How to Open an Encrypted Email: A Guide for Recipients

Organizations encrypt email when it contains information such as medical results, financial statements, contracts or identity documents, often because regulations or their own policies require it. Encryption means that only the intended recipient can read the content, even if the message is stored on servers along the way or forwarded by mistake. The extra step to open it is the price of that protection.

Portal delivery is common because the recipient needs no special software. A typical sequence looks like this:

1. Check the notification. Confirm that it comes from someone you expect to hear from.
2. Open the link. If you were not expecting the message, contact the sender through a phone number or address you already have before you continue.
3. Verify your identity. Depending on the sender’s settings, this may be a one-time code sent by email or text message, a password you create on first use, a passkey or your organization’s single sign-on.
4. Read the message and download any attachments the sender allows.
5. Reply from the portal, so your response stays encrypted.

The first time you receive a portal message from an organization, you may be asked to register by creating a password or a passkey. Later messages from the same sender then open after you sign in.

Senders decide which verification methods to offer. Our page on secure email authentication and access control describes the options, from passwordless sign-in with passkeys to multi-factor verification.

Messages protected with Microsoft 365’s built-in encryption follow a similar pattern: open them in Outlook, or use the link to read them in a browser after signing in or requesting a one-time passcode.

S/MIME

Outlook, Apple Mail and many other mail apps decrypt S/MIME automatically when your certificate and private key are installed. If you see an error saying the message cannot be opened, the usual causes are that the certificate is not installed on this device, that it was renewed and the old private key is missing, or that your mail app does not support S/MIME. Ask your IT team to install your certificate on every device you use for mail.

PGP

PGP messages need software that holds your private key, such as a mail client with built-in OpenPGP support, like Thunderbird, or a plug-in for your mail app. Import your key, enter its passphrase when prompted, and the message is decrypted. If you have never created a PGP key, the message cannot have been encrypted to you with PGP, so check whether it is a portal notification instead.

Forwarded encrypted messages

An S/MIME or PGP message can be read only by the recipient it was encrypted for. If a colleague forwards you an encrypted message without decrypting it, your own key will not open it; ask the original sender to send it to you directly.

Phones and tablets

On phones, support varies by app. S/MIME and PGP often need extra setup on mobile devices, so a desktop mail client can be easier.

Some senders encrypt only the attachment, as a password-protected PDF, Office document or ZIP file. The sender should give you the password through a separate channel, such as a phone call or text message, never in the same email. Open the file in its usual application and enter the password when asked. The section on encrypted document access explains how these documents are delivered.

Attackers imitate secure-message notifications to steal passwords. Before you click:

• Confirm that you were expecting a message from that sender.
• Hover over the link and check that the address belongs to the sender’s organization or its known secure-mail service.
• Never enter your email account password into a page you reached from an unexpected notification.
• Do not share one-time codes with anyone, including someone who claims to be the sender.
• If in doubt, contact the sender using details you already have.

• Code not arriving: check your spam folder, confirm the phone number or address the sender has for you, and wait a few minutes before requesting another code.
• Link expired: secure messages can expire, so ask the sender to resend.
• Certificate or key errors: contact the IT team that issued your certificate or key.
• Not meant for you: tell the sender and delete the message.

For organizations choosing which options to offer recipients, how cloud email encryption works compares PGP, S/MIME, secure portals and encrypted documents. Our cloud email encryption FAQs answer common questions from senders.