security.txt Generator & Validator (RFC 9116)

What is a security.txt file?

Reviewed by Prabath Thalangama · Last updated October 23, 2026

security.txt is a plain-text file at /.well-known/security.txt that tells security researchers how to report vulnerabilities to you. RFC 9116 requires a Contact and an Expires field. This tool generates a valid file from a form, and validates an existing file's fields and expiry in your browser.

Without one, people who find a problem in your site have to guess who to tell, and often give up. The file is small, but it needs maintaining: Expires must be in the future, and the RFC recommends it be less than a year away.

Contacts entered as an email address or phone number are turned into mailto: and tel: URIs automatically. Optional fields are Encryption, Acknowledgments, Policy, Hiring, Canonical and Preferred-Languages.

How do I create a security.txt file?

Enter at least one contact and an expiry date, plus any optional fields.
Fix any warnings, then save the output as security.txt.
Serve it over HTTPS at https://yourdomain/.well-known/security.txt as text/plain.
Set a reminder to renew Expires before it passes.

How to read the results

Generated file: The fields in RFC 9116 format, with Expires as an ISO 8601 timestamp.
Warnings: Missing Contact or Expires, an invalid, past or more-than-a-year-ahead Expires, and a missing Canonical field.
Validation issues: For a pasted file: unparseable lines, missing required fields, an expired file, Expires appearing more than once, and no Canonical.

Common security.txt mistakes

File has expired

Update Expires and redeploy. An expired file tells researchers the contact may be stale.

Expires: 2027-10-01T00:00:00.000Z

Served at the wrong path

The standard location is /.well-known/security.txt. /security.txt at the root is accepted only as a legacy fallback.

Examples and command-line equivalents

A minimal valid file

Contact: mailto:[email protected]
Expires: 2027-10-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt

Check a site's file

curl -s https://example.com/.well-known/security.txt

Frequently asked questions

Should I sign security.txt with PGP?

RFC 9116 recommends a cleartext OpenPGP signature so readers can verify the file wasn't tampered with. It's optional; a correct, current file matters more.

Do I need a bug bounty to publish security.txt?

No. A Contact and an Expires field are enough. A Policy link can explain how you handle reports and whether you offer rewards.

security.txt Generator & Validator