# security.txt Generator & Checker

A security.txt file tells security researchers where to report a vulnerability. Fill in Contact and Expires to get a file that follows RFC 9116, or paste an existing file to see line-numbered problems.

- URL: https://tools.itlibra.com/en/security-txt-tool
- On-device・No upload
- Last updated: 2026-10-26

## How to use

1. In “Build”, enter Contact and Expires. “Fill in one year from now” sets Expires for you.
2. Add Encryption, Policy, Acknowledgments, Preferred-Languages, Canonical or Hiring if needed. Empty fields are left out of the output.
3. Check the output and the findings, then copy it or use “Save security.txt”.
4. Serve the file at https://your-domain/.well-known/security.txt.
5. To check a file you already have, switch to “Check” and paste it or open the file.

## Use cases

- Publish a security.txt for the first time so researchers can report issues
- Check before renewing the Expires date that the file has not expired
- See whether an existing file meets the required fields of RFC 9116
- Check the format of a PGP-signed security.txt

## What it does

### Written in RFC 9116 form

Contact and Expires (required), plus Encryption, Acknowledgments, Preferred-Languages, Canonical, Policy and Hiring, in the RFC order. Empty fields are not written.

### Line-numbered checks

Flags missing required fields, an Expires that is past, malformed or repeated, non-https URIs, repeated language tags and unregistered field names.

### Expiry and location

Warns when Expires is more than a year ahead. With a location, checks https, the /.well-known/security.txt path and whether Canonical matches.

### PGP signature detection

A signed file is checked on its signed text. The tool says plainly that it does not verify the signature.


## Supported formats

### Input

- security.txt as text (pasted or a .txt file, up to 256 KB)

### Output

- security.txt (.txt, UTF-8)


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| Write a security.txt with all RFC 9116 fields | Supported | — |
| Check required fields, dates and URIs with line numbers | Supported | — |
| Detect a PGP-signed file | Supported | The signature is not verified |
| Fetch the file from its published URL and check it | Not supported | Paste the contents or open the file |
| Check the location format, https and Canonical match | Partial | The URL is not visited |
| Verify the PGP signature or the TLS certificate | Not supported | — |

## Limits & notes

- The tool does not visit your site. It cannot confirm that the file is served, the TLS certificate or the signature.
- Text to check is limited to 256 KB.
- The one-year guide is 365 days. RFC 9116 recommends (SHOULD) no more than a year ahead.
- Unregistered field names are reported as warnings; other extensions are not checked.

## Privacy & safety

Your input is processed only in your browser. Nothing is sent to or stored on a server.

## FAQ

### Where should security.txt be placed?

At https://your-domain/.well-known/security.txt, served over https (RFC 9116). /security.txt also works, but /.well-known/ is the primary location.

### When should Expires be set?

RFC 9116 recommends no more than a year ahead. An expired file is treated as invalid, so renew it before the date.

### What can Contact contain?

A mailto: address, an https: page or a tel: number. At least one is required.

### Must the file be PGP-signed?

No. A signed file is detected and checked, but this tool does not verify the signature itself.

### How is this different from robots.txt?

robots.txt controls which crawlers may fetch pages. security.txt tells researchers where to report vulnerabilities.