security.txt generator

Build a valid RFC 9116 security.txt — contact, expires, encryption, policy and the rest — for /.well-known/.

Generated in this browser. Nothing is sent anywhere.

Builds an RFC 9116 security.txt. Fields appear in the RFC's preferred order; Expires is normalized to UTC. Deploy the file at /.well-known/security.txt and consider signing it with your site's PGP key.

How to use

  1. Enter contact URIs and an expiry date.
  2. Add optional fields (canonical, encryption, acknowledgments, languages, policy, hiring).
  3. Generate and copy the security.txt text.

What it supports

RFC 9116 fields with validation: contacts must be mailto: or https: URIs, Expires must be a future ISO date, each field up to 500 characters and 20 entries. Canonical is generated as https://<host>/.well-known/security.txt when you give a host. Signing (PGP) is out of scope.

Related tools

Related guides