SBOM Diff Checker

Compare two SBOMs and see exactly what was added, removed, upgraded or relicensed between them, filtered by what matters for risk.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Before

Drop the older SBOM

After

Drop the newer SBOM

What actually changed between two builds

A textual diff of two SBOMs is almost all noise. Serial numbers and timestamps change on every generation, identifiers are regenerated, and component order shuffles. This checker compares what the documents say. Components are matched by Package URL (type, namespace and name, without the version), or by name when there is no purl. Each match is then classified: added, removed, upgraded, downgraded, or modified at the same version.

Changes that deserve attention

Downgrades are listed separately from upgrades because they so often reintroduce a fixed vulnerability. A licence change at the same version is unusual and worth a look. The one flagged in red is a different hash for the same name and version. Either the package was rebuilt, or what you shipped is not what the registry published. The second case is exactly what supply-chain compromise looks like.

Noise is shown, not hidden

The serial number, creation time and identifiers that changed without anything else changing are listed under "Ignored as noise", with counts. You can confirm that nothing meaningful was discarded. The two documents can even be in different formats, CycloneDX before and SPDX after: components are matched on purl and name, never on format-specific identifiers.

How versions are ordered

Dotted numeric versions are compared number by number (1.10 is newer than 1.9), and a pre-release such as 1.0.0-rc1 comes before 1.0.0. When two versions use different schemes and cannot be ordered, the change is reported as "version changed" rather than guessed to be an upgrade or a downgrade.

Frequently asked questions

Why is a component both removed and added?

Its identity changed: usually a new purl namespace or a rename. Without a stable identifier, the two cannot safely be treated as the same package.

Are dependency changes compared?

Yes. Edges are compared by component identity, so regenerated identifiers do not show as rewired dependencies. Added and removed edges are listed.

Is anything uploaded?

No. Both SBOMs are parsed in background workers in your browser.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.