Stop e-mailing passwords
in plain text.

Secure Messages adds zero-knowledge encrypted, self-destructing messages to any Joomla site. Share credentials with clients - or let them send secrets to you - through one-time links that even your own server can't read.

Get Secure Messages - €15

Try the live demo

One year of updates & personal support · Unlimited sites ·

Latest version: 1.0.0 - 3 September 2026

AES-256-GCM in the browser - the key never reaches the server. Read exactly how it works.

Every agency does it. Hosting logins in an e-mail. API keys in a chat.

"I'll delete it after, promise."

E-mail is forever

That password you mailed in 2019 is still sitting in two Sent folders and a backup.

Chat is not better

Slack, WhatsApp and Teams retain everything, searchably, on someone else's servers.

"Just use a password manager" doesn't scale

You can't onboard every client into your vault just to hand over one login.

What you need is a link that works once, expires, and leaves nothing behind.

One-time links, encrypted before they leave the browser

Write

Type the secret in your Joomla backend - or let clients use the public form on your site. The message is encrypted in the browser with AES-256-GCM before anything is sent.

You get a one-time link. The decryption key lives in the URL fragment (after the #) - the part browsers never send to a server. E-mail it straight from the form, or copy it into any channel.

Burn

The recipient clicks, the message decrypts locally, and - if you enabled burn-after-reading - the ciphertext is deleted from your database the same second. Expired messages clean themselves up on schedule.

See it before you buy it

Try it yourself

Send yourself a secure message on the demo site - no account needed. Watch it encrypt, open the link, and see it burn.

Open the demo

Zero-knowledge,
and we can prove it

"Trust us" is not a security model. So here is the actual one: your browser generates a random 128-bit key, derives an AES-256 key via PBKDF2-SHA256 (100,000 iterations), and encrypts with AES-GCM - authenticated encryption, so tampering breaks decryption outright. Only the ciphertext travels to your server. The key becomes the URL fragment, which browsers keep client-side by design. Your database, your logs, your backups: all of them only ever contain ciphertext.

An optional password isn't checked by the server - it's folded into the key derivation itself. No password check endpoint means nothing to brute-force.

One honest trade-off, documented instead of hidden: when a link is delivered by e-mail, it briefly passes through your mail transport like any e-mailed secret would. Copy the link into another channel and even that goes away.

Cipher: AES-256-GCM (Web Crypto API)
Key derivation: PBKDF2-SHA256, 100k iterations
Key transport: URL fragment - never sent
Password:"part of key derivation
Server stores: ciphertext + metadata only
Revocation: burn / expiry / manual delete
Audit: User Actions Log (no content)

Read the full security documentation

Built for the client work you already do

Hand over credentials

Site launch? Send the hosting and admin logins as one burn-after-reading link, straight from the backend. Opened once, gone forever.

Receive secrets from clients

Put the send form on your agency site (menu item or module). Clients stop pasting API keys into e-mail because you gave them something better.

Temporary supplier access

Seven-day expiry for the photographer who needs FTP this week. It cleans up after itself.

Prove you take security seriously

"We never send passwords in plain text" is a line that wins pitches - and now it's true.

One package, everything included

Component

Backend message manager, public send form with menu item type, per-field admin modes (sender chooses / default shown / default hidden), recipient whitelist, captcha support, custom CSS.

Send Form module

The same form in any module position - sidebar, footer, or on your contact page.

Cleanup task plugin

Scheduled Tasks integration that removes expired messages from the database.

Action Log plugin

Every create and delete in Joomla's User Actions Log - including guest submissions and automatic burns. Never the content.

E-mail template editable like any Joomla mail template

Pick your version

One price. Every feature. All your sites.

Buy once, install on every client site you build or maintain. No per-domain fees, ever.

Secure Messages

15€

Per year. Unlimited sites. Cancel anytime.

All features - no tiers
Component
Send Form module
Cleanup task plugin
Action Log plugin
Unlimited installations
1 year updates& personal support

Buy PRO - €15

Joomill Extensions Bundle

65€

All commercial Joomill extensions in one license. Save €100+

Admin Checklist component PRO
Admin Customizer plugin
Autolanguage plugin PRO
Client Response Gallery
Content Calendar module PRO
Custom fields plugins
Filedrop
Openinghours module PRO
Price List component PRO
Reset Hits module PRO
RSForm! PRO Notion plugin
Secure Messages
YOOtheme PRO Elements bundle

Get the Bundle - €65

FAQ

Frequently Asked Questions

Can the site owner or host read the messages?

No. Messages are encrypted in the browser before upload, and the decryption key travels in the URL fragment - the part of a link browsers never send to any server. The database only ever holds ciphertext.

Full technical explanation →

What happens when my update year ends?

Everything keeps working. Renewing is only needed if you want new updates and support.

How many sites can I install it on?

Unlimited - including client sites. No per-domain fees.

Does it work with my template?

The public pages use standard Bootstrap markup, carry UIkit classes for YOOtheme-based templates, and fall back to neutral styling everywhere else. A Custom CSS option covers the fine-tuning.

What are the requirements?

Joomla 5.1.3 or later (Joomla 6 supported), PHP as required by your Joomla version.

Is there a free version or trial?

No free tier - but there is a full live demo.

What if a client loses the link or the password?

Gone is gone, by design. There is nothing stored that could recover it. Send a new message; that takes ten seconds.

The next password you send deserves better than an e-mail.

Install Secure Messages on every site you manage for the price of one lunch.