← All Tools
Security Txt Generator🔒 100% local
Generate security.txt. Privacy-first, no server uploads, no tracking.
Related Tools
Builds a security.txt file in the RFC 9116 layout: a Contact line taken from whatever you paste, an Expires stamp, a Preferred-Languages line, a Canonical URL and a block of plain-language instructions for a reporter. Only the contact value is read from your input; everything else is fixed text generated in the page.
How to use it
- Paste a line starting with 'contact:' followed by the address, for example 'contact: mailto:[email protected]'.
- Press Process. The output box shows the full file with a 90-day expiry.
- Copy the text and serve it at /.well-known/security.txt on your domain.
Worked example
contact: mailto:[email protected]becomes# SECURITY.TXT - security.txt RFC 9116
Contact: mailto:[email protected]
Expires: 2026-12-26T23:59:00.000+00:00
Preferred-Languages: en
Canonical: https://blank2done.com/.well-known/security.txt
# If you find a vulnerability:
# 1. Do not access or modify user data
# 2. Act in good faith
# 3. Give us 90 days to fix before disclosure
# 4. No payment or bounty - thanks for keeping users safeRun on 27 September 2026; the expiry is the current date plus 90 days, so it moves with the calendar. The page prints an em dash in the first and last comment lines.
When to use it
- Standing up a security contact path for a small site and wanting a correctly shaped starting file.
- Reminding yourself of the field names RFC 9116 expects before writing one by hand.
- Producing a draft to edit, when the fixed fields and the expiry policy are acceptable.
What it does not do
- The Canonical line is hardcoded to https://blank2done.com/.well-known/security.txt. It does not read your domain, so it must be edited before you publish the file.
- Only the first line beginning with 'contact:' is used, and if none is found the output falls back to mailto:[email protected] without warning.
- The Expires date is always today plus 90 days. There is no field for a policy URL, an encryption key, a bug-bounty page or multiple languages.
- Because the expiry is recomputed on every run, generating the file again in three months produces a different date; a stale file served from disk expires silently.