Security
Processed locally in your browser — not uploaded
RFC 9116 security.txt File Generator
Create RFC 9116-compliant security.txt files for your web applications and organizations. Configure mandatory Contact and Expiration directives, OpenPGP keys, security policies, and preferred languages with instant syntax validation and file export.
RFC 9116 security.txt Directives
security.txt File Preview
RFC 9116 Valid01
How to use
- Fill in mandatory vulnerability report contact endpoints (email or web security form URL).
- Select an expiration timestamp (Expires) according to RFC 9116 requirements.
- Optionally provide links to your OpenPGP encryption key, security policy, or hall-of-fame acknowledgments.
- Copy the generated security.txt content and place it at /.well-known/security.txt on your web server.
02
Understanding the output
RFC 9116 defines a standardized format for security researchers to find vulnerability reporting policies and contact info. The file MUST be served over HTTPS at standard URI path /.well-known/security.txt.
03
Common issues & tips
- •Missing mandatory fields: RFC 9116 mandates both 'Contact' and 'Expires' directives.
- •Invalid URI scheme: Contact directives must start with mailto: or https://.
- •Expired file: The 'Expires' date must be set in the future; security crawlers ignore stale security.txt files.
Frequently asked questions
- Where should I host the generated security.txt file?
- According to RFC 9116, the file must be served at /.well-known/security.txt via HTTPS.