security.txt Generator
Fill in a contact and an expiry date and get a correctly formatted file that follows RFC 9116, with the checks the standard asks for.
Worked examples
A minimal file
Contact: [email protected]. Expires: 30 June 2027.
Contact: mailto:[email protected] and Expires: 2027-06-30T00:00:00.000Z, one on each line
The date is written in the full form the standard requires.
About security.txt Generator
If someone finds a security flaw on your website, the first thing they need is a way to tell you. Without a clear route they may email a random address, post about it in public, or say nothing. A security.txt file fixes that. It is a short text file, kept at a known address on your site, that lists who to contact, how long the information can be trusted and where to find your reporting policy. The format is a published standard, RFC 9116.
Only two fields are required: at least one Contact and an Expires date. The others are optional but useful: a link to your encryption key, to your disclosure policy, to a page that thanks people who report problems, and to security jobs, plus the languages you can read. This generator checks as you type: email addresses and phone numbers become correct links, web links must use https, and an expiry date in the past or more than a year ahead is flagged. The result is plain text ready to save and publish.
How to use security.txt Generator
- Enter at least one way to contact you, such as a shared mailbox, one per line.
- Pick an expiry date, ideally a few months ahead, and add any optional links.
- Fix anything flagged in the notes below the form.
- Save the text as security.txt and publish it at /.well-known/security.txt over HTTPS.
Common uses
- Giving researchers a route to report a problem on your site
- Meeting a client's or insurer's security checklist
- Replacing an out of date file whose expiry has passed
- Publishing a disclosure policy link in a standard place
Frequently asked questions
Where do I put the file?
At /.well-known/security.txt on your domain, served as plain text over HTTPS. Many sites also keep a copy at /security.txt, which the standard allows for older setups.
Why does it need an expiry date?
An old file can send reports to a mailbox nobody reads. The expiry date tells researchers when to stop trusting the file, and forces you to review it. The standard advises less than a year ahead.
Which contact should I use?
A shared mailbox that more than one person reads, so reports are not lost when someone leaves. You can list more than one contact, in order of preference, for example an email address and a web form.
Do I have to sign the file?
The standard recommends signing it with an OpenPGP signature so that readers know it has not been changed. This page does not sign the file. If you want a signature, sign the finished text with your own key.
What is the Canonical field?
It states the address or addresses where the file is meant to be found. It helps readers confirm they have the real file and not a copy served from somewhere else.