Skip to main content
Secure Messages for Joomla 5 & 6

Share passwords through a link that works only once.

Stop e-mailing logins and other sensitive details. Write your message on your own Joomla site, send the link, and the message deletes itself after it has been read. Nobody else can open it. Not even your own server.

Get Secure Messages - €15
Try the live demo

Unlimited sites  ·  One year of updates & personal support  ·  No account needed for recipients

Latest version: 1.1.0 - 8 October 2026

A secure message is written, turned into a one-time link and deleted after the recipient has opened it

Encrypted in the browser. The key is never stored on your server. See how it works.

Opens once, then it is gone

Nothing left behind in an inbox or a chat history.

Unreadable for everyone else

Encrypted in the browser, before it leaves the computer.

On your own website

No third-party service that holds your secrets.

Works both ways

Send to clients, and let clients send to you.

The problem

A password in an e-mail stays there forever

Everybody does it. A login in an e-mail, an API key in a chat, "delete it after reading". Years later it is still sitting in two mailboxes and every backup.

A password sent by e-mail stays in mailboxes and backups, a Secure Messages link works one time and then expires
How it works

Three steps. No training needed.

Three steps: write the message, share the one-time link, the recipient reads it once and it is gone

Type the secret in the Joomla backend, or on the public form on your website. It is encrypted in your browser before it is sent.

You get a one-time link. The site e-mails it to the recipient, or you paste it wherever you like.

The recipient clicks, reads, and the message is deleted the same second. Unopened messages expire on their own.

Two directions

Send secrets out. Receive them safely too.

The New Secure Message screen in the Joomla administrator with the generated one-time link

From you to a client

Create a message in the Joomla backend and get a one-time link. Copy it, or let the site e-mail it straight to any address.

The public Send a Secure Message form on a website with a list of recipients

From a client to you

Put the send form on your site as a page or a module. Visitors need no account, and they can only send to the recipients you configured.

Who uses it

If your site handles anything private, you need this

It was built for web agencies. It turns out everyone who e-mails something they would rather not see leaked has the same problem.

Web agencies & freelancers

Hand over hosting, CMS and FTP logins at launch. Receive API keys from clients without them ending up in your inbox.

Accountants & bookkeepers

Let clients send portal logins, bank details or tax numbers through your own site instead of plain e-mail.

Practices & care providers

Give patients and clients a private way to send personal details that does not linger in a mailbox.

Legal & financial advisers

Share a case reference, an access code or a one-off instruction that should be read once and never forwarded.

HR & internal IT

Send a new colleague their first password or door code. It is gone after day one.

Suppliers & partners

Temporary access for the photographer or the developer. Seven days later the message has cleaned itself up.

Features

Everything in one package

Secure Messages features: burn after reading, expiry, optional password, recipient list, spam protection and activity log

Send Form module

The same form in any module position: sidebar, footer or contact page.

Editable e-mail

The notification is a normal Joomla mail template. Change the text to your own.

Six languages

English, Dutch, German, French, Italian and Spanish included.

Fits your template

Bootstrap and YOOtheme-ready, with a Custom CSS option for fine-tuning.

Why it is safe

Your server stores the message, but cannot read it

The message is locked in the sender's browser. The key travels inside the link and is never stored on your server. Without the link there is only scrambled text.

The message is readable in the sender's and recipient's browser, the server and database only hold scrambled text

For the technical reader

No "trust us". AES-256-GCM through the browser's own Web Crypto API, with the key in the URL fragment. An optional password is part of the key itself, so there is nothing on the server to brute-force.

One honest trade-off: when the link is delivered by e-mail, it passes through your mail server like any e-mail. Burn-after-reading and expiry limit how long it is usable. Copy the link into another channel and that goes away too.

Read the full security documentation

Cipher: AES-256-GCM (Web Crypto API)
Key derivation: PBKDF2-SHA256, 100k iterations
Key transport: URL fragment
Password: part of key derivation
Server stores: ciphertext + metadata only
Revocation: burn / expiry / manual delete
Audit: User Actions Log (no content)

You stay in control

Decide what visitors may choose

For expiry, burn-after-reading and password protection you pick per option: the sender chooses, or your default applies, shown or hidden. The server enforces it, so a tampered form cannot override your rules.

  • Fixed recipient list, no open relay
  • Manage and delete messages from the backend
  • Joomla permissions for who may create and delete
The Field modes options of Secure Messages: sender chooses, use default shown or use default hidden
Compare

Why not just e-mail it?

E-mailChat appsOnline secret-sharing serviceSecure Messages
Message disappears after reading
Unreadable for the server that stores itsometimesdepends
Runs on your own website and domain
Clients can send secrets to youunsafeunsafewith extra steps
No account for the recipient
See it

Watch it work in 22 seconds

Try it yourself

Send yourself a secure message on the demo site. Watch it encrypt, open the link, and see it burn.

Open the demo
Pricing

One price. Every feature. All your sites.

Buy once, install on every client site you build or maintain. No per-domain fees, ever.

Secure Messages

15€

Per year. Keeps working after the year ends.

  • All features, no tiers
  • Component
  • Send Form module
  • Cleanup task plugin
  • Action Log plugin
  • Unlimited installations
  • 1 year updates & personal support
Get Secure Messages - €15

Joomill Extensions Bundle

65€

All commercial Joomill extensions in one license.

  • Admin Checklist component PRO
  • Admin Customizer plugin
  • Article Form Builder PRO
  • Autolanguage plugin PRO
  • Client Response Gallery
  • Content Calendar module PRO
  • ContentSync Plugin PRO
  • Custom fields PRO plugins
  • Filedrop PRO
  • Openinghours module PRO
  • Price List component PRO
  • Reset Hits module PRO
  • RSForm! PRO Notion plugin
  • Secure Messages PRO
  • YOOtheme PRO Elements bundle
Get the Bundle - €65
FAQ

Frequently Asked Questions

Does the recipient need an account or an app?
No. They click the link and read the message in their browser.
Can the site owner or host read the messages?
No. Messages are encrypted in the browser before upload, and the decryption key travels in the URL fragment, the part of a link browsers never send to any server. The database only ever holds ciphertext.
Full technical explanation →
Can I send files?
No, text only: passwords, logins, codes and notes.
What if a client loses the link or the password?
Gone is gone, by design. There is nothing stored that could recover it. Send a new message; that takes ten seconds.
How many sites can I install it on?
Unlimited, including client sites. No per-domain fees.
What happens when my update year ends?
Everything keeps working. Renewing is only needed if you want new updates and support.
Does it work with my template?
The public pages use standard Bootstrap markup, carry UIkit classes for YOOtheme-based templates, and fall back to neutral styling everywhere else. A Custom CSS option covers the fine-tuning.
What are the requirements?
Joomla 5.1.3 or later (Joomla 6 supported), PHP as required by your Joomla version.
Is there a free version or trial?
No free tier, but there is a full live demo.

The next password you send deserves better than an e-mail.

Install Secure Messages on every site you manage for the price of one lunch.
Get Secure Messages - €15
Get Bundle - €65
One license, unlimited sites · Zero-knowledge by design