SBOM viewer for CycloneDX and SPDX files: search every component, license and dependency, spot missing licenses and export a CSV. Read in your browser.
SBOM viewer for CycloneDX and SPDX files: search every component, license and dependency, spot missing licenses and export a CSV. Read in your browser.
Is SBOM Viewer free to use?
Yes. SBOM Viewer is completely free with no usage limits, and there is no paid tier required to use it.
Do I need an account to use SBOM Viewer?
No. SBOM Viewer works immediately in your browser with no signup, login, or email address required.
View and explore JSON data in an interactive collapsible tree structure. Search, filter, and navigate nested objects and arrays. Free online JSON viewer with no signup required.
CSV viewer online: open a CSV from a URL, upload a file, or paste data, then search, sort, and filter it in a clean table. Shareable ?url= links, custom delimiters, large files.
Share code snippets, logs, and text with a shareable link. Syntax highlighting for 30+ languages, expiration controls, and password protection for Pro users.
Read in your browser, never uploaded. Up to 150 MB, UTF-8 or UTF-16.
SBOM Analysis
Every component with its version, purl and license, a license breakdown, the dependency tree and a check against CISA's 2026 SBOM minimum elements will appear here.
About SBOM Viewer
An SBOM viewer is used to read a software bill of materials without a command line. It lists every component, license and dependency in a CycloneDX or SPDX file and checks the file against CISA's 2026 minimum elements. Paste the SBOM or open the file your build pipeline, a vendor or GitHub's dependency graph export produced, then filter, sort and export the components to CSV.
Key Features
Reads CycloneDX JSON (1.2 to 1.7) and XML (1.0 to 1.7), SPDX 2.2 and 2.3 in JSON and tag-value, and SPDX 3.0 JSON-LD, and detects the format and version on its own
Lists every component with its version, purl, CPE, hashes, producer and licenses, with search, sorting and a CSV export
Groups licenses by SPDX id, labels common permissive, weak copyleft and strong copyleft licenses, and calls out components marked NOASSERTION, NONE or with no license at all
Draws the dependency tree from the root component, including nested CycloneDX components and SPDX DEPENDS_ON, DEPENDENCY_OF and CONTAINS relationships, and marks cycles instead of looping
Scores the file against the 17 data fields in CISA's 2026 Minimum Elements for an SBOM, such as component producer, hash, license, tool name and generation context
Opens GitHub dependency graph SBOM exports and UTF-16 files, and was tested on 20,000-component SBOMs
Use Cases
Checking an SBOM against CISA's 2026 Minimum Elements before sending it to a customer or a federal buyer
Answering a federal contract clause that asks for a current SBOM on request, which OMB memo M-26-05 lets agencies adopt after it rescinded M-22-18 in January 2026
Reviewing the SBOM a medical device maker includes in an FDA premarket submission for a cyber device under section 524B of the FD&C Act
Reading a vendor's SBOM during a SOC 2 or third-party security review without installing Syft or the CycloneDX CLI
Finding GPL and AGPL components in an open source license audit before an acquisition closes
Comparing what npm sbom, Syft and Trivy each put into an SBOM before wiring one into a CI/CD pipeline
Supported Formats
CycloneDX JSON (1.2 to 1.7)
CycloneDX XML (1.0 to 1.7)
SPDX 2.2 and 2.3 JSON (.spdx.json)
SPDX 2.x tag-value (.spdx)
SPDX 3.0 JSON-LD
GitHub dependency graph SBOM exports
Related Keywords
sbom viewer
sbom viewer online
cyclonedx viewer
spdx viewer
sbom file viewer
software bill of materials viewer
sbom json viewer
cyclonedx json viewer
spdx json viewer
sbom license report
What is the difference between CycloneDX and SPDX?
Both are machine-readable SBOM formats, and the common generators (npm sbom, Syft, Trivy) can write either one. SPDX comes from the Linux Foundation, began as a license compliance format, and its version 2.2.1 is the international standard ISO/IEC 5962:2021. CycloneDX comes from OWASP, began with security use cases, and is standardized by Ecma International as ECMA-424. SPDX describes relationships between documents, packages and files, while CycloneDX nests components and lists dependencies by bom-ref. CISA's 2026 minimum elements name both as the widely used formats, and this viewer reads both.
Your SBOM never leaves this tab
The file is parsed in your browser. Nothing is uploaded, and auto-save keeps only the text report, never the SBOM itself.