← All Tools
Security Txt Generator🔒 100% local
Generate security.txt. Privacy-first, no server uploads, no tracking.
Security Txt Generator: related tools
Builds a security.txt file in the RFC 9116 layout: a Contact line taken from whatever you paste, an Expires stamp, a Preferred-Languages line, a Canonical URL and a block of plain-language instructions for a reporter. Only the contact value is read from your input; everything else is fixed text generated in the page.
Security.txt Generator: how to use it
- Paste a line starting with 'contact:' followed by the address, for example 'contact: mailto:security@example.com'.
- Press Process. The output box shows the full file with a 90-day expiry.
- Copy the text and serve it at /.well-known/security.txt on your domain.
Security.txt Generator: worked example
contact: mailto:security@example.combecomes# SECURITY.TXT - security.txt RFC 9116
Contact: mailto:security@example.com
Expires: 2026-12-26T23:59:00.000+00:00
Preferred-Languages: en
Canonical: https://blank2done.com/.well-known/security.txt
# If you find a vulnerability:
# 1. Do not access or modify user data
# 2. Act in good faith
# 3. Give us 90 days to fix before disclosure
# 4. No payment or bounty - thanks for keeping users safeRun on 27 September 2026; the expiry is the current date plus 90 days, so it moves with the calendar. The page prints an em dash in the first and last comment lines.
Security.txt Generator: when to use it
- Standing up a security contact path for a small site and wanting a correctly shaped starting file.
- Reminding yourself of the field names RFC 9116 expects before writing one by hand.
- Producing a draft to edit, when the fixed fields and the expiry policy are acceptable.
Security.txt Generator: what it does not do
- The Canonical line is hardcoded to https://blank2done.com/.well-known/security.txt. It does not read your domain, so it must be edited before you publish the file.
- Only the first line beginning with 'contact:' is used, and if none is found the output falls back to mailto:security@example.com without warning.
- The Expires date is always today plus 90 days. There is no field for a policy URL, an encryption key, a bug-bounty page or multiple languages.
- Because the expiry is recomputed on every run, generating the file again in three months produces a different date; a stale file served from disk expires silently.