security.txt Generator

Fill in the standard fields and get a valid security.txt file for your site. The preview updates as you type and flags anything the RFC requires. It runs in your browser.

A security.txt file tells researchers how to report a vulnerability they’ve found on your site, and this security.txt generator writes one for you from a handful of fields. Add your Contact and Expires values — both required — plus optional Encryption, Acknowledgments, Policy and Preferred-Languages lines, and this rfc 9116 generator lays them out in the right order. The live preview flags a missing contact or a stale expiry date before you publish. Use it as a quick security txt maker, then download the file and drop it at /.well-known/security.txt.

RFC 9116 asks for a date under a year out.

security.txt
Contact: mailto:[email protected]
Expires: 2027-07-31T00:00:00.000Z
Preferred-Languages: en
Policy: https://example.com/security-policy

Serve this at /.well-known/security.txt over HTTPS. A copy at /security.txt is allowed as a fallback.

How it works

  1. 1

    Add your contacts and expiry

    Enter at least one Contact (a mailto:, tel: or https: URI) and pick an Expires date under a year out.

  2. 2

    Fill in any optional fields

    Add Encryption, Policy, Acknowledgments, Canonical or Preferred-Languages lines if you have them.

  3. 3

    Download and publish

    Copy or download the file and serve it over HTTPS at /.well-known/security.txt (a /security.txt copy is allowed too).

Instant & 100% private — nothing is uploaded

Everything runs locally in your browser. Your code, text and files are processed on your own device and are never sent to a server — so there are no upload waits, no size limits from us, and nothing is ever stored or logged.

Frequently asked questions

What is a security.txt file?
It’s a plain-text file defined by RFC 9116 that lists how to reach your security team and report a vulnerability. Researchers look for it at /.well-known/security.txt before they try to disclose an issue.
Which fields are required?
Contact and Expires. Contact points to how you want reports sent; Expires is an ISO 8601 date after which the file should be treated as out of date. This security.txt builder warns you if either is missing.
Where do I put the file?
At https://yourdomain.com/.well-known/security.txt, served over HTTPS. A copy at the site root (/security.txt) is a permitted fallback, but the well-known path is the canonical location.
How often should I update Expires?
The RFC recommends less than a year out, and shorter is better. Set a reminder to regenerate the file with this rfc 9116 generator before the date passes, or scanners will treat it as stale.
Should I sign the file with PGP?
It’s optional but recommended for high-value sites. Add an Encryption field pointing to your public key, then sign the file separately — this security txt maker produces the plain-text body you’d sign.

More tools

JSON Formatter & ValidatorBeautify, minify, validate JSON with a collapsible tree view.Code Formatter & MinifierPretty-print or minify JS, TS, CSS, HTML, JSON, SQL and more.YAML ⇄ JSON ⇄ TOML ConverterConvert config between YAML, JSON and TOML, both ways.JSON Schema Viewer & ValidatorRender a JSON Schema as a tree and validate data against it.Markdown Editor (Live Preview)Write Markdown with a live, side-by-side HTML preview.Mermaid Live EditorTurn Mermaid text into flowcharts and diagrams, live.

More from the Hivly network

Free sister tools on our other sites.

Color Palette GeneratorShuffle palettes with the spacebar, lock favourites, copy hex codes.Length ConverterMetres, feet, miles, inches, km and more, instantly.Word CounterCount words, characters, sentences and reading time live.