Skip to content
TextArray1.41.0
100% local

security.txt validator

Check a security.txt file against RFC 9116 and list what is missing, invalid or deprecated.

Input
Output
Related tools
Robots.txt testernewDeveloper tools
Humans.txt generatorDeveloper tools
SPF and DMARC checkernewDeveloper tools
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
security.txt validator
Paste the contents of a security.txt file — the one meant to live at /.well-known/security.txt — and this tool checks it against RFC 9116, the standard that defines the format. It reports missing required fields, values that don't parse, and field names that are deprecated or unrecognized, each tied to the line it came from.
RFC 9116 requires at least one "Contact" line and exactly one "Expires" line; both are checked by default, along with the "Expires" date itself — it must be a full ISO 8601 timestamp with a timezone, and the tool warns when that date has already passed. Encryption, Policy, Hiring, Canonical and Acknowledgments are all supposed to hold a URI, so the tool flags a bare domain or email with no scheme. It also catches the deprecated British spelling "Acknowledgements" (RFC 9116 uses "Acknowledgments"), fields dropped from earlier drafts such as "Disclosure", field names typed in the wrong case, duplicate "Expires" or "Preferred-Languages" lines, and fields that fall out of the conventional reading order. Any of these checks can be turned off individually.
Switch the output between a line-by-line list of findings and a corrected file: the fixed version regroups recognized fields into the conventional order, drops duplicate singular fields down to the first occurrence, corrects deprecated field names, and keeps anything it doesn't recognize rather than deleting it. Lines with no valid "Field: value" shape are called out instead of guessed at, and a missing "Contact" or "Expires" is noted with a comment rather than invented outright.
Everything runs locally in your browser — the file you paste, which is often a real, unpublished security contact address, is never uploaded anywhere. Copy the result, download it as a .txt file ready to publish, or send it back into the input to check another revision.
FAQ
What does RFC 9116 actually require?
At minimum, one "Contact" field and exactly one "Expires" field with a valid RFC 3339 date-time. Everything else — Encryption, Canonical, Preferred-Languages, Acknowledgments, Hiring and Policy — is optional.
Why is my "Expires" date flagged as invalid?
RFC 9116 requires a full date-time with a timezone, like 2027-01-01T00:00:00Z. A bare date such as 2027-01-01, or a non-ISO format, doesn’t satisfy the spec even though it looks like a date.
What does "Corrected file" change?
It regroups recognized fields into the conventional reading order, keeps only the first occurrence of a field that must be singular (Expires, Preferred-Languages), and fixes the deprecated "Acknowledgements" spelling to "Acknowledgments". It never invents a Contact or Expires value that isn’t already in your file.
Does it fetch my live security.txt from my domain?
No. Paste the file contents yourself — the tool never makes a network request, so it can’t confirm what is actually published at /.well-known/security.txt on your site.
Is my security.txt file uploaded anywhere?
No. Validation runs entirely in your browser. Since this file often contains a genuine, not-yet-published security contact address, nothing you paste ever leaves your device.