Build abuse reports for registrars, hosting providers and CDNs, as an email and as JSON.
New
security.txt Generator
Runs locally
Use security.txt Generator
What it does
Build a security.txt file so that researchers and people reporting phishing that imitates your brand know how to reach you. Save the result as /.well-known/security.txt.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Minimal file
mailto:security@example.comContact: mailto:security@example.com
Expires: 2027-10-20T23:59:59.000Z
Preferred-Languages: enProduces Contact: mailto:security@example.com, an Expires line one year ahead at 23:59:59Z and Preferred-Languages: en, the two required fields plus a language hint.
FAQ
Which fields are required?
RFC 9116 requires at least one Contact and exactly one Expires field; the rest are optional. Contact must be a URI such as mailto:security@example.com, https://example.com/report or a tel: number, and the generator copies what you type without checking it.
What should I set Expires to?
The date defaults to one year from today, while RFC 9116 recommends less than a year, so pick an earlier date to follow it. Renew the file before that date, because the RFC says an expired security.txt should be treated as stale.
Does it upload or sign anything?
No. The file is assembled in your browser and nothing is sent anywhere. It is not signed; RFC 9116 recommends an OpenPGP cleartext signature, which you can add with gpg --clearsign before publishing.