Security.txt Generator

About Security.txt generator

security.txt is a small text file, standardized in RFC 9116, that tells researchers how to report a vulnerability in your site. This form assembles it field by field, checks that the required Contact and Expires lines are present and valid, and lets you copy or download the finished file for /.well-known/security.txt.

How to use it

1. Set Expires to a future ISO 8601 date. It is pre-filled a year ahead, and shorter is recommended.
2. Add at least one Contact entry, such as mailto:security@yourdomain.com or an https:// form, and press the plus button or Enter. Replace the sample address.
3. Optionally add Encryption, Acknowledgments, Canonical, Policy and Hiring links, and Preferred-Languages as comma-separated tags.
4. Check the banner above the form. Copy the file, or Download security.txt once the errors are cleared.

A minimal file

Contact mailto:security@example.com, Expires 2027-06-30T00:00:00Z, Preferred-Languages en, fr, Canonical and Policy links

Two comment lines, a blank line, then Contact: mailto:security@example.com, Expires: 2027-06-30T00:00:00Z, Preferred-Languages: en, fr, Canonical: https://example.com/.well-known/security.txt and Policy: https://example.com/security-policy

When to use it

• Giving researchers a documented, machine-readable route to report a flaw before they post it publicly.
• Meeting a customer or procurement security questionnaire that asks whether you publish a disclosure contact.
• Renewing an expired file by generating a new Expires date and the same fields.
• Pointing reporters to a PGP key and acknowledgments page alongside the email address.

Questions about Security.txt generator

Which fields are mandatory?

Only Contact and Expires. Everything else is optional. The tool refuses the download until Contact has an entry and Expires is a valid future date.

Where do I put the file?

Serve it over HTTPS at /.well-known/security.txt on your domain as plain UTF-8 text. RFC 9116 also permits the older /security.txt path as a fallback, but the well-known path is preferred.

Why does the page warn about the Expires date?

The RFC recommends less than a year ahead so that abandoned files go stale instead of pointing at dead mailboxes. A date in the past is an error, and one over a year out is a warning.

What does Canonical do?

It lists the exact URLs where this file is meant to be served, so a reader can tell a genuine copy from a mirror. Non-https links in it, or in other link fields, trigger a warning.

Does the tool sign the file?

No. RFC 9116 recommends signing with an OpenPGP cleartext signature, but this generator produces the unsigned text only. Sign it yourself with gpg if you publish an Encryption key.

Related tools

• MD5 GeneratorGenerate an MD5 hash from text
• SHA GeneratorGenerate SHA-1, SHA-256, SHA-384, and SHA-512 hashes
• Bcrypt GeneratorGenerate a bcrypt hash from text
• JWT DecoderDecode and inspect JWT tokens — view header, payload claims, expiry, and signature.
• Whirlpool GeneratorGenerate a Whirlpool hash from text
• HMAC generatorGenerate a keyed-hash message authentication code for any message and secret key using SHA-1, SHA-256, SHA-384 or SHA-512.