Skip to content
Free tool

security.txt generator

A security.txt file tells people who find a security problem in your website how to reach you. Check the file your domain publishes today, then fill in the form to create or renew one: the file is written in your browser and checked against RFC 9116. Only a domain you ask us to check is sent to our server, and it is not stored.

Check your current file

We read /.well-known/security.txt on your domain the way a researcher would and check it against RFC 9116. The address is not stored.

Your details

The website the file will be served from, such as example.com. Add www.example.com too if it is a separate site, separated by a space.

One per line, preferred first: an email address, a phone number with the country code (+237...), or an https page.

RFC 9116 recommends less than a year. Set a reminder to renew the file before this date.

Languages you read reports in

One per line: an https link to your public key, or openpgp4fpr: followed by its fingerprint.

An https page that thanks the people who reported problems.

An https page that explains how you handle reports.

An https page listing security jobs.