Secure Login Collector gives agencies and freelancers a safe way to receive login details from their clients. Your client fills in a simple form on your website, the data is encrypted in their browser before it is sent, and only you can decrypt it in your WordPress dashboard. No more passwords in emails, chat messages or shared spreadsheets.

How it works

Add the form to any page with the shortcode [seculoco_form] and send the link to your client.
Your client enters name, email and the service, and pastes all login details (username, password, backup codes, notes) into one “Login Credentials” field.
The client’s browser encrypts everything before it is sent (AES-256-GCM for the data, RSA-2048 for the key, using the browser’s built-in Web Crypto API). Your server only receives and stores the encrypted package.
You get an email notification with the sender’s name and email. The login details are never part of the email.
You open the entry in your dashboard and decrypt it with your master password. Decryption happens in your browser.

Free features

Encryption in the browser: login details are encrypted on the client’s device, so they are never sent or stored in plain text.
Master password protection: your private key is stored only in encrypted form, locked with your master password. The master password itself is never stored. Without it, nobody can read the entries, not even someone with a copy of your database.
Decryption in your dashboard: only administrators who know the master password can decrypt entries.
Entry list: search and sort entries by name, email, service and date, decrypt and copy login details with one click, and delete entries when a project is done.
Email notifications: get notified about every new submission.
Simple form for clients: one free-text field for all login details, clear help text and validation messages.
HTTPS check: the plugin warns you in the dashboard if your site does not use HTTPS.

Pro features (Secure Login Collector Pro)

Passkey protection: the Pro encryption key is created in your browser and locked with a secret that only your passkey can produce (WebAuthn PRF extension). Every decryption and export needs the passkey, and the server never holds the key or anything it could be derived from. Works with iCloud Keychain (macOS 15 / iOS 18 or newer), Google Password Manager, 1Password, Bitwarden and FIDO2 security keys such as the YubiKey 5.
Spam and bot protection: a hidden honeypot field with a daily changing name, a minimum time before the form can be submitted, and rate limiting per IP address.
Automatic data expiry: choose after how many days the encrypted data of an entry is deleted automatically.
Bulk decrypt and export: decrypt several entries at once and export CSV files for Bitwarden, 1Password, LastPass, Dashlane, KeePass, Chrome, Firefox or Safari.

Security notes

Use HTTPS. Without HTTPS, the form can be manipulated on its way to your client before anything is encrypted.
Choose a strong master password (at least 12 characters) and store it in your password manager. If you lose it, the stored entries cannot be recovered, not by you and not by us.
How the master password is used: during setup it is sent to your server once to create your key pair and is not stored. After that, it is only used in your browser.
Limits of browser encryption: it protects login details on their way to your site and in your database. It cannot protect against a compromised WordPress site, because someone with administrator or file access could change the code that runs in the browser. Keep WordPress, themes and plugins updated and keep the number of administrator accounts small.

Freemius and privacy

This plugin bundles the Freemius SDK for licensing, payments and optional usage data. Nothing is shared until you explicitly opt in. See “External Services” below for details. Client submissions, encrypted data and decrypted login details never leave your server.

Disclaimer

Security is a shared responsibility. We provide the tools, but you control how and where they are used. We are not liable for any damage, data loss or regulatory issues that arise from using this plugin. Use it at your own risk.

External Services

This plugin bundles the Freemius SDK to handle optional usage data, licensing and upgrades. You have to opt in before any data is shared.

What is sent (only after opt-in):
* Site URL, WordPress version, PHP version and plugin version: for compatibility checks.
* Admin email and locale: so Freemius can send license receipts and support messages if you purchase Pro.

No client submissions, passwords or encrypted data ever leave your server. All login data stays in your WordPress database.

Freemius Terms: https://freemius.com/terms/
Freemius Privacy: https://freemius.com/privacy/