# security.txt Generator

URL: https://phishdestroy.io/developer-tools/security-txt-generator
Category: Reporting & IOC
Where it runs: Runs locally (nothing you enter is uploaded)

Build a security.txt file so that researchers and people reporting phishing that imitates your brand know how to reach you. Save the result as /.well-known/security.txt.

## Example input

Minimal file

```
mailto:security@example.com
```

Produces Contact: mailto:security@example.com, an Expires line one year ahead at 23:59:59Z and Preferred-Languages: en, the two required fields plus a language hint.

## FAQ

### Which fields are required?

RFC 9116 requires at least one Contact and exactly one Expires field; the rest are optional. Contact must be a URI such as mailto:security@example.com, https://example.com/report or a tel: number, and the generator copies what you type without checking it.

### What should I set Expires to?

The date defaults to one year from today, while RFC 9116 recommends less than a year, so pick an earlier date to follow it. Renew the file before that date, because the RFC says an expired security.txt should be treated as stale.

### Does it upload or sign anything?

No. The file is assembled in your browser and nothing is sent anywhere. It is not signed; RFC 9116 recommends an OpenPGP cleartext signature, which you can add with gpg --clearsign before publishing.

## Related tools

- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [robots.txt Generator](https://phishdestroy.io/developer-tools/robots-txt-generator)
- [llms.txt Generator](https://phishdestroy.io/developer-tools/llms-txt-generator)
- [CSP Header Builder](https://phishdestroy.io/developer-tools/csp-header-builder)

All tools: https://phishdestroy.io/developer-tools