security.txt Generator
Build a /.well-known/security.txt.
Runs entirely in your browser — nothing you enter is uploaded, logged, or tracked.
security.txt is a standard file (RFC 9116) at /.well-known/security.txt that tells security researchers how to responsibly report vulnerabilities. Fill in your contact, an expiry date and optional fields to generate a valid file you can drop on your site. Built entirely in your browser.
Frequently asked questions
Where do I put the file?
At https://yourdomain/.well-known/security.txt (and ideally also /security.txt). Serve it over HTTPS with a text/plain content type.
Which fields are required?
Contact (at least one) and Expires are required by RFC 9116. The generator warns if they are missing and formats the date for you.
Should I sign it?
Recommended — sign the file with PGP (use our PGP tool) and reference the signature, for authenticity. The generator notes where to add it.