Generate or check a security.txt file
Generate a valid RFC 9116 security.txt from a short form, or paste yours to catch missing fields and an expired date.
What each field means
Contact
Where a researcher should reach you. An email becomes mailto:you@example.com. A host name becomes an https:// link. The file itself must contain a URI, so a bare email left in the file is invalid.
Expires
The moment the file stops being trustworthy. Required, and it may appear only once. Use a full timestamp. This tool warns inside 30 days (our policy) and if the date is more than a year out (the RFC's recommendation).
Encryption
A link to a key, never the key text. https://, openpgp4fpr:, or dns: are accepted. If you list a mailto: contact and no key, the checker warns.
Acknowledgments
An https:// page that thanks people who reported issues.
Preferred-Languages
One line of comma-separated language tags, such as en, fr.
Canonical
The https:// URL of this exact file, usually https://your-site/.well-known/security.txt.
Policy
An https:// page with your vulnerability disclosure policy: what to report, and what you promise in return.
Hiring
An https:// page for security jobs, if you want researchers to see it.
Questions
What is a security.txt file?
A small text file that tells researchers how to contact you about a security issue. The format is RFC 9116. It is not a promise that the rest of the site has been tested.
Where does the file go?
Put it at /.well-known/security.txt and serve it over HTTPS as text/plain. A copy at /security.txt is only a legacy fallback.
Why is a bare email address rejected?
Contact has to be a URI. mailto:you@example.com is valid. you@example.com alone is not. The generator adds mailto: for you and shows the line it wrote.
How long should Expires be?
Less than a year. That limit is the RFC's recommendation. This tool also warns when the date is inside 30 days, which is our own reminder window, not a rule from the RFC.
Does a clear result mean my site is compliant?
No. A pass means no problems were found in the pasted text. It does not show where the file is published, whether the site uses HTTPS, what content type was sent, or whether a PGP signature is valid.
Do you store what I paste?
No. The paste is checked in memory and thrown away. Logs may include the size, the verdict and the finding codes. They do not include the file.
Will you email me before the file expires?
Not yet. Leaving an address only records that you want a reminder if we build one. No email is sent. We store the address and the kind of expiry problem, not the file and not your domain.
Can you fetch the file from my live site?
No. This version only checks text you paste. The server does not request URLs you supply.
What about a PGP signature?
A cleartext signature is detected and the wrapper is skipped so the fields can be read. The signature is not verified. The result will not say the signature is valid.