an end-to-end messenger, that path is usually more practical. A “zipped and passworded” attachment only makes sense if the password arrives through another channel.

1. If your service offers protected sending, do not write the password in the same message.
2. Coordinate with the recipient beforehand through another method.
3. Do not confuse this with the HTTPS lock.

A second account and roles

1. Keep a public or newsletter inbox separate from the inbox that recovers important accounts.
2. Do not open the recovery inbox in a public browser or on public devices.
3. Use a less-visible address to recover sensitive accounts, with the same strong protection.
4. Signing in with Google or Microsoft to other sites links this mailbox to those sites; review those permissions periodically.

When you see signs of a break-in

1. From a device you trust, change the password and revoke other sessions if you can.
2. Check forwarding and filters immediately.
3. Disconnect connected apps.
4. Harden, one by one, the accounts that use this email for recovery.
5. Follow the details in the compromised-account guide.

Common mistakes

• Relying on SMS as the only two-step method for the main mailbox.
• Missing a forwarding rule that has been working for months.
• Opening a “your account is locked” link from a message.
• Sending a sensitive document unprotected just because the site shows a lock.
• Storing backup codes only inside this same inbox.
• Leaving webmail open on a shared computer.

Look at a suspicious message in its original form

A display name is easy to forge. Sometimes Reply-To points somewhere else so your reply reaches an attacker.

1. In Gmail open the message, tap the three-dot menu and choose Show original.
2. Read the From and Reply-To addresses. If replies go somewhere other than that organization, ignore the message.
3. Preview a link by hovering on a computer or by a long press on a phone, not with an immediate click.
4. Compare the domain with the official address you know from your own bookmark: an extra letter or a look-alike domain is enough to make a fake page.
5. Start a sign-in from a saved bookmark or by typing the official address yourself, not from the message.

Read recent activity from the inbox itself

1. In Gmail on the web, open the last account activity details at the bottom of the page and see which access types and which regions appear.
2. Match an unfamiliar sign-in with the Google account device list and disconnect what is not yours.
3. Take a “new sign-in from a new device” message seriously; if it was not you, change the password immediately and look at forwarding again.
4. An attacker sometimes adds a filter that deletes these same security alerts, so check filters alongside that message.

Do not leave unused POP and IMAP open

1. If you only use the web or the service’s official app and you have no old mail program, read Gmail’s Forwarding and POP/IMAP tab and turn off what you do not need.
2. Each mail client is another copy and another way in; sign an old program on an old computer out of the account.
3. Revoke that old app password on the security page so it no longer works.
4. On a phone, remove the mailbox from a third-party app if you already read it in the official app.

Read the address before you send

1. Autocomplete can send a sensitive message to someone else with a similar name. Look at the full address before you send.
2. Do not treat recalling a message after sending as a guarantee; many services do not fully pull it back.
3. Open an attachment once to see that it is the right file, then send it.
4. If a document should not sit with the provider, do not send it by ordinary email.

Public computers and an official bookmark

1. Bookmark the sign-in address of an important mailbox so you do not reach a fake page from a search result.
2. On a public computer open a private window, sign out when you finish, and do not save the password.
3. If you had to sign in on such a computer, later change the password from your own device and close sessions.
4. Do not use a public computer at all for the inbox that recovers important accounts.

Which accounts depend on this mailbox

1. Search the password manager to see which logins use this email.
2. Keep a list of accounts that use this address for recovery so you can prioritize them if the mailbox is at risk.
3. Send newsletters and low-stakes shopping to a separate inbox so the main one stays quiet and easier to watch.
4. When you leave a job, remove organizational mail from a personal phone, and know that forwarding all work mail to a personal inbox may violate that organization’s policy.

Advanced Protection and a security key

For the main mailbox that the rest of your digital life recovers through, a security key is stronger than SMS. If you use Google and you face a targeted risk, read the Advanced Protection Program on the account security page: it limits sign-in to stronger methods and reduces weaker app access. Setting it up takes time, and you should have a key or a backup method beforehand, not after a lockout.

Do not use a work email to recover personal life

An organization’s administrator can usually read work mail or take over the account. If that same address recovers a social network, a bank or a personal mailbox, leaving the job or an administrative dispute reaches those accounts too.

1. Put recovery for personal accounts on a personal address, not on a work or university email.
2. Do not send personal newsletters and shopping to the work inbox.
3. When you leave an organization, change the accounts that still depend on that address before the mailbox is closed.
4. Do not leave work mail sitting on a personal phone after you leave the organization.

