SBOM Viewer
Read an SBOM without installing anything.
Runs entirely in your browser — nothing you paste is sent to our servers.
What this tool does
Both formats
CycloneDX and SPDX normalised into one component view, so you can read either without learning both vocabularies.
Licence breakdown
Every licence counted, with copyleft and reciprocal terms surfaced as something to be aware of rather than buried.
The gaps that break scanning
Components with no version or no package URL cannot be matched against advisories — which defeats the purpose of the file.
Nothing uploaded
An SBOM is a complete inventory of your software. It is parsed in this tab.
Frequently asked questions
What is an SBOM?
A Software Bill of Materials — a machine-readable inventory of the components inside a piece of software, with versions and licenses. It exists so that when a vulnerability is announced you can answer "are we affected" by querying a list, rather than by grepping build systems for a week.
Which formats does this read?
CycloneDX and SPDX, both in JSON. Those are the two formats in real use. XML variants exist for both and are not supported here — every generator can emit JSON, and supporting one representation well is better than supporting two badly.
Why does it flag components without a version?
Because a component with no version cannot be matched against a vulnerability database. Matching works on name plus version range, so an entry missing the version is invisible to every scanner that reads the file — which defeats the main purpose of having one.
What is a package URL?
A purl is a standard identifier like pkg:npm/lodash@4.17.21 that names the ecosystem, package and version unambiguously. Without one, tools fall back to matching by name, which is unreliable across ecosystems — plenty of packages share a name on npm and PyPI while being unrelated.
Does this check my components for vulnerabilities?
No. It reads and validates the document. Matching components against advisories is what the dependency checker does, from a lockfile. Keeping the two separate means this tool needs no network and can safely read an SBOM describing internal software.
Why does it point out copyleft licenses?
Because they carry distribution obligations that permissive licenses do not, and a reviewer needs to know they are present. It is surfaced as information rather than a problem — GPL and similar licenses are entirely legitimate, they just require a decision.
Is my SBOM uploaded?
No. It is parsed in this tab. An SBOM is a complete inventory of your software and often of internal components, so it is exactly the sort of file that should not be pasted into a remote service.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.