Generate encrypted, self-destructing links for passwords, credentials, API keys and confidential notes — directly inside Perfex CRM. The server never sees the plaintext. Ever.

Important: This is an add-on module for Perfex CRM. A valid Perfex CRM license is required. Perfex CRM is sold separately at CodeCanyon.

The problem this solves

Every time you send a credential through email, WhatsApp or Slack, you create a permanent, searchable record of that secret. Secure Messages eliminates that risk by giving your team a dedicated, encrypted channel inside Perfex CRM.

Zero-Knowledge Architecture

Most “secure sharing” tools encrypt data on the server — which means the service provider technically has access to your secrets. Secure Messages uses a fundamentally different approach: all encryption and decryption happens in the browser using AES-256.

The encryption key is appended to the link as a URL fragment (the part after #). Fragments are never sent to the server in HTTP requests. Your database stores only ciphertext. Even with full database access, the content is unreadable without the key — and the key lives only in the shared URL.

How it works

Compose your message — Paste your sensitive content (passwords, API keys, credentials). Add an internal reference label for your own bookkeeping.
Configure protection — Choose an expiry window (1, 3, 7 or 30 days — or never). Enable burn-after-reading. Optionally require a password before decryption.
Share the link — Copy and send the URL. Once the recipient reads the message, it is permanently deleted. The link in your chat history becomes a dead end.

Features

Zero-Knowledge AES-256 encryption — Encryption key is only in the URL hash, never stored on the server
Burn-after-reading mode — Content is deleted from the database immediately after the first view
Time-bound expiry (1 / 3 / 7 / 30 days / never) — Automatic cleanup via Perfex cron integration
Optional password gate — bcrypt-verified password check before decryption starts
Company branding on public view — Display your logo instead of the default icon
Admin overview with DataTable — All active links in one sortable, filterable table with one-click delete
Global defaults in Settings panel — Set default expiry, burn mode and password for your whole team
Perfex native role permissions — View, create and delete capabilities per staff role
Internal reference / label field — For your own administration, clearly disclosed in the UI
SEO-safe public view — Public pages carry noindex, nofollow, noarchive meta tags
32-character random link identifier — Not guessable, not sequential
22+ included languages — Full translation files for admin and public views
No external SaaS dependency — Runs entirely on your own server
Clean install / uninstall — Single-table schema (tbl_secure_messages), clean uninstall removes all data

Who uses this

Web agencies and IT service providers — Share hosting credentials and server access with clients securely
Accounting and finance firms — Deliver credentials without leaving a paper trail in email
Software development teams — Distribute API keys and environment secrets without polluting Slack history
Legal and compliance teams — Share access data with counterparties in a way that automatically expires
Healthcare and HR departments — Transmit sensitive personal data in a GDPR-conscious way

Frequently asked questions

Can the server administrator read the encrypted messages?

No. The encryption key is only in the URL fragment (#). HTTP clients never send the fragment to the server, so the key is never transmitted or stored. The database contains only AES-256 ciphertext — unreadable without the URL.

What happens if the recipient opens the link but doesn’t click “Show Message”?

Nothing. The message is only destroyed when the recipient actively clicks the button. Simply opening the URL does not trigger deletion — so accidental link previews from messaging apps will not prematurely destroy the content.

Can I recover a message after it has been burned or expired?

No. Deletion is permanent. Because the key was never stored server-side, there is no recovery path. This is by design.

Does this work with Perfex multi-staff setups?

Yes. Uses Perfex’s native capabilities system. View, create and delete permissions are assignable per role independently.

The module significantly reduces data exposure risks because plaintext is never stored and messages self-destruct. GDPR compliance depends on your broader data processing context — consult your legal advisor for your specific situation.

Technical requirements

Perfex CRM: 2.3.2 or higher
PHP: 7.4 or higher (bcrypt support required)
MySQL: 5.7+ / MariaDB 10.3+
Browser: Any modern browser with ES6+ support (Chrome, Firefox, Safari, Edge)
External dependency: CryptoJS 4.1.1 (loaded from Cloudflare CDN)
Cron job: Perfex cron must be active for automatic expiry cleanup

This module uses only one new database table and does not modify any existing Perfex tables or core files.

Changelog

v1.1.0 (07-04-2026)

Add PHPDoc comments across Secure Messages module for improved code clarity and maintainability
Don’t load assets from CDN
All JavaScript should be written with “use strict” mode on.
No inline scripts or styles unless dynamic.

v1.0.0 — Initial release (01-04-2026)

Full Zero-Knowledge AES-256 encryption, burn-after-reading, time-bound expiry, optional bcrypt password gate, company logo support, admin DataTable overview, global settings, Perfex role-based permissions, automatic cron cleanup, 22+ language files, clean install and uninstall scripts.

Secure Messages for Perfex CRM