security.txt Generator
- At least one contact is required: an email address, a web form or a phone number.
- Choose an expiry date in the future. RFC 9116 recommends less than one year.
- This must be a full https:// address.
- The expiry date is more than a year away. RFC 9116 recommends less than one year.
- The file follows RFC 9116.
- Publish it at /.well-known/security.txt on your domain (and optionally at /security.txt). Serve it over HTTPS as plain text.
- Optional: sign the file with your PGP key (a clear-signed file) so researchers can verify it came from you.
About this tool
A security.txt file tells security researchers how to report a vulnerability in your website. Fill in the form to get a file that follows RFC 9116, ready to publish at /.well-known/security.txt. Everything runs in your browser.
Frequently asked questions
What is security.txt Generator?
Create an RFC 9116 security.txt file so researchers know how to report vulnerabilities. It is one of the Security & Crypto tools on MyCodeTips.
How do I use security.txt Generator?
Open the tool, enter or paste your input, and the result appears right away. Use the Copy button to copy it.
Is security.txt Generator free to use?
Yes. It is free to use and does not need an account.
Is my data safe with security.txt Generator?
Yes. It runs entirely in your browser, so what you enter is never uploaded to our servers.
Can I share my result?
Yes. Use the share buttons below the tool to post a link or copy a link to the tool page.
Which tools are related to security.txt Generator?
CSP Builder & Evaluator, CVSS Calculator.
Related tools
- Send output to…
- Nothing to send yet.
- Received output from {tool}
- Undo
- Dismiss