// TOOLS

Security Tools

🤖 robots.txt / security.txt Analyzer

Paste a robots.txt or a security.txt. From robots it extracts user-agents, rules and sitemaps, and flags the sensitive paths it reveals (recon), recalling that it is not access control. From security.txt (RFC 9116) it validates Contact/Expires, warns if expired and highlights what is missing. In your browser.

Frequently asked questions

Does robots.txt protect my secret paths?

No, quite the opposite. robots.txt is a HINT for search engines, not access control: anyone can read it, and an attacker checks it precisely to discover paths (that is why this tool flags "sensitive paths"). Never put paths you want to hide there; protect them with authentication.

What does it check in security.txt?

It follows RFC 9116: it requires Contact and Expires (and warns if Expires is in the past, in which case the file is invalid), and recommends Canonical, Encryption and a PGP signature. security.txt must be published at /.well-known/security.txt.

Is the content uploaded anywhere?

No. The analysis runs in your browser with JavaScript; the text never leaves your machine.