SBOM Generator

A Software Bill of Materials (SBOM) is a machine-readable inventory of every component, library, and dependency in your software. It is used for supply chain security audits, vulnerability scanning (knowing what you ship), open-source license compliance, and regulatory requirements like the US Executive Order 14028 and the EU Cyber Resilience Act.

CycloneDX is an OWASP-backed SBOM standard optimised for security use cases — vulnerability tracking, VEX (Vulnerability Exploitability eXchange), and integration with tools like Dependency-Track. SPDX is a Linux Foundation standard focused on licence compliance. CycloneDX 1.5 (generated by this tool) is widely supported by GitHub, Grype, Trivy, and most CI/CD pipelines.

Four ecosystems are supported: npm (package.json — reads dependencies, devDependencies, peerDependencies, and optionalDependencies), pip (requirements.txt — standard ==, >=, ~= version specifiers), Cargo (Cargo.toml — [dependencies] and [dev-dependencies] sections), and Go modules (go.mod — require blocks and inline require statements). The ecosystem is auto-detected from the file content.

A Package URL (PURL) is a standardised string that uniquely identifies a software package across ecosystems. The format is pkg:type/namespace/name@version. For example, pkg:npm/[email protected] or pkg:pypi/[email protected]. PURLs are used in SBOMs, vulnerability databases (OSV, NVD), and tools like OWASP Dependency-Track to unambiguously match packages against known CVEs.

Yes. All parsing and SBOM generation runs entirely in your browser using client-side JavaScript — no file content is ever sent to a server. The CycloneDX JSON is built locally and downloaded directly to your machine. It is safe to use with proprietary or internal dependency manifests.