security.txt Validator

Validate your security.txt

A security.txt file tells security researchers how to report vulnerabilities in your site, and it must follow a defined format to be useful. This validator checks your security.txt for the required fields, correct formatting and best practices.

Why security.txt matters

When a researcher finds a vulnerability in your site, they need a way to tell you, and without a clear channel the report often never reaches the right person, or the researcher gives up. A security.txt file at a standard location provides that channel, listing a contact and related details in a machine-readable format. To work it must be correctly formatted, with the required fields present and valid. Validating it ensures a researcher’s tools and eyes can actually read it, which is the difference between an open door for responsible disclosure and a broken one.

An open door for disclosure

The tool runs entirely in your browser, so nothing you paste is uploaded, which is exactly what you want when the input is your own security-sensitive data.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.