Security.txt Generator
Create an RFC 9116 security.txt so researchers know how to report vulnerabilities — built in your browser
About this tool
Generate an RFC 9116 security.txt with Contact, Expires, Encryption, Acknowledgments, Policy and more so researchers know how to report vulnerabilities to you Security.txt Generator runs in the browser on DevTools. There is no signup, and your input stays on this device unless the tool explicitly performs a live network lookup.
What this tool does not do
- Security.txt Generator is a free in-browser utility, not a hosted API. It does not keep server-side history and is not a substitute for production verification in your own stack.
How do I use this tool?
How do I use Security.txt Generator?
Open Security.txt Generator, enter or paste your input, and copy the result. The page works without an account.
Related guides
security.txt: Tell Researchers How to Report Vulnerabilities
What the RFC 9116 security.txt file is, the required and optional fields, where to host it, and why every production site should have one.
Four Files Every Production Website Should Have
robots.txt, sitemap.xml, security.txt, and the web app manifest — the small root-level files that improve crawling, security, and installability.
The Legal and Trust Pages Every Web App Should Ship
A practical checklist of the legal, privacy, and security pages users and regulators expect — and how to generate each one.
The /.well-known/ Directory: What It Is and What Goes There
A single reserved path holds a surprising amount of a site's machine-readable metadata — from security contacts to certificate validation. Here's the tour.
Related tools
AES Encryption
Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.
Basic Auth Generator
Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.
Bcrypt Generator & Verifier
Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.
BIP39 Mnemonic Generator
Generate and validate BIP39 seed phrases locally for testing
Checksum Calculator
Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API
Client-Side File Encryptor
Encrypt any file with AES-256-GCM and PBKDF2 directly in your browser — no uploads, no accounts, wrong passwords fail loudly.