security.txt Generator
Create security.txt in RFC 9116 format to inform vulnerability reporters where to contact
Features
Generate in standards-compliant format
Output with RFC 9116 field names and correct order
Prevent missing required fields
Display missing contact information and expiration date immediately
Expiration date preset included
Pre-filled with one year from today; alerts if expired
Copy and download
Save generated results directly as security.txt
How to Use
Enter contact information
Input an email address or HTTPS URL, and add more if needed
Verify expiration date
One year from today is pre-filled; change if necessary
Enter optional fields
Open Advanced Settings and add supported languages, policy URLs, and more
Generate and save
Press the Generate button and copy or download
Use Cases
Initial setup
Publish a vulnerability reporting channel on your website
Update before expiration
Recreate an expiring file with the same content
Multiple contact points
List email and form URLs in priority order
Security audit compliance
Meet installation requirements requested in audits
Knowledge Base
What is security.txt?
security.txt is a text file that tells both machines and people where to report vulnerabilities found on a website. RFC 9116 is the standard that defines how to write and where to place it.
- Contact：A required field for receiving reports. Email addresses are written as "mailto:security@example.com" and web forms as URLs starting with "https://".
- Expires：A required field indicating when this content is valid. Format: "2027-03-31T00:00:00.000Z" combining date and time.
Why place it in /.well-known/?
The standard specifies a single location so reporters don't have to search. The proper location is "https://example.com/.well-known/security.txt".
- .well-known folder：A shared folder for site-related files with standardized names. Certificate issuance and app integration configs are also stored here.
Why keep Expires within one year?
Old contact information left unchanged could result in reports being ignored. RFC 9116 recommends an expiration within one year, and expired security.txt is treated as invalid.
- When expiration is reached：Review the content and replace with a file containing a new expiration date. Even if contact info hasn't changed, you must reinstall it.
Security and Privacy
Runs entirely in your browser
Your input data is processed only within your browser and is never sent externally.
Processing only in your browser
Assembling security.txt is processed entirely within your browser, and input data is not sent to any server.
Communications encrypted with HTTPS
Page loading is also encrypted by TLS, and content cannot be read by third parties.
No transmission to third parties
Input content is not sent to external services such as ad networks or trackers.
No automatic saving of results
Contact information and URLs you entered and input suggestions are not stored on the server.
Updates
- update #249
Added security.txt generator, creates files to specification using contact information and expiration date