Documentation: Secure Messages
Frequently asked questions
Can the site owner (or their host) read my message?
No. Messages are encrypted in the sender's browser before they are sent to the server; the server only ever stores the encrypted result. The decryption key travels in the part of the link after the #, which browsers never send to the server when the page is requested. Without the full link (and the password, if set), the stored data is unreadable - for the site owner, the host and any database backup alike. The one nuance is automatic e-mail delivery: see the Security & encryption article.
I lost the link. Can it be recovered?
No. The key only exists inside the link, and the link is shown or e-mailed exactly once. Create a new message instead - that is the point of the design.
I forgot the password of a password-protected message.
There is no reset. The password is folded into the encryption key itself; without it, decryption mathematically fails. Send a new message.
Why does the link say the message is no longer available?
Either it was a burn-after-reading message that has already been opened, the expiry date passed, or a backend user deleted it. In all three cases the encrypted data is gone from the server.
Can I change the e-mail the recipient gets?
Yes - it is a normal Joomla mail template: System > Templates > Mail Templates > com_securemessages.link. Your changes survive updates.
Does the public form work without a login?
Yes, by design. Guests can send messages to the recipients you configured (and only to those). Enable the captcha option if you are worried about abuse, and remember the recipient list is a strict whitelist - the form can never be used to mail arbitrary addresses.
Which languages are included?
English, Dutch, German, French, Italian and Spanish, for all parts of the package.
What ends up in the logs?
The User Actions Log records who created or deleted which message, identified by its reference (or a shortened, non-usable identifier fragment). Message content, links and passwords are never logged.
Does it work with my template?
The public pages use standard Bootstrap markup, carry UIkit classes for YOOtheme-based templates, and include neutral fallback styling for everything else. The Custom CSS option (Options > Advanced) covers any remaining fine-tuning.