Compare two SBOMs
CycloneDX or SPDX JSON, in any combination. See which components were added, removed or changed, and check their licenses. Files are read in this tab and never uploaded.
SBOM A baseline
Drop SBOM A (JSON) or click to select
SBOM B new
Drop SBOM B (JSON) or click to select
Load SBOM B to compare. The license check below already works on one file.
Changes from A to B
License check
How it works
- Matching
- Components are matched by package URL (purl) without its version, or by name when there is no purl. A new version of the same package counts as changed, not as one removal and one addition. Two versions of one package in the same SBOM are tracked separately.
- Licenses
- SPDX expressions are evaluated, not just split:
MIT OR GPL-2.0-onlypasses “No GPL” because you can choose MIT, whileMIT AND GPL-3.0-onlyfails. The check runs on SBOM B, or on A if only one file is loaded. - Formats
- CycloneDX JSON and SPDX 2.x JSON, up to 20 MB each. CycloneDX XML, SPDX tag-value and SPDX 3.0 are not read; you get an error instead of a wrong result.
- Privacy
- Files are read with the browser’s FileReader. The page’s Content Security Policy only allows connections to this site, so an SBOM cannot be sent anywhere. There are no analytics. The source is short enough to check.
- Not included
- Vulnerability data. This shows what changed between two SBOMs, not which changes are vulnerable.