A shared family inbox

1. One address for the whole family means everyone can reach everyone else’s password resets.
2. Give each person their own mailbox with a separate password and verification.
3. If you register a child with a parent’s email, do it deliberately and do not later forget which accounts remain there.

Aliases and separating newsletters

Some services let you add a tag to the first part of the address so you can tell sign-ups apart. If a shop sells that address, the tag shows the source of the leak. This does not replace a unique password.

1. For low-trust sign-ups use Hide My Email or your provider’s alias addresses if you have them.
2. Do not type the main recovery address into public forms.
3. If your address appears in a known breach, change that service’s password and check you had not reused it elsewhere.

Certificate warnings in a mail app

1. If a mail client warns about the server certificate, do not dismiss it with “continue anyway.”
2. A public network and an old app can both produce that warning; move the work to a more trusted network and the official app.
3. Do not turn off the warned-about encryption just so mail “just works.”

Calendar invites and shared files

1. Treat an unexpected meeting invite like a message with a link; it may lead to a fake sign-in page.
2. A cloud file that suddenly “was shared with you” and asks you to sign in again is suspicious.
3. Sign in from inside the drive itself or from a bookmark, not from that message.

Look at the junk folder too

1. From time to time scan junk for a real security message or a missing work email.
2. If security messages that should arrive are missing, open filters and forwarding again.
3. Move a real bank message from junk to the inbox, and do not sign in to the site from that message.

If a verification code arrives that you did not ask for

A sudden two-step prompt means someone typed the password correctly. Ignoring it is not enough.

1. Sign in, change the password and revoke all other sessions if that option exists.
2. Check forwarding and connected apps in the same sitting.
3. If you cannot sign in, use that service’s official recovery flow from a trusted device.
4. Put accounts that use this email for recovery next on your list.

Look at delegated access separately

1. In Gmail open Settings, Accounts and Import, and read Grant access to your account.
2. Remove someone who should no longer read the mail.
3. In a work Outlook environment see whether Send on behalf or delegate access is on for someone who should no longer have it.
4. After a temporary collaboration, close these access paths the same day.

Search the inbox for old attachments

A mailbox can hold documents, passports and spreadsheets for years after they are needed.

1. Search for messages with attachments and review old files.
2. Delete what should not remain, and empty the mail trash.
3. Know that a copy may still sit on a synced device or in a backup.
4. From now on, do not email an identity document if you do not need to, or delete it from your own mailbox after the recipient has it—and still assume a copy existed with them and on the server.

Create backup codes in the same session

1. After you turn on two-step verification, open the backup codes or one-time codes option.
2. Store the codes in a password manager or on separate paper, not in a draft in this mailbox.
3. Once, check that you can find the storage place.
4. If you created codes before and lost them, generate a fresh set so the old ones are revoked.

When not to send mail

1. For urgent confidential coordination, an end-to-end messenger is usually more appropriate than ordinary email.
2. Email fits archives, organizational contacts and formal work; even then, judge the audience and the attachment.
3. Before you send, see which address you are sending from: personal, work or an alias.
4. Remove extra CC recipients.

More precise Microsoft and iCloud paths

1. In Outlook on the web open the gear, Mail, Forwarding, and if forwarding to an unknown address is on, turn it off and remove it.
2. In the same settings, read rules one by one: moving mail to Deleted items or forwarding it outside is the most common hiding place.
3. Open the Microsoft account security page separately for sign-in methods, passkeys and devices.
4. On iPhone go to Settings, your name, iCloud and look at Hide My Email: review the generated addresses and turn off what you do not need.
5. Review iCloud Mail’s signed-in devices under that Apple ID’s Sign-In & Security as well.

Change recovery in the right order

1. Add and test the new sign-in method, then remove the old one; the reverse can lock you out.
2. Do not leave an old number you no longer have as recovery.
3. If you create a passkey to sign in to the mail account, do not lose the device it lives on, and keep a second method too.
4. Changing a recovery email is sometimes applied after a security delay; keep both addresses reachable until the change is final.
5. Remove an address or number you no longer control from recovery the same day.
6. After the change, read recent security activity to confirm only you did it.

If you lose access in the middle of this change, use backup codes and that service’s official recovery flow, not someone who suddenly offers in mail or a message to help you open that same account. Real support for that service never asks you to send them a one-time sign-in code in a message.

What to do today

1. Finish a unique password and non-SMS two-step verification for the main mailbox, and store backup codes outside it.
2. Open automatic forwarding, filters and delegated access.
3. Review devices and connected apps.
4. Set external images to ask first.
5. Look with your own eyes at which addresses use this email for recovery.