Loading…
Home / Tools / Pentest scope generator
Free pentest scope & authorization generator
Fill in the client, the authorizing signer, the in-scope and out-of-scope assets, the testing window and the prohibited actions, and download a ready-to-send scope and authorization document as .docx or .pdf. No account, and nothing you type leaves your browser.
Fill in the scope
Everything is optional. Anything you leave blank stays as a fill-in line in the document, so you can print it and complete it by hand. Nothing is uploaded or stored — the document is built in your browser.
Live preview
This is exactly what the downloaded document contains.
Penetration Testing Scope & Authorization This document records the scope and authorization for a penetration test. It states what may be tested, what may not, when testing may run, and who has authorized it. It is not a substitute for a signed contract; it is the record of permission the tester relies on. Client / asset owner: ____ Authorizing signer: ____ Tester / testing organisation: ____ Authorization effective from: ____ Authorization expires: ____ 1. AUTHORIZATION The signer named above confirms that they are authorized to permit security testing of the systems listed as in scope, and that they grant permission for the tester to perform that testing within the terms of this document. 2. SCOPE (IN SCOPE) The following assets are in scope. Nothing else is. ____ 3. OUT OF SCOPE The following are explicitly out of scope, in addition to any asset not listed as in scope. ____ 4. TESTING WINDOW ____ 5. PROHIBITED ACTIONS ____ 6. CONTACTS AND REPORTING Emergency contact: ____ Report recipients: ____ 7. SIGN-OFF Authorizing signer: ____ Name / title / date Tester acknowledgement: ____ Name / title / date
How the scope document works
What the document records
It ties a named signer to a named set of assets and a window of time. Those four facts — who authorised it, what may be tested, when testing may run, and what is forbidden — are the minimum a tester needs to be able to point at if the testing is ever questioned. The generator collects them as fields and renders them as a structured document with an authorization statement, scope, out-of-scope list, testing window, prohibited actions, contacts and a sign-off block.
Why the scope has to be exact
A scope is a list of what is permitted, so an ambiguous entry is not a permission — it is an argument waiting to happen. Write hostnames and IP ranges exactly, and state third-party systems and anything not explicitly listed as out of scope. The generator adds that catch-all line for you, because "the tester found a connected service and assumed it was fair game" is one of the most common ways an engagement goes wrong.
Why nothing is uploaded
An asset inventory is a map of what you would attack. Sending it to a third-party form to produce a document is an unnecessary disclosure, so this tool does not: the .docx and .pdf are assembled from your input in the browser using dependency-free writers, with no fetch, no storage and no analytics. Turn off your network after the page loads and it still works.
Where this fits in an engagement
The authorization document is the permission; a rules of engagement document is the plan for how the permitted testing runs. Issue both, cross-reference them by date, and store them with the final report so the whole engagement is one traceable record. The generated document is not a contract and does not replace legal review — it is the operational record of permission that the tester relies on.
Pentest scope and authorization FAQ
- What is a pentest scope and authorization document?
- It is the record of permission for a penetration test. It names the person authorising the test, the exact assets in scope, the assets explicitly out of scope, the window during which testing may run, the actions that are prohibited, and the contacts for escalation. A tester relies on it to show that testing was authorised; an organisation relies on it to limit what may be tested.
- Do I need a signed authorization letter before testing starts?
- Yes. Testing of systems you do not own without documented, current authorisation from someone entitled to give it is unauthorised access, regardless of intent. The document this tool generates captures that authorisation's scope and window; get it reviewed and signed before any test traffic is sent.
- Does this generator store or transmit the information I enter?
- No. The form is a client-side component: nothing is sent to a server, saved to a database or reported to analytics. The .docx and .pdf files are generated in your browser, so your asset list never leaves your machine.
- What should go in the out-of-scope list?
- Every asset that a reasonable tester might otherwise reach and that must not be touched — production billing, third-party or SaaS systems you do not own, employee devices, and anything not explicitly listed as in scope. Being generous here costs nothing and prevents the most common scope dispute.
- How is this different from the free rules of engagement template?
- The authorization document records whether testing is permitted and against what. The rules of engagement document records how the permitted testing will be conducted — rate limits, escalation, emergency stop, evidence handling and retest. Most engagements use both, cross-referenced by date.
Related templates and reading
- Rules of engagement (ROE) template — the plan for how the permitted testing is run, to issue alongside this authorization.
- Penetration test authorization letter template — a letter-format version of the same permission, when a shorter document is required.
- Pentest scope and authorization: what belongs in the document — the fields a reviewer will look for, and the clauses teams most often omit.
PentSeal enforces the scope instead of filing it
The document above is a promise a tester is trusted to keep. PentSeal makes the same scope and window a hard gate on execution: it verifies target ownership, records the signed scope and testing window, and will not run a scan outside them — with a scope and authorization workflow built into the product rather than a PDF on a shared drive.