Creating a message in the backend

Open Components > Secure Messages and click New Message. Type your message, optionally add a reference (only visible in the backend list, never to the recipient), choose the expiry, burn-after-reading and password options, and click Generate link.

The message is encrypted in your browser before anything is sent to the server, and you get the secure link. The link is shown only once: the decryption key is part of the link and is never stored, so it cannot be shown again later. Copy it right away, or use the "Or e-mail this link to..." field below the link to send it to any address directly.

The messages list

The Messages overview shows every stored message with its reference, password and burn flags, expiry and creation date - never its content. Select messages and click Delete to revoke them: a deleted message's link stops working immediately. Messages opened with burn-after-reading enabled remove themselves and disappear from this list automatically.

What the recipient sees

The recipient receives an e-mail with the secure link. The link opens a page with a Show message button (and a password field when the message is password-protected). After clicking, the message is decrypted in the recipient's browser and shown in a highlighted panel, preserving line breaks.

• With burn after reading, the page warns beforehand that the message will be deleted on opening; once shown, the message is permanently removed and reloading the page says it is no longer available.
• With an expiry, the page shows the expiry date; after that date the link reports the message is no longer available.
• With a password, the recipient needs the password you agreed on through another channel - a wrong password simply fails to decrypt.

The public send form

Visitors of your site can send secure messages to you through the public form (via a menu item or the module - see those articles). They write their message, pick a recipient from your configured list, and submit. The message is encrypted in their browser and the secure link is e-mailed automatically to the chosen recipient. The sender never handles the link themselves.

Activity logging

Message creation and deletion (including guest submissions and automatic burn/expiry deletions) is recorded in Users > User Actions Log. The log identifies messages by their reference - never by their secret link and never by their content.