Free security.txt Generator
Enter your security contact and optional policy details and get a security.txt file that follows the standard.
Free, with no sign-up. Fair-use limits apply. To enforce them we keep the domain you enter and a scrambled form of your IP address for 30 days, as described in our privacy policy.
What security.txt is
A security.txt file is a short text file at /.well-known/security.txt that tells people who find a vulnerability where to send the report. It is defined in RFC 9116 and is increasingly checked by security reviewers.
How to use it
Enter at least one contact, an email address or a page that starts with https. Add an expiry date, or leave it to default to a year ahead, then optional links to your disclosure policy, encryption key and acknowledgements page. Press Generate security.txt and upload the file to your /.well-known/ folder.
Keep it current
The expiry date is required so that stale files can be recognised. Set a reminder to renew it, and check your other protections with the caching and compression checker and the security headers checker.
Frequently asked questions
Where does the file go?
At https://example.com/.well-known/security.txt, served as plain text over https.
Do I need to sign it?
Signing is optional but recommended if you publish an encryption key.
Is it a security measure?
It is a communication channel. It does not protect the site by itself.
More free tools
See all free tools, or read about the Domain Tools in the dashboard.