security.txt Generator
Generate an RFC 9116 security.txt file with contact addresses, an expiry date, a policy link, an encryption key and preferred languages.
Free · No sign-up · Your inputs stay in your browser
Input
Generate a security.txt file
Output
/.well-known/security.txt
151 characters
RFC 9116: serve it as text/plain over HTTPS at /.well-known/security.txt, so a researcher who finds a vulnerability knows where to report it instead of posting it publicly. Contact and Expires are the two required fields; an expired file tells reporters the contact may be dead, so put the renewal in a calendar.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Why publish one
Someone who finds a vulnerability in your site needs to know where to report it. Without a security contact they guess at info@, post publicly or give up. RFC 9116 standardised one place to look, and security tools and researchers check it first.
Keep it current
Contact and Expires are required. An expired file signals that nobody maintains the contact, so put the renewal date in a calendar. Serve it over HTTPS as text/plain; signing it with OpenPGP is optional.