security.txt generator

A valid RFC 9116 file, so a researcher who finds something in your estate at 11pm knows where to send it instead of guessing at info@ or posting it publicly. Takes two minutes and removes an entire category of avoidable mess.

Everything you type stays in this tab. Share copies a link, never your inputs, unless the tool says it encodes them in the URL.

Your domain

Contact

Expires in

Preferred languages

Policy URL

Acknowledgements URL

Hiring URL

Encryption key URL

Canonical URL

Filled from the domain. The file must be served at this exact address over HTTPS.

Where it goes: https://your-domain/.well-known/security.txt, served as text/plain. A copy at the site root is allowed for legacy readers but the well-known path is the one that counts. Sign it with PGP if you publish a key.