Españolsecurity.txt generator (RFC 9116)
Fill in at least one contact and the expiry date. The file goes at /.well-known/security.txt, at the root of the domain.
How to useWhere to report a flaw on your site
Available in: 
security.txt generator (RFC 9116): what it is for
security.txt is a text file standardized by RFC 9116 (2022) that tells security researchers how to report a flaw to a site's owner. It lives at /.well-known/security.txt.
Fill in the contacts in order of preference (email, page or phone become mailto:, https: and tel: automatically) and the expiry date, the two required fields. The optional fields (Policy, Acknowledgments, Encryption, Hiring, Canonical and Preferred-Languages) are added when filled in, and the tool warns you if the expiry date has passed or is more than a year away, the recommended maximum.
How to use
- Enter the contacts and the expiry date.
- Fill in any optional fields you have.
- Download and publish at /.well-known/security.txt.
When to use it
- Business websites and online stores.
- Public systems and APIs.
- Vulnerability disclosure programs.
Frequently asked questions
What is security.txt for?
It's a standardized text file (RFC 9116, from 2022) that tells security researchers how to report a flaw on your site to you. Without it, people who find a problem often don't know whom to write to and give up.
Which fields are required?
Two: Contact, with at least one contact method (mailto:, https: or tel:), and Expires, the date the file stops being valid. Contacts are read in order; the first is the preferred one.
Why does the file expire?
So nobody relies on an abandoned contact. The recommendation is a date less than a year ahead; when it gets close, update the file with a new expiry date.
Is it really free?
Yes, 100% free. No sign-up, no subscription and no usage limits. All Tools123 tools are free and run right in your browser.