Your files stay on your device

# Security.txt checker

Paste a security.txt and get RFC 9116 validation: required contacts, expiry parsing, duplicate singletons and canonical consistency.

Paste a security.txt to check it.

This check validates the pasted text against RFC 9116: required Contact and Expires, the expiry timestamp, singleton fields, URI shapes, and Canonical against the origin you name. It does not fetch /.well-known/security.txt or verify where a site actually serves the file, which needs the network path this tool deliberately does not take; the location note in the report is exactly that, a note.
Options

## More web & auth tools

- [robots.txt tester](/web/robots)
- [HTTP header parser](/web/headers)
[All web & auth tools](/web)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/web/security-txt-checker
Markdown version: https://nutter.tools/web/security-txt-checker.md
Plain-text version: https://nutter.tools/web/security-txt-checker.txt
Agent index: https://nutter.tools/llms.txt