security.txt Generator
Generate a valid RFC 9116 security.txt file with Contact, Expires, Encryption, Policy, and CSAF fields. Free, offline, copy-paste ready.
Loading tool...
What is security.txt Generator?
A security.txt generator that builds RFC 9116 compliant vulnerability disclosure files. Fill in your contact details, expiry date, and optional fields like encryption keys and policy links, and get a ready-to-deploy security.txt file — all processed locally in your browser.
Key Benefits
- Standards-compliant output that security scanners and researchers recognize
- Guided form with required-field validation instead of hand-editing syntax
- Automatic ISO 8601 expiry formatting with a one-click +1 year helper
- Copy or download instantly with zero server processing
- Bilingual English and Thai interface that works offline
Common Use Cases
- •Publishing a vulnerability disclosure channel for a company website
- •Adding security.txt to open-source project documentation sites
- •Preparing bug bounty program infrastructure
- •Passing compliance checklists that look for /.well-known/security.txt
Create a security.txt File
- Add at least one contact: Enter a report email (emitted as Contact: mailto:...), a contact URL, or both — this is the channel researchers will use to reach you.
- Set the expiry date: Pick a date or press the one-year button; the file writes Expires with a full UTC timestamp as RFC 9116 requires, and the form warns until contact and expiry are both present.
- Fill optional fields: Add Encryption for your PGP key, Preferred-Languages (e.g. en, th), Policy, Acknowledgments, Hiring, CSAF, and Canonical; tick Signature only if you will host a .sig file.
- Copy and deploy: Copy the preview or download security.txt, then serve it at https://yourdomain/.well-known/security.txt over HTTPS — the file is built entirely in your browser.
Key Features
- Full RFC 9116 field coverage including CSAF and Signature
- Required-field validation with clear, actionable messages
- One-click +1 year expiry with ISO 8601 formatting
- Live preview that updates as you type
- Copy and download the file without any server round-trip
- Bilingual English and Thai interface, fully offline
Frequently Asked Questions
What is a security.txt file used for?
It tells security researchers where to report vulnerabilities for your domain. The RFC 9116 file lives at /.well-known/security.txt and lists contacts, encryption keys, the disclosure policy, and an expiry date.
Which fields are required?
Contact (at least one, as mailto: or a URL) and Expires. The tool warns until both are present; the expiry date is written with a full UTC timestamp (T23:59:59.000Z) as the RFC requires, and the one-year button sets a sensible default.
Where should I deploy the file?
Serve it at https://yourdomain/.well-known/security.txt over HTTPS, ideally also at /security.txt at the root. If you publish it in both places, set Canonical to the primary URL.
Is the Signature field a real signature?
No — the checkbox only adds a Signature line pointing at a .sig URL; you must create the detached PGP signature yourself and host it at that address. The file is assembled entirely in your browser and never uploaded.