Skip to main content

Stop e-mailing passwords
in plain text.

Secure Messages adds zero-knowledge encrypted, self-destructing messages to any Joomla site. Share credentials with clients - or let them send secrets to you - through one-time links that even your own server can't read.

Get Secure Messages - €20
Try the live demo

One year of updates & personal support  ·  Unlimited sites  ·  Less than 10 minutes of your hourly rate

AES-256-GCM in the browser - the key never reaches the server. Read exactly how it works.

Every agency does it. Hosting logins in an e-mail. API keys in a chat.

"I'll delete it after, promise."

E-mail is forever

That password you mailed in 2019 is still sitting in two Sent folders and a backup.

Chat is not better

Slack, WhatsApp and Teams retain everything, searchably, on someone else's servers.

"Just use a password manager" doesn't scale

You can't onboard every client into your vault just to hand over one login.

What you need is a link that works once, expires, and leaves nothing behind.

One-time links, encrypted before they leave the browser

Write

Type the secret in your Joomla backend - or let clients use the public form on your site. The message is encrypted in the browser with AES-256-GCM before anything is sent.

Share

You get a one-time link. The decryption key lives in the URL fragment (after the #) - the part browsers never send to a server. E-mail it straight from the form, or copy it into any channel.

Burn

The recipient clicks, the message decrypts locally, and - if you enabled burn-after-reading - the ciphertext is deleted from your database the same second. Expired messages clean themselves up on schedule.

See it before you buy it

Try it yourself

Send yourself a secure message on the demo site - no account needed. Watch it encrypt, open the link, and see it burn.

Open the demo

Zero-knowledge,
and we can prove it

"Trust us" is not a security model. So here is the actual one: your browser generates a random 128-bit key, derives an AES-256 key via PBKDF2-SHA256 (100,000 iterations), and encrypts with AES-GCM - authenticated encryption, so tampering breaks decryption outright. Only the ciphertext travels to your server. The key becomes the URL fragment, which browsers keep client-side by design. Your database, your logs, your backups: all of them only ever contain ciphertext.

An optional password isn't checked by the server - it's folded into the key derivation itself. No password check endpoint means nothing to brute-force.

One honest trade-off, documented instead of hidden: when a link is delivered by e-mail, it briefly passes through your mail transport like any e-mailed secret would. Copy the link into another channel and even that goes away.

Cipher: AES-256-GCM (Web Crypto API)
Key derivation: PBKDF2-SHA256, 100k iterations
Key transport: URL fragment - never sent
Password:"part of key derivation
Server stores: ciphertext + metadata only
Revocation: burn / expiry / manual delete
Audit: User Actions Log (no content)

Read the full security documentation

Built for the client work you already do

Hand over credentials

Site launch? Send the hosting and admin logins as one burn-after-reading link, straight from the backend. Opened once, gone forever.

Receive secrets from clients

Put the send form on your agency site (menu item or module). Clients stop pasting API keys into e-mail because you gave them something better.

Temporary supplier access

Seven-day expiry for the photographer who needs FTP this week. It cleans up after itself.

Prove you take security seriously

"We never send passwords in plain text" is a line that wins pitches - and now it's true.

One package, everything included

Component

Backend message manager, public send form with menu item type, per-field admin modes (sender chooses / default shown / default hidden), recipient whitelist, captcha support, custom CSS.

Send Form module

The same form in any module position - sidebar, footer, or on your contact page.

Cleanup task plugin

Scheduled Tasks integration that removes expired messages from the database.

Action Log plugin

Every create and delete in Joomla's User Actions Log - including guest submissions and automatic burns. Never the content.
E-mail template editable like any Joomla mail template
Pick your version

One price. Every feature. All your sites.

Buy once, install on every client site you build or maintain. No per-domain fees, ever.

Secure Messages

Per year. Unlimited sites. Cancel anytime.

  •  Translate Articles
  •  Translate Categories
  •  Content Fields (All Fields)
  •  Translate Menus
  •  Translate Modules
  •  Translate Mail Templates
  • Translate YOOtheme Builder pages
  •  Translate SEO Meta Data
  •  Smart Link Rewriting
  •  Custom Fields Support
  •  Dictionary
  •  PRO Translate Engines
  •  Unlimited installations
  •  1 year updates& personal support

Joomill Extensions Bundle

65€

All commercial Joomill extensions in one license. Save €100+

  • Admin Checklist component PRO
  • Admin Customizer plugin
  • Autolanguage plugin PRO
  • Client Response Gallery
  • Content Calendar module PRO
  • Custom fields plugins
  • Filedrop
  • Openinghours module PRO
  • Price List component PRO
  • Reset Hits module PRO
  • RSForm! PRO Notion plugin
  • YOOtheme PRO Elements bundle
Get the Bundle - €65
FAQ

Frequently Asked Questions

Can the site owner or host read the messages?
No. Messages are encrypted in the browser before upload, and the decryption key travels in the URL fragment - the part of a link browsers never send to any server. The database only ever holds ciphertext.
Full technical explanation →
What happens when my update year ends?
Everything keeps working. Renewing is only needed if you want new updates and support.
How many sites can I install it on?
Unlimited - including client sites. No per-domain fees.
Does it work with my template?
The public pages use standard Bootstrap markup, carry UIkit classes for YOOtheme-based templates, and fall back to neutral styling everywhere else. A Custom CSS option covers the fine-tuning.
What are the requirements?
Joomla 5.1.3 or later (Joomla 6 supported), PHP as required by your Joomla version.
Is there a free version or trial?
No free tier - but there is a full live demo.
What if a client loses the link or the password?
Gone is gone, by design. There is nothing stored that could recover it. Send a new message; that takes ten seconds.

Manage your Task List inside Joomla

{php file="ext_downloads.php"} Joomla sites already do. Pick Free to try, go PRO, or grab the Bundle if you maintain more than one Joomill extension.
Get Bundle - €65
One license, unlimited sites · Personal support from the developer