security.txt Generator
RFC 9116, including the Expires field that makes the file valid.
- Free
- No signup
- Nothing uploaded
- No watermark
Contact: mailto:security@example.com Preferred-Languages: en
How to Use the security.txt Generator Online
security.txt Generator writes the file that tells security researchers how to report a vulnerability in your site. You fill in a contact address or URL, an expiry date, and any of the optional fields: policy, encryption key, acknowledgments, hiring page, preferred languages and canonical URL. The output is ready to save as /.well-known/security.txt. Expires is required by the standard and left out by most hand-written files, which makes them invalid.
Generates an RFC 9116 security.txt, including the Expires field that makes it valid. Expires is mandatory and commonly omitted — a file without it is non-conformant, and researchers using automated tooling may simply skip you.
No software to install Free Works on any device
Step-by-Step Guide to Using the security.txt Generator
-
1. Fill in the fields — the file rewrites itself as you type
-
2. Anything the specification requires and you have missed is flagged above the output
-
3. Copy or download it, and put it where the page says it must live
What is the security.txt Generator?
Generates an RFC 9116 security.txt, including the Expires field that makes it valid. Expires is mandatory and commonly omitted — a file without it is non-conformant, and researchers using automated tooling may simply skip you.
At a glance
- Standard: RFC 9116
- Required fields: Contact (email or URL, one per line) and Expires
- Optional fields: Policy, Encryption, Acknowledgments, Hiring, Preferred-Languages, Canonical
- Gives: The finished text, ready to download as security.txt
- Goes at: https://yourdomain/.well-known/security.txt
- Runs: In the page; nothing is sent to a server
Why Secure Your PDFs?
A PDF can carry more than it shows, from hidden author details to text that was only covered with a black box. Password protection, true redaction and metadata removal make sure a shared file reveals only what you meant it to.
“Covering text is not the same as removing it.”
- Passwords on private files
- Author and software details cleared
- Hidden characters brought to light
- Documents never sent to a server
- Redacted text truly removed
- A signature without printing
- Look-alike letters flagged
- Access restored with the right password
Popular Uses for PDF Security Tools
These tools come out whenever a document holds something that should stay private.
- Salary slips and statements Add a password before emailing a payslip, bank statement or medical report.
- Redacting ID numbers Remove Aadhaar, PAN or account numbers from a copy before sharing it.
- Signing agreements Place your signature on a rental agreement or offer letter without printing it.
- Opening your own files Remove the password from a statement you open often, using the password you know.
- Clearing hidden details Strip author names and editing history from a PDF before it goes public.
- Spotting fake links Check a web address or name for look-alike letters used in phishing messages.
- Invisible characters Find zero-width characters hidden in copied text that break code or searches.
- Security contact files Create a security.txt so researchers know how to report problems with your site.
What You Can Do with the security.txt Generator
Understands TXT structure rather than treating the file as bytes
Generation happens on your own machine, at your machine's speed
The password is used where it is typed and never transmitted, which is the only way this is safe
Distinguishes real encryption from permission flags instead of presenting both as protection
Why Use ToolXkit for security.txt Generator?
Your files stay with you
Everything runs inside your browser. Nothing you open or type is uploaded to a server.
Free, with no catch
No signup, no watermark and no daily limit on how often you use it.
Fast
Results appear in seconds, because nothing has to travel over the internet and back.
Works on any device
Use it on a computer, tablet or phone, in Chrome, Edge, Firefox or Safari.
Nothing to install
No app, no extension and no desktop program. Open the page and start.
Made for real people
Plain words and clear buttons, built by one developer who wanted tools like this to exist.
Document Security for Different Users
HR teams
Protect payslips and offer letters, and redact personal details from shared records.
Lawyers
Redact names and case numbers properly before filing or sharing documents.
Finance staff
Lock statements and reports so only the right person can open them.
Freelancers
Sign contracts from a phone or laptop without a printer or scanner.
Website owners
Publish a security.txt file and check text for sneaky look-alike characters.
Anyone sharing ID proof
Hide numbers that are not needed before sending an ID copy to anyone.
Best Times to Protect a Document
Security tools matter most when you are:
- Emailing personal or salary details
- Sharing ID proof with a stranger
- Publishing a PDF on a website
- Signing an agreement remotely
- Removing a password you know
- Checking a suspicious link
- Handing over records for audit
- Cleaning text copied from the web
Tips and Good to Know
-
It writes the file; it does not upload it to your site. You still have to place it under /.well-known/ and serve it over HTTPS.
-
An expired file is treated as if it were missing, so put the expiry in your calendar and regenerate before then.
-
Signing the file with PGP is not done here. If you sign it, sign the exact text you download.
Frequently Asked Questions
Answers to common questions about this tool.
Do I need to install anything to use the security.txt Generator?
No. security.txt Generator runs entirely in your browser — there is nothing to download, no extension and no desktop program. It works the same on Windows, macOS, Linux, Android and iPhone.
Is it safe to use the security.txt Generator online?
Safer than the usual alternative, yes. Most online tools upload your file to a server you know nothing about, where it sits until someone deletes it. Here the file never leaves your device — the processing happens in the page itself, so there is no server copy to leak, retain or sell.
Can Unlock PDF open a file if I forgot the password?
No. It removes a password only when you type the correct one. It is meant for your own files that you open often, not for getting into documents you are not allowed to read.
Is security.txt Generator free?
Yes. Every security tool on the site is free, with no account, no trial and no limit on use. Nothing is added to your document apart from the change you asked for.
Does security.txt Generator send my files or text anywhere?
No. The work happens inside this browser tab, and nothing is uploaded. That is the whole point for sensitive papers: a redacted or protected file should not pass through a stranger’s server first.
Is a signature added here legally valid?
Sign PDF places an image of your signature on the page, much like signing a printout. Many everyday agreements accept this, but some official filings need a certified digital signature, so check what the other party requires.
Further reading
- RFC 9116: security.txt (IETF) The official standard for security.txt, the file that tells people how to report a security problem.
- Redaction (Wikipedia) What proper redaction means, with real cases where badly hidden text leaked out.
- IDN homograph attack (Wikipedia) How look-alike letters from other alphabets are used to fake web addresses.
More PDF Security Tools
Other free tools for the same kind of job.
- Protect PDF A password to open, plus print, copy and edit permissions, encrypted on your device. Open tool
- Sign PDF Sign, initial and date a PDF, on one page or every page. Open tool
- Unlock PDF Take the password off a PDF you own. Nothing is uploaded or stored. Open tool
- Homoglyph Detector Spot a Cyrillic а hiding in a domain name — the phishing you cannot read your way out of. Open tool
- Redact PDF Permanently remove sensitive text, not just cover it. Open tool
- Remove PDF Metadata Strip the author, title and keywords from both places a PDF stores them. Open tool
- Unicode Spoofing Checker Check text for letters from other alphabets that look Latin. Open tool
- Well-Known Security.txt Builder A vulnerability contact file that scanners will actually accept. Open tool
- Zero Width Character Detector Find invisible characters used for watermarking and filename spoofing. Open tool