🛡️security.txt Generator

About this tool

Enter one or more contacts, such as an email address, a reporting web page or a phone number, and an expiry date. Add whichever optional fields you use: your PGP key URL, a thank-you page, preferred languages, the canonical address, your disclosure policy, a security jobs page and a CSAF provider file. The file builds as you type, with checks for the required fields and an expiry date less than a year ahead. Plain email addresses are converted to mailto: links for you.

What security.txt is for

security.txt is a small text file, standardised in RFC 9116 in 2022, that tells security researchers how to report a vulnerability in your website or service. It means a responsible report reaches the right person instead of a general inbox or a public social media post. Publish it at https://yourdomain/.well-known/security.txt over HTTPS. Two fields are required. Contact gives at least one way to report, as an email (mailto:), a web form (https://) or a phone number (tel:). Expires is a date and time after which the file should be treated as stale, and the RFC recommends less than a year ahead, so set a reminder to renew it. The optional fields point to your encryption key, an acknowledgments page, your vulnerability disclosure policy, preferred languages and the file's canonical URL. RFC 9116 also allows signing the file with OpenPGP, which researchers can verify. Honest limits: the file only helps if someone monitors the contact, so route reports to a monitored mailbox and reply promptly. The robots.txt generator and the llms.txt generator create the other root files, and the hash generator can fingerprint your key. HTTP status codes explained — the ones you'll actually meet, and what to do about them helps check the file is served correctly.

Frequently asked questions