This tool compares two CycloneDX or SPDX JSON SBOMs — in any combination of the two formats — and lists exactly which components were added, removed, changed version, or changed licence between them. Paste each file's JSON or upload it directly; parsing and diffing happen entirely in your browser, so it is safe to compare a real pre-release and post-release SBOM without either file leaving your machine.
Paste or upload the two SBOMs to compare
Both SBOMs are parsed and diffed entirely in your browser. Nothing you paste or upload here is sent to SoftWSP.
Why diff two SBOMs instead of just reading the newer one?
A single SBOM is a snapshot; a diff is what actually changed between two releases, which is the question a security review, a change-management ticket, or a customer asking "what's different in this build" is really asking. Reading two full component tables side by side to spot one new GPL dependency or one quietly downgraded library among hundreds of entries does not scale, which is the gap this tool and its offline risk hints are built to close.
Component identity is the hard part of any SBOM diff: the same package can be named slightly differently across two scans, or across a CycloneDX scan and an SPDX scan of the same build. Matching by Package URL when it is present — the identifier both formats can carry for the same real-world package — is what lets this tool compare a CycloneDX "before" against an SPDX "after" without the two formats' different field names producing false added/removed noise.
Sources
Frequently asked questions
How does this tool match the same component across two different SBOMs?
By Package URL (purl) when both sides have one — the one identifier CycloneDX and SPDX can both carry for the same real-world package, per the package-url/purl-spec project. A CycloneDX component's `purl` field and an SPDX package's `externalRefs[]` entry with `referenceType: "purl"` are read the same way, so a component can be renamed between a CycloneDX scan and an SPDX scan and still be matched correctly. Components with no purl on either side fall back to matching by name, which is why a component that gets a purl added between two scans can briefly look like one component removed and a different one added.
Can I diff a CycloneDX SBOM against an SPDX SBOM, or do both files need to be the same format?
Either combination works — CycloneDX vs CycloneDX, SPDX vs SPDX, or one of each. This tool detects each document's format independently (a `components[]` array means CycloneDX, a `packages[]` array means SPDX) before extracting name, version, licence and purl from it, so a mixed comparison is a normal use case, not a special mode.
What counts as a "version-changed" component versus a "licence-changed" one?
A component present in both SBOMs under the same key is version-changed when its version string differs between the two files, and licence-changed when the version is identical but the licence string differs. A component can only land in one group: if both the version and the licence changed, it is reported once under version-changed, since the version bump is the more actionable fact for most reviews.
What are "Diff risk hints", and are they generated by an AI model?
No model call is involved. Diff risk hints are a deterministic, offline function of the diff this tool already computed: it flags newly-added components under a GPL/AGPL-family licence, newly-added components with no licence stated at all, and version changes that look like a downgrade rather than an upgrade. The same JavaScript that runs in your browser produces the hints — nothing is sent to a server, and removing this step leaves the underlying added/removed/version-changed/licence-changed tables unchanged.
Does either SBOM file get uploaded anywhere?
No. Both files are read with the browser's own FileReader API (or typed/pasted directly into the text boxes), parsed with `JSON.parse`, and diffed by JavaScript running on your machine. There is no fetch call, no form submission and no backend route behind this tool — the Markdown and CSV summaries it can generate are built and downloaded the same way, entirely client-side.
Questions about this page?