security.txt Generator
Create security.txt in RFC 9116 format to inform vulnerability reporters where to contact
Features
Generate in standards-compliant format
Output with RFC 9116 field names and correct order
Prevent missing required fields
Display missing contact information and expiration date immediately
Expiration date preset included
Pre-filled with one year from today; alerts if expired
Copy and download
Save generated results directly as security.txt
How to Use
Enter contact information
Input an email address or HTTPS URL, and add more if needed
Verify expiration date
One year from today is pre-filled; change if necessary
Enter optional fields
Open Advanced Settings and add supported languages, policy URLs, and more
Generate and save
Press the Generate button and copy or download
Use Cases
Initial setup
Publish a vulnerability reporting channel on your website
Update before expiration
Recreate an expiring file with the same content
Multiple contact points
List email and form URLs in priority order
Security audit compliance
Meet installation requirements requested in audits
Knowledge Base
What is security.txt?
security.txt is a text file that tells both machines and people where to report vulnerabilities found on a website. RFC 9116 is the standard that defines how to write and where to place it.
- Contact：A required field for receiving reports. Email addresses are written as "mailto:security@example.com" and web forms as URLs starting with "https://".
- Expires：A required field indicating when this content is valid. Format: "2027-03-31T00:00:00.000Z" combining date and time.
Why place it in /.well-known/?
The standard specifies a single location so reporters don't have to search. The proper location is "https://example.com/.well-known/security.txt".
- .well-known folder：A shared folder for site-related files with standardized names. Certificate issuance and app integration configs are also stored here.
Why keep Expires within one year?
Old contact information left unchanged could result in reports being ignored. RFC 9116 recommends an expiration within one year, and expired security.txt is treated as invalid.
- When expiration is reached：Review the content and replace with a file containing a new expiration date. Even if contact info hasn't changed, you must reinstall it.
Security and Privacy
Runs entirely in your browser
Your input data is processed only within your browser and is never sent externally.
Processing only in your browser
Assembling security.txt is processed entirely within your browser, and input data is not sent to any server.
Communications encrypted with HTTPS
Page loading is also encrypted by TLS, and content cannot be read by third parties.
No transmission to third parties
Input content is not sent to external services such as ad networks or trackers.
No automatic saving of results
Contact information and URLs you entered and input suggestions are not stored on the server.
Follow RAKKOTOOLS on Google Search
199 useful tools become easier to find from Google Search and AI Search!
- Found in search
- Also shown in AI Search
- Discover new tools
Updates
- update #250
Added security.txt generator, creates files to specification using contact information and expiration date
Featured Tools
RAKKOTOOLS is free to use!
Available free of charge for individuals and corporations, commercial and non-commercial use alike.No prior permission or usage application is required. Feel free to use it in various situations.
Use in streaming and videos
Use various tools such as lottery draws and raffles in live streams and videos.
Use in schools, work, and events
Can be used in various situations such as classes, team division, internal work, and events.
Introduction on Web, books, and SNS
Feel free to introduce it as a useful tool on web media, books, SNS, and other platforms.
Commercial use
Can be used for commercial purposes such as research, calculation, processing, and conversion in business and production.
If you mention it, I get motivated to create more tools!
If using in streaming and videos
Link to RAKKOTOOLS in the description, or Mention or display that you are using RAKKOTOOLS in the stream or video.
Credit example for the description
Usage guidelinesYou are free to use it for normal purposes. However, use for purposes that violate laws, infringe on third-party rights, impose significant load on the service, or otherwise interfere with service operation is prohibited.
We do not guarantee the accuracy or completeness of information and calculation results obtained from each tool.
This notice is a translation of the original Japanese text. If there is any discrepancy between the translation and the original, the Japanese original takes precedence.