What Encrypted Email Still Leaves Visible: Metadata, Subjects and Recipients
“Encrypted email” is usually presented as a single switch: on, private; off, not. In reality email has several layers, and encryption protects only some of them. Understanding which fields remain readable is not an argument against using encrypted mail; it is the difference between relying on it for the right thing and relying on it for something it was never designed to do.
Table of contents
- Three layers people conflate
- What still has to be visible
- Subject lines are a special case
- Where the encryption ends
- A realistic threat model
- Habits that matter more than the settings
- FAQ
- Bottom line
Three layers people conflate
Transport encryption protects a message while it travels between mail servers. It is widespread, and it protects against observation of the link, not against the servers at either end. End-to-end encryption protects message content such that only the intended recipient can read it; the provider handling the mail cannot. At-rest encryption protects stored copies on a server against someone gaining access to the storage, but the provider still holds the keys in the ordinary case.
A service can claim all three and still leave meaningful information visible, because the routing information needed to deliver a message is not part of the encrypted content. Separating these layers is the single most useful step in evaluating any privacy claim about email.
What still has to be visible
For a message to move across the global mail system, the sending and receiving domains, the envelope sender and recipient, timestamps, message size, and routing hops have to be readable by the systems doing the delivery. End-to-end encryption does not hide them; it was never intended to.
That set is more informative than it sounds. Who you correspond with, when, how often, and roughly how much you write can be enough to infer a relationship, a schedule, or a transaction, even with every message body unreadable. Traffic analysis of this kind is a well-understood limit, and it applies to private email providers as much as to ordinary ones.
Providers differ in how much of this they log and for how long, and that is a policy question rather than a cryptographic one. A provider with a narrow retention policy and a clear jurisdiction statement is meaningfully different from one that is vague, even if both offer end-to-end encryption between their own users.
Subject lines are a special case
People routinely put the substance of a message in the subject line. In most encrypted-mail systems the subject is a header, and headers are not always covered by the same protection as the body. Implementations vary, and some providers have added subject protection, but it is unsafe to assume the subject is encrypted just because the body is.
The practical rule is simple and worth following everywhere: write subject lines as if they will be read by somebody who cannot open the message. Use a neutral descriptor rather than a name, an amount, a diagnosis, or a decision. Treat the body as the place for substance.
Where the encryption ends
End-to-end encryption is easiest between two users of the same provider, where keys can be discovered automatically. Sending to somebody on a different system usually involves one of three arrangements: a password-protected message with a link, an exchange of public keys, or ordinary unencrypted delivery. Each changes who can read what, and the difference should be visible in the client before you press send.
Two other endpoints matter. A message is only as private as the device it is read on, and forwarding breaks the model entirely: the recipient can send a readable copy onward to anyone. Attachments, signatures, and automatic external images also create their own paths out of the protected channel.
A realistic threat model
- Good fit: protecting message contents from a mail provider, from someone who obtains a copy of a mailbox, and from observation of the link between mail servers.
- Partial fit: reducing what a provider can learn about you, where retention policies and metadata handling become decisive.
- Poor fit: hiding that you contacted a particular person, hiding your network address from a service you log into, or controlling a message after the recipient has read it.
If your concern is the third category, an encrypted email account is the wrong tool and no amount of configuration will change that. If your concern is the first, it is a good tool, and the remaining work is about subject lines, recipients' habits, and device security rather than about stronger ciphers.
Habits that matter more than the settings
Use neutral subjects, confirm that the client indicates end-to-end protection for this particular recipient before sending, and avoid forwarding sensitive threads. Keep recovery addresses and devices secure, since an attacker who can reset the account does not need to break the encryption. Where a conversation involves several people on different systems, agree on the channel before the sensitive content starts moving.
Finally, be precise with collaborators about what is protected. A colleague who believes the whole message including headers is hidden will write differently from one who understands the boundary. The clearest privacy policy in the world cannot compensate for a shared misunderstanding inside a thread.
FAQ
If the body is encrypted, can my provider read my subject line?
It depends on the implementation, and it is not safe to assume the subject is covered. Some systems protect subjects and many do not. Write neutral subject lines as a standing habit rather than checking each time.
Does end-to-end encryption hide who I am emailing?
No. Delivery requires readable recipient and sender information. Hiding the fact of correspondence is a different problem, and email as a protocol is not well suited to it.
Is a password-protected link as good as end-to-end encryption?
It is a different model with different trust: the recipient gets a link to a message held by the provider, and the password has to reach them through another channel. It is useful for a one-off message to somebody outside the system, but it is not the same protection as keys held only by the two ends.
Are messages to non-users still protected?
Only if the client shows a specific protection mechanism for that message. Otherwise assume ordinary delivery. Check the indicator before sending, not afterwards.
Bottom line
Encrypted email protects content, and content matters. It does not hide that a message was sent, who it went to, when, or how large it was, and in many systems it does not protect the subject line. Those limits are inherent to routing mail across the open internet rather than defects in any one provider. Use it for what it is good at — keeping bodies away from the provider and from anyone who later obtains a mailbox copy — and adjust the habits around it: neutral subjects, attention to the per-recipient protection indicator, care with forwarding and recovery, and an honest conversation with the people you write to. If what you need is to hide the fact of contact, that is a different requirement and deserves a different tool.
If you want to compare current plans in this category, the link below goes to our own product page.