Your files stay on your device

SBOM diff checker

Drop two CycloneDX or SPDX SBOMs and see which components were added, removed, upgraded or relicensed, matched on package URLs.

Paste or drop an SBOM on both sides, or load the example pair. Everything stays in this tab.

Components match on package URL: the purl with its version, qualifiers and fragment stripped, case-folded. A component with no purl falls back to its name, and the row says so. Versions compare under SemVer 2.0.0 when both sides parse; otherwise the row reads "changed, not comparable". SPDX tag-value (.spdx) files are not supported, and purl percent-escapes are not decoded. This is a structural diff only. It does not consult vulnerability feeds, license compliance lists, or dependency graphs, so a clean diff is not a clean bill of health.
Options

More regex & cron tools

- SBOM validator (/json/cyclonedx-validator)
- JSON diff (/json/diff)
- Semver compare (/dev/semver)
All regex & cron tools (/dev)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/dev/sbom-diff-checker
Markdown version: https://nutter.tools/dev/sbom-diff-checker.md
Plain-text version: https://nutter.tools/dev/sbom-diff-checker.txt
Agent index: https://nutter.tools/llms.txt