Gmail attachment size limit, explained

Gmail's attachment limit is one of those numbers everybody half-remembers and nobody quite trusts — because the file you tried to send was smaller than the limit, and it still came back. Here is the real figure, the smaller number hiding behind it, and why the workaround Gmail offers you is not a privacy answer.

The number

Gmail sends messages up to 25 MB and accepts incoming messages up to 50 MB. That asymmetry catches people out: someone can send you a 40 MB file that you cannot send back.

The 25 MB applies to the whole message — every attachment, plus the body, plus headers — not to one file. Two 15 MB files will not go together even though each is under the cap.

The smaller number nobody mentions

Email cannot carry raw binary data, so attachments are encoded into text using base64. That encoding inflates the file by about 33 %. A 20 MB file arrives at the size check as roughly 27 MB and is rejected by a 25 MB limit.

Working backwards, the real ceiling for a single file in Gmail is around 18 MB. If you want a rule that never surprises you, keep attachments under 18 MB and stop thinking about it.

And then there is the other server

Even a message Gmail happily sends can bounce later. The recipient's mail server enforces its own maximum, and the lower of the two limits wins. Corporate mail systems are often capped at 10 MB, which is why a file that reaches personal inboxes fine gets rejected by a client's work address.

This is the part that makes email unreliable rather than merely limited: you cannot know the ceiling in advance, and you find out asynchronously, sometimes hours later.

What Gmail suggests, and what it costs

Attach something over the limit and Gmail offers to upload it to Google Drive and insert a link instead. It works, and for a holiday photo it is entirely reasonable. For anything you would rather not hand over, it is worth being clear about what happens:

• A full copy of the file is stored on Google's servers, and stays there until you remember to delete it.
• Google can read it. Drive encrypts files at rest, but Google holds the keys — that is encryption in transit and at rest, not end-to-end encryption.
• The link is the credential. Set to “anyone with the link”, it can be forwarded, pasted into a ticket, or logged by any system it passes through.
• It counts against your storage, which is 15 GB shared across Gmail, Drive and Photos on a free account.

The private way to send a bigger file

If the file is sensitive — a contract, a scan, financial records, client work — the goal is to get past 25 MB without creating a copy anyone else can read. A peer-to-peer transfer does exactly that: the file is encrypted in your browser with AES-256-GCM and streams directly to the recipient's browser. There is no upload step, so there is no stored copy to leak, expire badly, or forget about.

The decryption key lives in the link's URL fragment, after the #, which browsers never send to a server. A separate PIN gates the transfer, so the link alone is not enough. With SaferDrop that covers files up to 100 MB free and up to 2 GB on Pro — and the recipient needs no account and installs nothing.

You can still use Gmail for the message itself. Email the link, send the PIN by text or phone, and the mail server only ever carries a URL that is useless on its own. That pattern is covered in detail in how to send files securely by email.

If your file bounced from a different provider, the general case is in file too large to email. If it is simply a big file, see how to send large files securely.

Frequently asked questions