← Back to Tools

📄 Security.txt Generator

Generate a RFC 9116-compliant security.txt file. This file lives at /.well-known/security.txt and tells researchers how to report vulnerabilities responsibly.

📬

Contact *

How researchers should report vulnerabilities. Can be email, URL, or phone. Required by RFC 9116.

📅

Expires *

Required. Recommend 1 year from today — prevents stale contact info from persisting.

Optional fields

Encryption (PGP key URL)

Acknowledgments URL

Policy URL (vulnerability disclosure policy)

Hiring (security jobs page)

Canonical (URL of this security.txt)

Preferred languages (comma-separated)

security.txt

/.well-known/security.txt

How to deploy

Create the directory /.well-known/ in your web root
Save the file as security.txt inside it
Verify it's accessible at https://yourdomain.com/.well-known/security.txt
Optionally sign it with PGP for authenticity

Serving the file also as /security.txt (root) is recommended for backwards compatibility.

How to use this tool

1 Enter your security contact email address and any PGP key URL.

2 Add optional fields: acknowledgments URL, hiring URL, and policy URL.

3 Click Generate to produce the security.txt content.

4 Save the output to /.well-known/security.txt on your web server.

Frequently asked questions

What is security.txt?

Security.txt is a proposed standard (RFC 9116) that tells security researchers how to report vulnerabilities in your website. It lives at /.well-known/security.txt.

Is security.txt required?

It is not mandatory, but it is good practice. Without it, researchers who find a vulnerability may have no easy way to contact you and may disclose it publicly.

Should the contact address be monitored?

Yes. Reports sent to it need a prompt response. Use a shared mailbox or a dedicated security team inbox, not a personal email that may go unread.

What is the Expires field?

The Expires field sets a date after which the security.txt should no longer be trusted. It prevents old, stale contact information from being used indefinitely.