security.txt generator
Build a security.txt with Contact and a future Expires, plus optional policy and hiring URLs.
Loading tool…
Recommended next step
Protect and verify your data
After using security.txt generator, continue with API key generator.
Continue this path
Tools selected to complete the same task.
Tool guide
security.txt generator: how it works
Practical information to understand the result and use this tool correctly.
About security.txt generator
security.txt (RFC 9116) tells researchers how to report a vulnerability. It belongs at https://example.com/.well-known/security.txt.
Contact is required and must be a mailto, https, or tel URI. Expires must be a future UTC timestamp so abandoned files stop being trusted.
Optional Encryption, Policy, Hiring, Acknowledgments, and Canonical fields must be https URLs. The file is built locally.
How to use it
- 1Enter a Contact (mailto:security@example.com) and a future Expires date.
- 2Add optional https policy, hiring, or canonical URLs.
- 3Copy or download security.txt. Upload it yourself to /.well-known/.
Frequently asked questions
- Where does security.txt go?
- Publish it at https://your-domain/.well-known/security.txt. A copy at /security.txt is only a fallback.
- Why must Expires be in the future?
- RFC 9116 says consumers should ignore a file after Expires so an abandoned contact is not trusted forever.
- Is this the same as robots.txt?
- No. robots.txt controls crawlers. security.txt publishes a vulnerability-disclosure contact.