security.txt Generator

Free

Generate a security.txt file per RFC 9116, the standard that tells security researchers how to report a vulnerability on your site, with built-in warnings for a missing or stale Expires date and invalid Contact URIs.

Contact (required, at least one)

A URI researchers can use to report a vulnerability: mailto:, https:, or tel:

Expires (required)

When this file should be considered stale. Most sites use one year out; RFC 9116 recommends keeping it under a year.

Optional fields

Encryption (PGP key URL)

Acknowledgments (hall-of-fame URL)

Preferred languages

Canonical URL of this file

Policy URL

Hiring URL

CSAF provider-metadata.json URL

Recent Activity

Visible to everyone. Last 20 uses across all visitors, newest first.

Generated security.txt with 1 contact(s)

1 hour ago

Generated security.txt with 1 contact(s)

1 hour ago

Comments (0)

Found this tool useful? Leave a comment, share a tip, or tell us how we can make it better.

No comments yet. Be the first to share your thoughts!

What this tool does

This tool generates a security.txt file following RFC 9116, the standard that tells security researchers how to responsibly report a vulnerability on your site. Add one or more contact methods, an expiry date, and any optional fields you need, and get a ready-to-upload file with built-in warnings for the most common mistakes.

How It Works

Each field you fill in becomes one line in the format Field-Name: value, in the order defined by RFC 9116. The Expires date you pick in your local time zone is converted to RFC 3339 format with a UTC offset (for example 2027-01-01T00:00:00Z), exactly as the specification requires. The tool checks that at least one Contact line exists and looks like a mailto:, https:, or tel: URI, and that Expires is set to a real future date, warning you if either check fails, before you ever upload the file.

Problems it solves

Giving security researchers a clear, standard way to report a vulnerability instead of hunting for a contact form.
Avoiding the most common security.txt mistakes: a missing Expires date, a stale one, or a Contact line that is not a valid URI.
Getting the exact RFC 9116 field order and timestamp format right without memorizing the specification.
Documenting a PGP key, disclosure policy, or bug bounty hiring page in one standard, machine-readable place.

Frequently asked questions

›Where does security.txt actually need to live?

RFC 9116 specifies the well-known location /.well-known/security.txt (for example https://example.com/.well-known/security.txt). Some crawlers also check the bare /security.txt path for backward compatibility, but the well-known path is the one the specification defines, so put it there first.

›Why is Expires required, and what happens if I forget it?

RFC 9116 requires an Expires field so automated tools and researchers can tell a stale, forgotten file from one that is actually maintained; a file without it, or with a date in the past, should be treated as untrustworthy by anything that checks it, which is why this tool warns you in both of those cases.

›Can I list more than one Contact line?

Yes, and RFC 9116 recommends it, listing contacts in order of preference (for example an email address first, then a web form as a backup) gives a security researcher more than one way to reach you if the first one fails.

›What goes in the Encryption field?

A URL pointing to your public PGP key (or an OPENPGPKEY DNS record URI), so a researcher reporting a sensitive vulnerability can encrypt their report to you before sending it, this field is optional but recommended if you handle sensitive disclosures by email.

›What is the CSAF field for?

CSAF (Common Security Advisory Framework) is a later addition to the security.txt ecosystem for organizations that publish machine-readable security advisories; the field points to your provider-metadata.json file so automated tools can discover your advisories, most sites without a formal CSAF feed can leave this blank.

Reformats minified or inconsistently indented JavaScript or CSS into readable, properly indented code, with adjustable indent style and before/after size stats.