Web Security

security.txt Validator

Checks a security.txt against RFC 9116 - mandatory Contact and Expires, plus the recommended fields.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste the full contents of the security.txt file.
  2. Select Validate file.
  3. Check the mandatory Contact and Expires first - a past Expires date is the most common real problem.
  4. Add the recommended fields the report lists as absent if they apply to you.

What security.txt validator does

A security.txt file tells a researcher who found a flaw where to send it. RFC 9116 makes two fields mandatory - Contact and Expires - and an expired file is arguably worse than none, because it points at a channel nobody is watching any more. The rest of the fields are recommendations that make the file more useful and more trustworthy.

Paste the contents of a security.txt and this checks the mandatory fields are present, parses the Expires date and tells you whether it has already passed, and lists which recommended fields - Encryption, Canonical, Policy and the others - are set. It runs entirely in your browser - nothing you paste is sent anywhere, and this tool does not contact, scan or attack any website. Only review systems you own or are authorised to assess.

Frequently asked questions

Contact and Expires. RFC 9116 made Expires mandatory so a file can signal that it is still current. The other fields - Encryption, Canonical, Policy and so on - are recommended, and the tool lists which are present.

An expired security.txt points a researcher at a contact channel that may no longer be watched. That is arguably worse than having no file, because it looks like an invitation to report and may go nowhere. Renew the file before Expires passes.

RFC 9116 recommends serving it as a clear-signed PGP document so a reader can confirm it was not altered or planted. It is not mandatory, and the tool notes when a file is unsigned rather than failing it.