# SBOM Viewer and Compare (SBOM Studio)

Paste a CycloneDX or SPDX SBOM, as JSON or SPDX tag-value, to list each component with its name, version, purl, license, supplier and hash, and draw the dependency relationships as a tree. It flags components with no purl or license, the same component at more than one version, and NOASSERTION licenses. Compare an old and a new SBOM to see what was added, removed, or changed in version or license. No vulnerability database is queried; only the vulnerabilities written in the SBOM are listed.

- URL: https://tools.itlibra.com/en/sbom-studio
- On-device・No upload
- Last updated: 2026-10-31

## How to use

1. Paste a CycloneDX 1.4 to 1.6 or SPDX 2.2 or 2.3 SBOM (JSON or SPDX tag-value), or drop a file (“Choose file” works too). “Try a sample” shows how it works.
2. In “Components”, check the name, version, purl, license, supplier and hash. You can search and sort, and save the current rows as CSV.
3. In “Dependency tree”, follow which components each one depends on, from the root down. Cycles and depth limits are shown as “not expanded”.
4. In “Issues”, see components with no purl, version or license, the same component at several versions, and NOASSERTION. “Vulnerabilities” lists only what the SBOM says.
5. In “Compare”, paste an older SBOM to list what was added, removed, changed in version, or changed in license.

## Use cases

- Check whether a received SBOM is CycloneDX or SPDX, and which version it is
- List each component with its license and supplier for an audit or internal review
- Compare this release’s SBOM with the last one to see new or changed components
- Find the same library at two versions, or components whose license is NOASSERTION

## What it does

### Both CycloneDX and SPDX

Reads CycloneDX 1.4, 1.5 and 1.6 JSON, and SPDX 2.2 and 2.3 in JSON and tag-value. An unsupported version stops with the version named.

### Dependencies as a tree

Builds a tree from the root down, using CycloneDX dependencies and SPDX relationships such as DEPENDS\_ON, CONTAINS and DESCRIBES. A cycle is shown once.

### Old and new comparison

Pairs components by purl (without the version) or by name, then lists additions, removals, version changes and license changes.

### Findings only where the SBOM shows a gap

Flags missing purl, version or license, the same component at several versions, and NOASSERTION. Each finding comes from what the SBOM itself says.

### CSV export

Saves the components on screen (with search and sort applied) as CSV. Leading formula characters are escaped so spreadsheets do not run them.


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| Reading components, dependencies and vulnerabilities from CycloneDX 1.4, 1.5 and 1.6 (JSON) | Supported | — |
| Reading components and relationships from SPDX 2.2 and 2.3 (JSON and tag-value) | Supported | Tag-value reads the main fields only. |
| Old and new comparison (additions, removals, versions, licenses) | Supported | — |
| Checking against a vulnerability database | Not supported | No network requests. Only the vulnerabilities written in the SBOM are listed. |
| Verifying signatures or generating an SBOM | Not supported | Reads an SBOM only; it does not create one or verify a signature. |
| Reading lock files such as package-lock.json | Not supported | For lock files, use dependency\_viewer. |
| Every SPDX field (file-level data, annotations and so on) | Partial | Reads only the fields used for packages and relationships. |

## Limits & notes

- Up to 20 MB of input and 50,000 components are read. Anything beyond is not read, and you are told.
- The tree shows up to 2,000 items and 12 levels deep. Parts beyond that are marked “not expanded”.
- No vulnerability database is queried. The vulnerability list contains only what the SBOM states.
- License meaning (permissions and compatibility) is not judged. License strings are shown as written.

## Privacy & safety

A pasted SBOM is read only inside your browser. It is not sent to or stored on a server, and nothing is saved in the browser. Usage analytics never include content or file names.

## FAQ

### How do I tell whether an SBOM is CycloneDX or SPDX?

If the top-level bomFormat is CycloneDX, it is CycloneDX. If there is a spdxVersion field, it is SPDX. An SPDX tag-value file begins with SPDXVersion:. Anything else is reported as unknown.

### How is this different from dependency\_viewer?

dependency\_viewer reads dependencies from lock files such as package-lock.json. This tool reads an SBOM (CycloneDX or SPDX) that a build or another tool has already produced.

### Is NOASSERTION the same as having no license?

No. NOASSERTION means the author did not state the license. It is reported separately from NONE or an empty license.

### Can I check vulnerabilities against current data here?

No. The tool does not query a vulnerability database, so it lists only the entries written in the SBOM. Check current data with a vulnerability service.

### If there are no issues, is the software safe?

No. The checks cover only gaps and duplicates in how the SBOM is written (purl, version, license). They do not assess the safety of the components.