security.txt Generator
Add a contact and an expiry date — your security.txt is built as you type.
Your text and files never leave your browser — nothing is sent to a server.
Upload the file to https://yourdomain/.well-known/security.txt. You can optionally sign it with OpenPGP.
How to use
- Under “Contact”, enter the email address or report page where you want security reports, one per line. List your preferred contact first.
- “Expires” defaults to one year from today. An expired file is not trusted, so add a reminder to renew it.
- Optionally add your encryption key, disclosure policy and acknowledgments page. All of these must be https URLs.
- Click “Download” to save security.txt and upload it to your site’s /.well-known/ folder.
FAQ
Do I really need a security.txt?
It is not legally required, but it helps people who find a vulnerability reach you instead of going public. Government sites, large companies and bug bounty programs widely use it.
Won’t publishing an email address attract spam?
It might. Use a dedicated address such as security@, or list a report form URL as the Contact instead of an email.
Can I put it in the site root instead?
RFC 9116 defines /.well-known/security.txt as the official location. For older tools, you can also redirect /security.txt there.
Related tools
All tools
Unit Converters
- Unit Converter
- Temperature Converter
- Weight Converter
- Area Converter
- Length Converter
- Angle Converter
- Calorie Converter
- Data Size Converter
- Dry Volume Converter
- Electric Charge Converter
- Energy Converter
- Flow Rate Converter
- Force Converter
- Fuel Economy Converter
- Luminous Intensity Converter
- Magnetomotive Force Converter
- Power Converter
- Pressure Converter
- Radiation Dose Converter
- Speed Converter
- Time Unit Converter
- Volume Converter