Security.txt Generator & Validator
Create an RFC 9116-compliant security.txt file so security researchers know how to report vulnerabilities to you — or paste an existing file to check it against the spec.
Generate security.txt
Validate an existing security.txt
What is security.txt?
security.txt is a standard file (RFC 9116, published 2022) that tells security researchers how to report a vulnerability in your site or product — who to contact, in what language, where your disclosure policy lives, and your PGP key for encrypted reports. Google, GitHub, and many governments publish one; several national cyber-security agencies (including the Dutch NCSC and the UK NCSC) recommend or require it. Without it, researchers who find a real bug often have no safe way to tell you, and the report ends up on social media instead of your inbox.
The two required fields
Contact — at least one URI, tried in order of appearance: mailto:[email protected], an HTTPS web form URL, or tel:+1-555-0100. Note it must be a URI: a bare email address without mailto: is invalid (the generator adds the prefix for you). Expires — exactly one ISO 8601 date-time after which the file should be considered stale; the RFC recommends less than a year out, so reviewing it becomes a yearly routine.
Example
Contact: mailto:[email protected]
Contact: https://example.com/report
Expires: 2027-06-30T23:59:00.000Z
Encryption: https://example.com/pgp-key.txt
Preferred-Languages: en, de
Canonical: https://example.com/.well-known/security.txt
Policy: https://example.com/security-policyFrequently asked questions
Where exactly does the file go?
At /.well-known/security.txt — RFC 9116 requires this path, served over HTTPS as plain text. Serving a copy (or a redirect) at /security.txt is a common courtesy but optional. On Apache hosting, create a .well-known directory in your web root and upload the file there.
security.txt vs robots.txt vs llms.txt?
Three unrelated root files: robots.txt tells crawlers what to fetch, llms.txt guides AI assistants to your key content, and security.txt tells humans how to report vulnerabilities. A well-run site can have all three.
Do I need to sign it with PGP?
The RFC recommends an OpenPGP cleartext signature but doesn't require one. The validator accepts signed files and checks the fields inside the signature wrapper.
What happens when the Expires date passes?
Researchers should treat the file as stale and distrust it. Set a calendar reminder to regenerate it — that's the whole point of the field.
Last updated: 2026-07-12