Your files stay on your device

# SBOM viewer

Open a CycloneDX or SPDX SBOM into a searchable component table with licences, purls, a dependency graph and filtered exports.

Paste an SBOM or open a file, then press Open SBOM.

What this viewer does, and what it does not
It reads CycloneDX JSON and XML and SPDX 2.x JSON into a searchable table, scores each component on missing purl, licence, supplier, version, or hash, and draws the dependency relationships the document states. It is not a vulnerability scanner: no advisories, no version-range matching, no license compliance verdicts beyond showing the strings. SPDX 3.x JSON-LD, SPDX RDF/XML, and tag-value text files are recognized and refused with a pointer to the formats it does read. Dependencies are the relationships written in the document; the viewer never guesses transitive edges.OptionsOpen SBOM

## More regex & cron tools

- [JSON query](/json/query)
- [JSON diff](/json/diff)
- [JSON validator](/json/validator)
[All regex & cron tools](/dev)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/dev/sbom-viewer
Markdown version: https://nutter.tools/dev/sbom-viewer.md
Plain-text version: https://nutter.tools/dev/sbom-viewer.txt
Agent index: https://nutter.tools/llms.txt