security.txt Generator

Build an RFC 9116 security.txt file: configure Contact, Expires, Encryption, Acknowledgments, Preferred-Languages, Canonical, Policy, and Hiring fields, with live preview and download. Also parses an existing security.txt back into the form.

Contact (required, one or more)

Expires (required)

Encryption (optional, PGP key link)

Acknowledgments (optional)

Preferred-Languages (optional)

Canonical (optional — authoritative URL(s) of this file)

Policy (optional — disclosure policy link)

Hiring (optional — security job postings)

Output (security.txt)

Per RFC 9116, publish the generated file at /.well-known/security.txt at your domain's root (a legacy /security.txt location is also checked by some tools, but /.well-known/ is canonical). Contact and Expires are the only required fields — set Expires to a date no more than a year out and remember to refresh it before it lapses.

security.txt Generator

Common uses

Generate a security.txt with a PGP key link
Build a vulnerability disclosure contact file
Parse an existing security.txt

Also searched as

security.txt generator
rfc 9116 security.txt example
create .well-known/security.txt
security.txt parser
import and edit existing security.txt
vulnerability disclosure contact file
security.txt expires field format

Frequently asked questions

How do I create a security.txt file?

Fill in Contact, Expires and optional fields such as Encryption, Policy and Hiring, then download the file and serve it at /.well-known/security.txt.

Can I load an existing security.txt to edit it?

Yes, the tool parses an existing security.txt back into the form.

Which fields does RFC 9116 define?

Contact and Expires are required, and Encryption, Acknowledgments, Preferred-Languages, Canonical, Policy and Hiring are optional; all are supported here.

Is my data uploaded to a server?

No. This tool runs entirely in your browser — your input is processed locally on your device and is never uploaded or stored on a server.