日本語English

security.txt Generator & Checker

A security.txt file tells security researchers where to report a vulnerability. Fill in Contact and Expires to get a file that follows RFC 9116, or paste an existing file to see line-numbered problems.

On-device・No uploadMobile friendlyWorks offline

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

If given, the https, location and Canonical checks use it.

Build

Required. Start each with mailto:, https: or tel:.

RFC 3339 date-time with a time zone, e.g. 2027-12-31T23:59:00Z. Required, exactly once.

Comma-separated language tags, e.g. ja, en.

Optional. If you give one, use an https: URI.

Output

Serve this at https://your-domain/.well-known/security.txt as UTF-8 text.

Location: /.well-known/security.txt (served over https)

  • Your input is processed only in your browser. It is not sent or stored.
  • SHOULD and MAY in RFC 9116 are shown as warnings; MUST is shown as an error.

How to use

  1. In “Build”, enter Contact and Expires. “Fill in one year from now” sets Expires for you.

  2. Add Encryption, Policy, Acknowledgments, Preferred-Languages, Canonical or Hiring if needed. Empty fields are left out of the output.

  3. Check the output and the findings, then copy it or use “Save security.txt”.

  4. Serve the file at https://your-domain/.well-known/security.txt.

  5. To check a file you already have, switch to “Check” and paste it or open the file.

What it does

Written in RFC 9116 form

Contact and Expires (required), plus Encryption, Acknowledgments, Preferred-Languages, Canonical, Policy and Hiring, in the RFC order. Empty fields are not written.

Line-numbered checks

Flags missing required fields, an Expires that is past, malformed or repeated, non-https URIs, repeated language tags and unregistered field names.

Expiry and location

Warns when Expires is more than a year ahead. With a location, checks https, the /.well-known/security.txt path and whether Canonical matches.

PGP signature detection

A signed file is checked on its signed text. The tool says plainly that it does not verify the signature.

Use cases

  • Publish a security.txt for the first time so researchers can report issues
  • Check before renewing the Expires date that the file has not expired
  • See whether an existing file meets the required fields of RFC 9116
  • Check the format of a PGP-signed security.txt

Supported formats

Input

security.txt as text (pasted or a .txt file, up to 256 KB)

Output

security.txt (.txt, UTF-8)

Capability matrix

FeatureSupportNotes
Write a security.txt with all RFC 9116 fieldsSupported—
Check required fields, dates and URIs with line numbersSupported—
Detect a PGP-signed fileSupportedThe signature is not verified
Fetch the file from its published URL and check itNot supportedPaste the contents or open the file
Check the location format, https and Canonical matchPartialThe URL is not visited
Verify the PGP signature or the TLS certificateNot supported—

Limits & notes

  • The tool does not visit your site. It cannot confirm that the file is served, the TLS certificate or the signature.
  • Text to check is limited to 256 KB.
  • The one-year guide is 365 days. RFC 9116 recommends (SHOULD) no more than a year ahead.
  • Unregistered field names are reported as warnings; other extensions are not checked.

Privacy & safety

Your input is processed only in your browser. Nothing is sent to or stored on a server.

FAQ

Where should security.txt be placed?
At https://your-domain/.well-known/security.txt, served over https (RFC 9116). /security.txt also works, but /.well-known/ is the primary location.
When should Expires be set?
RFC 9116 recommends no more than a year ahead. An expired file is treated as invalid, so renew it before the date.
What can Contact contain?
A mailto: address, an https: page or a tel: number. At least one is required.
Must the file be PGP-signed?
No. A signed file is detected and checked, but this tool does not verify the signature itself.
How is this different from robots.txt?
robots.txt controls which crawlers may fetch pages. security.txt tells researchers where to report vulnerabilities.

robots.txt Tester

Paste a robots.txt to see instantly whether a URL is allowed or blocked for Googlebot or AI crawlers, and which line decided it. Misspellings and directives Google ignores are flagged too.

No upload

CSP Studio

Paste a Content-Security-Policy header or meta tag to see unsafe-inline, unsafe-eval, wildcards and missing object-src or base-uri, ranked high, medium or low, with a suggested policy. Generation and hash calculation are included.

No upload

XML Sitemap Generator & Validator

Paste a list of URLs to create a correctly written sitemap.xml, or paste an existing sitemap to find the errors that stop Google from reading it — with line numbers.

No upload

SRI Hash Generator

Drop a JavaScript or CSS file to get the integrity value (sha384-…) and a ready-to-use script or link tag. Paste an existing integrity value to check whether it matches the file.

No upload

HTML Inspector

Paste a page’s HTML to review SEO and accessibility basics at a glance: heading structure, meta tags, Open Graph, image alt text, links and structured data — with a preview of how it may look in search and on social media.

No upload

Structured Data / JSON-LD Studio

Build JSON-LD for 13 common types with forms that separate required from recommended fields, then copy it. Paste JSON-LD or HTML to extract every script, @graph and array and see problems from the exact line of a syntax error to missing Google rich result requirements. It is not Google’s official tool.

No upload

Last updated: