--- title: "Secure Messages for Joomla - Encrypted One-Time Links" date: 2026-07-27 author: "Claude MCP" --- # Secure Messages for Joomla - Encrypted One-Time Links # Stop e-mailing passwords in plain text. Secure Messages adds zero-knowledge encrypted, self-destructing messages to any Joomla site. Share credentials with clients - or let them send secrets to you - through one-time links that even your own server can't read. - [Get Secure Messages - €20](https://www.joomill-extensions.com/buynow/secure-messages) - [Try the live demo](https://demo.joomill-extensions.com/administrator/?joomill&extension=securemessages) One year of updates & personal support  ·  Unlimited sites  ·  ![](https://www.joomill-extensions.com/images/extensions/securemessages/securemessages-backend.png) AES-256-GCM in the browser - the key never reaches the server. [Read exactly how it works](#security). ## Every agency does it. Hosting logins in an e-mail. API keys in a chat. "I'll delete it after, promise." - ### E-mail is forever That password you mailed in 2019 is still sitting in two Sent folders and a backup. - ### Chat is not better Slack, WhatsApp and Teams retain everything, searchably, on someone else's servers. - ### "Just use a password manager" doesn't scale You can't onboard every client into your vault just to hand over one login. ## **What you need is a link that works once, expires, and leaves nothing behind.** ## One-time links, encrypted before they leave the browser - ### Write Type the secret in your Joomla backend - or let clients use the public form on your site. The message is encrypted in the browser with AES-256-GCM before anything is sent. - ### Share You get a one-time link. The decryption key lives in the URL fragment (after the #) - the part browsers never send to a server. E-mail it straight from the form, or copy it into any channel. - ### Burn The recipient clicks, the message decrypts locally, and - if you enabled burn-after-reading - the ciphertext is deleted from your database the same second. Expired messages clean themselves up on schedule. ## See it before you buy it ### Try it yourself Send yourself a secure message on the demo site - no account needed. Watch it encrypt, open the link, and see it burn. [Open the demo](https://demo.joomill-extensions.com/administrator/?joomill&extension=securemessages) ## Zero-knowledge, and we can prove it "Trust us" is not a security model. So here is the actual one: your browser generates a random 128-bit key, derives an AES-256 key via PBKDF2-SHA256 (100,000 iterations), and encrypts with AES-GCM - authenticated encryption, so tampering breaks decryption outright. Only the ciphertext travels to your server. The key becomes the URL fragment, which browsers keep client-side by design. Your database, your logs, your backups: all of them only ever contain ciphertext. An optional password isn't checked by the server - it's folded into the key derivation itself. No password check endpoint means nothing to brute-force. One honest trade-off, documented instead of hidden: when a link is delivered by e-mail, it briefly passes through your mail transport like any e-mailed secret would. Copy the link into another channel and even that goes away. **Cipher:** AES-256-GCM (Web Crypto API) **Key derivation:** PBKDF2-SHA256, 100k iterations **Key transport:** URL fragment - never sent **Password:"**part of key derivation **Server stores:** ciphertext + metadata only **Revocation:**burn / expiry / manual delete **Audit:**User Actions Log (no content) [Read the full security documentation](https://www.joomill-extensions.com/index.php?option=com_content&view=article&id=414&catid=113) ## Built for the client work you already do - ### Hand over credentials Site launch? Send the hosting and admin logins as one burn-after-reading link, straight from the backend. Opened once, gone forever. - ### Receive secrets from clients Put the send form on your agency site (menu item or module). Clients stop pasting API keys into e-mail because you gave them something better. - ### Temporary supplier access Seven-day expiry for the photographer who needs FTP this week. It cleans up after itself. - ### Prove you take security seriously "We never send passwords in plain text" is a line that wins pitches - and now it's true. ## One package, everything included - ### Component Backend message manager, public send form with menu item type, per-field admin modes (sender chooses / default shown / default hidden), recipient whitelist, captcha support, custom CSS. - ### Send Form module The same form in any module position - sidebar, footer, or on your contact page. - ### Cleanup task plugin Scheduled Tasks integration that removes expired messages from the database. - ### Action Log plugin Every create and delete in Joomla's User Actions Log - including guest submissions and automatic burns. Never the content. E-mail template editable like any Joomla mail template Pick your version ## One price. Every feature. All your sites. Buy once, install on every client site you build or maintain. No per-domain fees, ever. Secure Messages Per year. Unlimited sites. Cancel anytime. -  All features - no tiers -  Component -  Send Form module -  Cleanup task plugin -  Action Log plugin -  Unlimited installations -  1 year updates& personal support Joomill Extensions Bundle FAQ ## Frequently Asked Questions - ### Can the site owner or host read the messages? No. Messages are encrypted in the browser before upload, and the decryption key travels in the URL fragment - the part of a link browsers never send to any server. The database only ever holds ciphertext. [Full technical explanation →](https://www.joomill-extensions.com/index.php?option=com_content&view=article&id=414&catid=113) - ### What happens when my update year ends? Everything keeps working. Renewing is only needed if you want new updates and support. - ### How many sites can I install it on? Unlimited - including client sites. No per-domain fees. - ### Does it work with my template? The public pages use standard Bootstrap markup, carry UIkit classes for YOOtheme-based templates, and fall back to neutral styling everywhere else. A Custom CSS option covers the fine-tuning. - ### What are the requirements? Joomla 5.1.3 or later (Joomla 6 supported), PHP as required by your Joomla version. - ### Is there a free version or trial? No free tier - but there is a full live demo. - ### What if a client loses the link or the password? Gone is gone, by design. There is nothing stored that could recover it. Send a new message; that takes ten seconds. ## The next password you send deserves better than an e-mail. Install Secure Messages on every site you manage for the price of one lunch. - - One license, unlimited sites · Zero-knowledge by design ## Custom Fields **Extension Name:** Joomill Secure Messages **Extension Alternative Name:** Joomla Message Burner **Cache Key:** securemessages **OCH categorie:** 41 **Prijs PRO versie:** 20 **Extension URL:** https://www.joomill-extensions.com/extensions/secure-messages **Extension Download URL:** https://www.joomill-extensions.com/downloads/secure-messages **Buy Now URL:** https://www.joomill-extensions.com/buynow/secure-messages