diff --git a/flask_security/core.py b/flask_security/core.py
index c0e65b0..b9421c1 100644
--- a/flask_security/core.py
+++ b/flask_security/core.py
@@ -62,15 +62,15 @@ _default_config = {
 
 #: Default Flask-Security flash messages
 _default_flash_messages = {
-    'UNAUTHORIZED': 'You do not have permission to view this resource.',
-    'ACCOUNT_CONFIRMED': 'Your account has been confirmed. You may now log in.',
-    'ALREADY_CONFIRMED': 'Your account has already been confirmed',
-    'INVALID_CONFIRMATION_TOKEN': 'Invalid confirmation token',
-    'PASSWORD_RESET_REQUEST': 'Instructions to reset your password have been sent to %(email)s.',
-    'PASSWORD_RESET_EXPIRED': 'You did not reset your password within %(within)s. New instructions have been sent to %(email)s.',
-    'INVALID_RESET_PASSWORD_TOKEN': 'Invalid reset password token',
-    'CONFIRMATION_REQUEST': 'A new confirmation code has been sent to %(email)s.',
-    'CONFIRMATION_EXPIRED': 'You did not confirm your account within %(within)s. New instructions to confirm your account have been sent to %(email)s.'
+    'UNAUTHORIZED': ('You do not have permission to view this resource.', 'error'),
+    'ACCOUNT_CONFIRMED': ('Your account has been confirmed. You may now log in.', 'success'),
+    'ALREADY_CONFIRMED': ('Your account has already been confirmed', 'info'),
+    'INVALID_CONFIRMATION_TOKEN': ('Invalid confirmation token', 'error'),
+    'PASSWORD_RESET_REQUEST': ('Instructions to reset your password have been sent to %(email)s.', 'info'),
+    'PASSWORD_RESET_EXPIRED': ('You did not reset your password within %(within)s. New instructions have been sent to %(email)s.', 'error'),
+    'INVALID_RESET_PASSWORD_TOKEN': ('Invalid reset password token', 'error'),
+    'CONFIRMATION_REQUEST': ('A new confirmation code has been sent to %(email)s.', 'info'),
+    'CONFIRMATION_EXPIRED': ('You did not confirm your account within %(within)s. New instructions to confirm your account have been sent to %(email)s.', 'error')
 }
 
 
diff --git a/flask_security/decorators.py b/flask_security/decorators.py
index 481f075..cfdb492 100644
--- a/flask_security/decorators.py
+++ b/flask_security/decorators.py
@@ -42,7 +42,7 @@ def _get_unauthorized_response(text=None, headers=None):
 
 def _get_unauthorized_view():
     cv = utils.get_url(utils.config_value('UNAUTHORIZED_VIEW'))
-    utils.do_flash(utils.get_message('UNAUTHORIZED'), 'error')
+    utils.do_flash(utils.get_message('UNAUTHORIZED'))
     return redirect(cv or request.referrer or '/')
 
 
diff --git a/flask_security/utils.py b/flask_security/utils.py
index 9d537c3..23a7160 100644
--- a/flask_security/utils.py
+++ b/flask_security/utils.py
@@ -96,7 +96,8 @@ def get_config(app):
 
 
 def get_message(key, **kwargs):
-    return config_value('MSG_' + key) % kwargs
+    rv = config_value('MSG_' + key)
+    return rv[0] % kwargs, rv[1]
 
 
 def config_value(key, app=None, default=None):
diff --git a/flask_security/views.py b/flask_security/views.py
index b398f7d..d98536d 100644
--- a/flask_security/views.py
+++ b/flask_security/views.py
@@ -181,9 +181,9 @@ def send_confirmation():
 
         _logger.debug('%s request confirmation instructions' % user)
 
-        msg = get_message('CONFIRMATION_REQUEST', email=user.email)
+        msg, cat = get_message('CONFIRMATION_REQUEST', email=user.email)
 
-        do_flash(msg, 'info')
+        do_flash(msg, cat)
 
     else:
         for key, value in form.errors.items():
@@ -200,22 +200,22 @@ def confirm_account(token):
         _logger.debug('%s confirmed their account' % user)
 
     except ConfirmationError, e:
-        msg = str(e)
+        msg, cat = str(e), 'error'
 
         _logger.debug('Confirmation error: ' + msg)
 
         if e.user:
             reset_confirmation_token(e.user)
 
-            msg = get_message('CONFIRMATION_EXPIRED',
-                              within=_security.confirm_email_within,
-                              email=e.user.email)
+            msg, cat = get_message('CONFIRMATION_EXPIRED',
+                                   within=_security.confirm_email_within,
+                                   email=e.user.email)
 
-        do_flash(msg, 'error')
+        do_flash(msg, cat)
 
         return redirect(get_url(_security.confirm_error_view))
 
-    do_flash(get_message('ACCOUNT_CONFIRMED'), 'success')
+    do_flash(get_message('ACCOUNT_CONFIRMED'))
 
     return redirect(_security.post_confirm_view or _security.post_login_view)
 
@@ -232,8 +232,9 @@ def forgot_password():
 
         _logger.debug('%s requested to reset their password' % user)
 
-        msg = get_message('PASSWORD_RESET_REQUEST', email=user.email)
-        do_flash(msg, 'success')
+        msg, cat = get_message('PASSWORD_RESET_REQUEST', email=user.email)
+
+        do_flash(msg, cat)
 
         return redirect(_security.post_forgot_view)
 
@@ -259,18 +260,18 @@ def reset_password(token):
             _logger.debug('%s reset their password' % user)
 
         except ResetPasswordError, e:
-            msg = str(e)
+            msg, cat = str(e), 'error'
 
             _logger.debug('Password reset error: ' + msg)
 
             if e.user:
                 reset_password_reset_token(e.user)
 
-                msg = get_message('PASSWORD_RESET_EXPIRED',
-                                  within=_security.reset_password_within,
-                                  email=e.user.email)
+                msg, cat = get_message('PASSWORD_RESET_EXPIRED',
+                                       within=_security.reset_password_within,
+                                       email=e.user.email)
 
-            do_flash(msg, 'error')
+            do_flash(msg, cat)
 
     return render_template('security/passwords/edit.html',
                            reset_password_form=form,