Free security.txt Generator — Create a Security Policy File (RFC 9116)

A security.txt file tells security researchers exactly how to report vulnerabilities in your site — and RFC 9116 made it an official standard. This generator builds a correctly formatted file with all the standard fields, validates your contacts and expiry date, and previews everything live. Download it and drop it in your site’s .well-known folder. Everything runs in your browser.

How it works

The generator assembles your security.txt from the RFC 9116 field set — Contact, Expires, Encryption, Acknowledgments, Preferred-Languages, Canonical, Policy, and Hiring — in your browser. It validates as you type: contacts must use a mailto: or https:// scheme, and the expiry date must be in the future (security tools ignore expired files). The preview updates live, and the download is a plain text file generated locally.

Everyday uses

• Site owners — publish a vulnerability-disclosure policy in minutes.
• Freelancers — add security.txt to every client site as a professionalism signal.
• Startups — look serious to enterprise buyers who check for disclosure policies.
• Bug-bounty hosts — point researchers at your policy, scope, and PGP key.

Frequently asked questions

Where do I put the security.txt file?

In your site’s /.well-known/ folder (https://yoursite.com/.well-known/security.txt). The legacy root location also works but .well-known is the standard.

Why does the expiry date matter?

RFC 9116 says readers should treat an expired file as stale. Set a reminder to refresh it yearly — the “+1 year” button makes that easy.

Is anything uploaded?

No. Validation, preview, and the download all happen locally in your browser.