SBOM Viewer

Open a CycloneDX or SPDX SBOM and actually read it - searchable components, versions, licences, identifiers and the dependency graph - without uploading your inventory anywhere.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop a CycloneDX or SPDX SBOM

JSON, XML or tag-value, up to 64 MB. Opened in your browser; nothing is uploaded.

Read the SBOM, not the JSON

A software bill of materials is meant to answer simple questions: what is in this product, at which versions, under which licences, from which suppliers, and what depends on what. In raw form it answers none of them easily. A CycloneDX file nests components inside components, and an SPDX file scatters dependencies across a relationship list. This viewer reads CycloneDX 1.4 to 1.7 (JSON and XML) and SPDX 2.2 and 2.3 (JSON and tag-value) into one table you can search, filter and export.

Completeness, not just contents

The summary counts what is missing: components without a Package URL, without a licence, without a supplier, without a version, without a hash. Those gaps are what make an SBOM less useful than it looks. A component with no purl is invisible to most vulnerability matching. One with no hash cannot be checked against what was actually shipped. Filter by any gap to see exactly which components are affected.

Dependencies in both directions

Select a component to see what it depends on and what depends on it, built from CycloneDX dependency entries or SPDX DEPENDS_ON, DEPENDENCY_OF and CONTAINS relationships. Every related component is a link, so you can walk the graph from a vulnerable library up to the application that ships it.

Large files, same page

Parsing runs in a background Web Worker and can be cancelled, and the table only renders the rows on screen. A 20,000-component SBOM stays responsive, and the rest of the page keeps working while the file loads.

Frequently asked questions

Does opening an SBOM here validate it?

It runs the same checks as the validators, and the summary says whether the document passed. Detailed findings are on the CycloneDX and SPDX validators.

Why do some SPDX packages show no licence?

The viewer shows the declared licence, or the concluded one if no licence is declared. NOASSERTION is shown as no licence, because it is not one. The viewer never infers a licence.

Is my SBOM sent anywhere?

No. It is read by your browser, parsed in a worker, and discarded when you leave the page.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.