日本語English

SBOM Viewer and Compare (SBOM Studio)

Paste a CycloneDX or SPDX SBOM, as JSON or SPDX tag-value, to list each component with its name, version, purl, license, supplier and hash, and draw the dependency relationships as a tree. It flags components with no purl or license, the same component at more than one version, and NOASSERTION licenses. Compare an old and a new SBOM to see what was added, removed, or changed in version or license. No vulnerability database is queried; only the vulnerabilities written in the SBOM are listed.

On-device・No uploadMobile friendlyWorks offline

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

The SBOM is read only inside your browser. It is not sent to a server or saved. No vulnerability database is queried (no network requests). Vulnerabilities shown are only those written in the SBOM.

Drop an SBOM file

or

One JSON or SPDX tag-value text file (up to 20 MB). Contents are not sent anywhere.Paste (Ctrl+V) also works
Paste an SBOM or drop a file to see the component list.

How to use

  1. sbom.cdx.json

    Paste the SBOM

  2. Componentsname, version, purl

    Components and tree

  3. Added / removed / versioncompared with the old SBOM

    Changes from old

Paste an SBOM, check the components and dependencies, then compare it with an older one

  1. Paste a CycloneDX 1.4 to 1.6 or SPDX 2.2 or 2.3 SBOM (JSON or SPDX tag-value), or drop a file (“Choose file” works too). “Try a sample” shows how it works.

  2. In “Components”, check the name, version, purl, license, supplier and hash. You can search and sort, and save the current rows as CSV.

  3. In “Dependency tree”, follow which components each one depends on, from the root down. Cycles and depth limits are shown as “not expanded”.

  4. In “Issues”, see components with no purl, version or license, the same component at several versions, and NOASSERTION. “Vulnerabilities” lists only what the SBOM says.

  5. In “Compare”, paste an older SBOM to list what was added, removed, changed in version, or changed in license.

What it does

Both CycloneDX and SPDX

Reads CycloneDX 1.4, 1.5 and 1.6 JSON, and SPDX 2.2 and 2.3 in JSON and tag-value. An unsupported version stops with the version named.

Dependencies as a tree

Builds a tree from the root down, using CycloneDX dependencies and SPDX relationships such as DEPENDS_ON, CONTAINS and DESCRIBES. A cycle is shown once.

Old and new comparison

Pairs components by purl (without the version) or by name, then lists additions, removals, version changes and license changes.

Findings only where the SBOM shows a gap

Flags missing purl, version or license, the same component at several versions, and NOASSERTION. Each finding comes from what the SBOM itself says.

CSV export

Saves the components on screen (with search and sort applied) as CSV. Leading formula characters are escaped so spreadsheets do not run them.

Use cases

  • Check whether a received SBOM is CycloneDX or SPDX, and which version it is
  • List each component with its license and supplier for an audit or internal review
  • Compare this release’s SBOM with the last one to see new or changed components
  • Find the same library at two versions, or components whose license is NOASSERTION

Capability matrix

FeatureSupportNotes
Reading components, dependencies and vulnerabilities from CycloneDX 1.4, 1.5 and 1.6 (JSON)Supported—
Reading components and relationships from SPDX 2.2 and 2.3 (JSON and tag-value)SupportedTag-value reads the main fields only.
Old and new comparison (additions, removals, versions, licenses)Supported—
Checking against a vulnerability databaseNot supportedNo network requests. Only the vulnerabilities written in the SBOM are listed.
Verifying signatures or generating an SBOMNot supportedReads an SBOM only; it does not create one or verify a signature.
Reading lock files such as package-lock.jsonNot supportedFor lock files, use dependency_viewer.
Every SPDX field (file-level data, annotations and so on)PartialReads only the fields used for packages and relationships.

Limits & notes

  • Up to 20 MB of input and 50,000 components are read. Anything beyond is not read, and you are told.
  • The tree shows up to 2,000 items and 12 levels deep. Parts beyond that are marked “not expanded”.
  • No vulnerability database is queried. The vulnerability list contains only what the SBOM states.
  • License meaning (permissions and compatibility) is not judged. License strings are shown as written.

Privacy & safety

A pasted SBOM is read only inside your browser. It is not sent to or stored on a server, and nothing is saved in the browser. Usage analytics never include content or file names.

FAQ

How do I tell whether an SBOM is CycloneDX or SPDX?
If the top-level bomFormat is CycloneDX, it is CycloneDX. If there is a spdxVersion field, it is SPDX. An SPDX tag-value file begins with SPDXVersion:. Anything else is reported as unknown.
How is this different from dependency_viewer?
dependency_viewer reads dependencies from lock files such as package-lock.json. This tool reads an SBOM (CycloneDX or SPDX) that a build or another tool has already produced.
Is NOASSERTION the same as having no license?
No. NOASSERTION means the author did not state the license. It is reported separately from NONE or an empty license.
Can I check vulnerabilities against current data here?
No. The tool does not query a vulnerability database, so it lists only the entries written in the SBOM. Check current data with a vulnerability service.
If there are no issues, is the software safe?
No. The checks cover only gaps and duplicates in how the SBOM is written (purl, version, license). They do not assess the safety of the components.

Lockfile Diff & Dependency Tree

Compare two lockfiles to see which packages were added, removed or upgraded. You can also see why a package is installed and where several versions of one package come from. Nothing leaves your browser.

No upload

JSON Studio — Formatter & Validator

Paste JSON to format, minify or validate it instantly. Errors are shown with the exact line, column and cause, and comments or trailing commas can be auto-repaired. Your data never leaves your device.

No upload

Secret Scanner

Paste text or drop config and code files to list likely secrets with file, line and rule before you publish or share them. Values are masked by default and you can save a copy with them replaced by ***. A helper only — it cannot guarantee that nothing is missed.

No upload

OSS License Report and NOTICE Draft (OSS License Report)

Paste a package-lock.json, a CycloneDX or SPDX SBOM, or a name,version,license CSV. The tool counts licenses by kind with a guide classification, and lists items to review such as GPL or AGPL family licenses and packages with no license. It can also draft a THIRD-PARTY-NOTICES file, without the full license texts. The classification is a guide, not legal advice.

No upload

Docker Compose Studio

Convert docker run commands to compose.yaml, or compose.yaml back to docker run. A compose file is checked for syntax, the Compose Specification and common mistakes, and security points worth confirming are listed. Nothing is started or pulled, and your input never leaves your device.

No upload

Dockerfile Studio

Paste a Dockerfile to check its syntax, stages and common mistakes. Secret-looking values and points to confirm, such as curl | sh, are listed with line numbers. You can also format it or generate starter files for Node.js, Python, Go, a static site or Java. Nothing is built, and your input never leaves your device.

No upload

Last updated: