CyberNew

security.txt Generator

Create an RFC 9116 security.txt so researchers know how to report issues to you. Runs entirely in your browser, nothing is stored.

How this works

Builds an RFC 9116 security.txt in your browser so researchers know how to report vulnerabilities to you.

What we never see

Your contact details. They stay in this tab until you download the file.

Contact (required, one per line)

Email, https:// form or tel: number.

Expires (required)

RFC 9116 recommends less than a year ahead. Set a reminder to renew.

Encryption (PGP key URL)

Acknowledgments (hall of fame URL)

Preferred-Languages

Canonical

Policy (disclosure policy URL)

Hiring (optional)

Contact: mailto:security@example.pk
Preferred-Languages: en, ur
Canonical: https://example.pk/.well-known/security.txt

Upload to https://yourdomain/.well-known/security.txt and serve it as text/plain over HTTPS.

Need more than a free tool?

Qawex builds, secures and grows websites and systems. Talk to a person.

Related tools

Strong random passwords with a strength meter. Generated on your device, never sent anywhere.

SHA-1, SHA-256, SHA-384 and SHA-512 hashes, computed in your browser.

Read a token's header, payload and expiry. Decode only, nothing leaves your browser.

Check a password against billions of leaked ones. Only a 5-character fingerprint prefix is ever sent.