PGP in Practice, Part 3: Sending encrypted email from Gmail with Mailvelope
Gmail’s web UI has no native PGP. Mailvelope is the browser extension that injects an encrypt/decrypt overlay over Gmail — keys never leave the browser, Gmail never sees plaintext. This part covers install, key import, send/receive, and the limits (mobile, attachments, HTML formatting, search).
Gmail's web UI does not ship native PGP — Google has shipped and quietly retired multiple "End-to-End" prototypes, and there is no first-party encryption layer in Gmail today. The most widely-deployed third-party answer is Mailvelope, a browser extension that injects an encrypt / decrypt overlay over Gmail (and other supported webmail providers — GMX, Outlook.com, Yahoo, mail.de, Posteo). Keys never leave the browser, Gmail never sees plaintext, and the rest of your workflow stays in the Gmail tab.
Mailvelope is open source, has been audited by Cure53, and is listed by Germany's Federal Office for Information Security (BSI) as a reference OpenPGP browser extension. It is not the only option — FlowCrypt is another — but Mailvelope is the most widely-deployed and the one most operators end up on.
Install the Mailvelope extension from the Chrome Web Store, the Firefox Add-ons site, or the Edge Add-ons store. The extension shows a small lock icon in your browser toolbar; click it to open Mailvelope's UI in a separate tab.
On first launch you set a Mailvelope password — this is not your PGP key passphrase. The Mailvelope password encrypts the local key store inside the browser; you'll be prompted for it once per browser session. If you forget it, the key store is unrecoverable, but exported keys are not — Mailvelope holds copies, not the originals.
Mailvelope's key management lives at mailvelope://options (or via the toolbar icon → Options).
- Generate — Mailvelope creates an RSA-4096 or ECC key entirely in the browser. The private key is encrypted at rest with your Mailvelope password.
- Import — paste an ASCII-armored private key (
.ascfrom gpg, GPGTools, Kleopatra, or another Mailvelope install). Mailvelope will prompt for the key's passphrase to verify it.
For correspondents' public keys, you can:
- Paste an ASCII key into the import dialog.
- Search Mailvelope's bundled key servers (keys.openpgp.org, the Mailvelope public key directory).
- Receive a key as an attachment — Mailvelope detects
attachments in Gmail and offers a one-click import.