Your gmail friend gets a link to their "secure inbox" that they can only view by providing the password you assigned them when you sent them the email. It's a shared password that you need to provide them by _some_ means. I believe the encryption and decryption is all done in the browser (yours and theirs), so tutanota never has the plain text.