/.well-known/* URI Reference
Searchable catalog of well-known URIs registered with IANA — security.txt, openid-configuration, acme-challenge and 30+ more, with RFCs.
/.well-known/security.txtStandardized location for security disclosure contact info and policy. Required: Contact, Expires.
/.well-known/openid-configurationOpenID Connect provider configuration document — authorization/token/userinfo endpoints, supported scopes, JWKS URI.
/.well-known/oauth-authorization-serverOAuth 2.0 Authorization Server Metadata. Like OIDC discovery but for plain OAuth 2.0 deployments.
/.well-known/oauth-protected-resourceOAuth 2.0 Protected Resource Metadata — tells clients which authorization server protects this API.
/.well-known/jwks.jsonJSON Web Key Set — public keys used to verify JWTs issued by this server.
/.well-known/webfingerDiscover information about people or entities at a domain via account URIs (acct:user@example.com).
/.well-known/host-metaSite-wide metadata document, predecessor to WebFinger. XRD format.
/.well-known/nostr.jsonNIP-05 verification — maps a name (user@example.com) to a Nostr public key.
/.well-known/change-passwordStandard URL browsers redirect to when users want to change their password (W3C draft).
/.well-known/apple-app-site-associationApple Universal Links + Handoff associations. JSON with applinks and webcredentials keys.
/.well-known/assetlinks.jsonAndroid Digital Asset Links — verifies app-to-website ownership for App Links.
/.well-known/acme-challenge/<token>ACME HTTP-01 challenge token — Let's Encrypt and other CAs use this to verify domain control.
/.well-known/mta-sts.txtMail Transfer Agent Strict Transport Security policy for inbound email.
/.well-known/dnt-policy.txtEFF Do Not Track policy declaration — predates the deprecated DNT browser header.
/.well-known/traffic-adviceTells private prefetch proxies (Chrome) the max throughput they should send.
/.well-known/ai.txtIndustry-proposed convention for declaring AI training opt-out preferences.
/.well-known/llms.txtProposed convention to give LLMs a curated, machine-friendly site overview.
/.well-known/privacy-policyConvention for a canonical privacy policy URL — not standardized but common.
/.well-known/datDat peer-to-peer hyperdrive discovery.
/.well-known/did.jsonDID Web method — resolves did:web:example.com to a DID document.
/.well-known/matrix/serverMatrix server-server federation discovery.
/.well-known/matrix/clientMatrix client-server homeserver discovery.
/.well-known/ashrae135BACnet building automation device discovery.
/.well-known/caldavCalDAV calendar server discovery (RFC 6764).
/.well-known/carddavCardDAV contacts server discovery (RFC 6764).
/.well-known/est/cacertsEnrollment over Secure Transport — CA certificate retrieval (RFC 7030).
/.well-known/gnap-as-rsGrant Negotiation and Authorization Protocol metadata.
/.well-known/included-in-set/<algorithm>Set inclusion proofs for transparency logs (RFC 9335).
/.well-known/jmapJSON Meta Application Protocol mail discovery (RFC 8620).
/.well-known/openpgpkey/hu/<localpart>OpenPGP Web Key Directory — discover PGP keys from email addresses.
/.well-known/payment-manifest.jsonW3C Payment Manifest — declares supported payment methods.
/.well-known/posh/<hostname>.jsonPKIX over Secure HTTP — TLS certificate publication (RFC 7711).
/.well-known/reload-configREsource LOcation And Discovery configuration (RFC 6940).
/.well-known/sipSIP service discovery (RFC 7095).
/.well-known/sipsSIPS service discovery (RFC 7095).
/.well-known/stunSTUN server discovery (RFC 7064).
/.well-known/turnTURN server discovery (RFC 7065).
/.well-known/timezoneiCalendar timezone service discovery (RFC 7808).
/.well-known/oauth-token-introspectionOAuth 2.0 token introspection endpoint (RFC 7662).
Sourced from IANA Well-Known URI registry + de facto industry conventions.
How to use
- Filter by category to narrow down (Security for
security.txt/ACME, Identity for OIDC/OAuth, Mobile for app deep links). - Search by path, RFC number, or description text. Copy the path with one click.
- Click through to the RFC/spec to get exact content requirements — most have specific JSON schemas or text formats.
About this tool
ShowHide
RFC 8615 defines /.well-known/ as the standard path for site metadata that needs a predictable location — discovery endpoints, security contacts, mobile app deep-link associations, ACME validation tokens, identity provider configurations. This reference lists the URIs registered with IANA (plus a few de facto industry standards), grouped by purpose: security, identity, mobile, web, mail, miscellaneous. Each entry links to the defining RFC or spec so you can read the exact requirements. Useful when setting up a new domain, debugging an OIDC discovery flow, or just trying to remember which path Apple's universal links go on.
Frequently asked questions
Do I have to register a /.well-known/ URI with IANA?
Yes if you're defining a new public protocol. The IANA Well-Known URI registry (https://www.iana.org/assignments/well-known-uris) tracks them to prevent collisions. For private/internal use within your own apps, you can use any subpath — but you risk conflicts if your URI later gets registered by someone else's protocol.
Should /.well-known/ paths be served over HTTPS only?
Mostly yes. security.txt requires HTTPS per RFC 9116. apple-app-site-association requires HTTPS (and used to require no redirects, though that was relaxed). OIDC discovery, OAuth metadata, and most identity-related endpoints require HTTPS. The few exceptions are legacy text files that predate ubiquitous TLS.
Why put these files at a fixed path instead of advertising them?
Because a fixed path can be checked without asking. A scanner, a browser or another server can look for one URL and either find the document or not, with no negotiation and no prior link — which is what makes automated discovery possible across sites that have never heard of each other. The cost is that the path is a namespace everyone shares, which is why registration exists.
What breaks these paths in practice?
A redirect and a wrong content type, mostly. Clients often refuse a well-known URL that redirects, and several of these documents must be served as JSON rather than as HTML, so a framework returning the site's 404 page with a 200 status looks like success and fails validation. A dot-prefixed directory is also the sort of thing static hosts and build tools quietly exclude — check the deployed URL, not the source tree.
Related tools
Relative URL Resolver (RFC 3986)
Resolve a relative reference against a base URI by RFC 3986, with the dot-segment trace and the browser’s answer beside it.
Network
Port Number Reference
Searchable cheat sheet for ~60 standard TCP / UDP port numbers — from 22 (SSH) and 80 (HTTP) to 6379 (Redis) and 27017 (MongoDB).
Network
PWA Manifest Builder
Build a valid manifest.json for a Progressive Web App — name, icons, theme color, display mode, scope — with the matching HTML <link> tags.
Developer
URI Template Expander (RFC 6570)
Expand RFC 6570 URI templates with your own variables — all four levels, with path, query, fragment and label operators and explode modifiers.
Network
TXT Record Splitter (255-Byte Chunks)
Split a long SPF, DKIM or DMARC TXT record into the 255-byte strings DNS requires, in BIND, generic zone-file, Cloudflare or Route 53 syntax.
Network
HTTP Headers Reference
Searchable reference for ~50 standard HTTP request, response, CORS, caching, security, and cookie headers.
Developer