In short
Lists every component in a CycloneDX or SPDX JSON SBOM
You need one SBOM file in JSON
You get a component table, licence warnings and a CSV export
Parsed in your browser; the file is not uploaded
Who uses it
Machine builders and automation OEMs
The engineering head checks a supplier SBOM before answering a customer questionnaire.
Device makers and brands
The firmware lead reviews what an SBOM says ships in a release, and spots missing licence data.
Enterprise buyers and their supply chain
Procurement security opens an SBOM a vendor sent and reads it as a plain table.
How it works
This tool reads the two component-list formats most software and firmware vendors publish an SBOM in: CycloneDX (ECMA-424) and SPDX (ISO/IEC 5962:2021). The component identity, version and license fields it lists come from NTIA's Minimum Elements For a Software Bill of Materials, the baseline most SBOM consumers (including CISA's SBOM guidance) expect a usable SBOM to carry. To compare two SBOMs instead of browsing one, use the SBOM diff tool.
Parsing happens in your browser. The file is not uploaded to SoftWSP.
Choose a fileSelect a CycloneDX or SPDX JSON file. The format is detected from its structure. Review the tableRead name, version, licence and package URL for each component, with warnings for missing licences and copyleft families. ExportDownload the table as CSV for a spreadsheet or a review ticket.
What fields does a genuinely useful SBOM need, beyond a bare list of component names?
NTIA's Minimum Elements For a Software Bill of Materials report sets a baseline of seven data fields — supplier name, component name, version, other unique identifiers, dependency relationship, author of the SBOM data, and a timestamp — that every component entry should carry for the SBOM to be usable by the people who receive it, not just by the tool that produced it.
CISA's SBOM guidance builds on that same baseline when it frames an SBOM as a foundational artefact for software supply-chain risk management, and both formats this viewer reads can carry those fields: CycloneDX's ECMA-424 component entries and SPDX's ISO/IEC 5962:2021 package entries just structure them differently, which is why the viewer reads both instead of favouring one. If you need the SBOM itself produced from a binary firmware build rather than just viewed, our device firmware security service generates one as part of its scan.
What you get
5 CycloneDX components
- busybox1.36.1GPL-2.0-onlypkg:generic/[email protected]
- openssl3.0.13Apache-2.0pkg:generic/[email protected]
- zlib1.3.1Zlibpkg:generic/[email protected]
- dropbear2022.83MITpkg:generic/[email protected]
- acme-hal2.4.0No licencepkg:generic/[email protected]
Missing license information: 1 of 5 components have no license field in this SBOM.
Formats and standards
Standard names belong to their owners and are used only to identify the formats; nominative use, no endorsement implied.
Delivered by Netbase JSC
SoftWSP is a brand of Netbase JSC. Facts of Netbase JSC as of .
Founded
2012
Reach
Clients in around 80 countries
Delivery model
Remote, worldwide
Vulnerability reports
PSIRT via [email protected], published security.txt
The full job, done for you
The viewer reads an SBOM you already have. Our machine builders service builds the SBOM for a whole machine line from your electrical component list and matches each part to published vulnerabilities, without connecting to your machines.
Need this across a product range or in your pipeline? Talk to sales.
Frequently asked questions
Which SBOM formats does this viewer read?
The two JSON serializations most vendors publish today: CycloneDX, specified in ECMA-424, and SPDX, specified in ISO/IEC 5962:2021. The viewer detects the format from the file structure (a CycloneDX "components" array or an SPDX "packages" array) and does not require you to say which one you have.
Does my SBOM file ever leave my browser?
No. The file is read with the browser's own File API and parsed with JSON.parse in JavaScript running on your machine. There is no upload, no fetch call and no server-side processing anywhere in this tool.
What does the "missing license information" warning mean?
It means at least one component in your file has no license field (no `licenses` entry in CycloneDX, no `licenseConcluded`/`licenseDeclared` in SPDX). That is a gap in the SBOM itself, not an error in the viewer — NTIA's Minimum Elements report lists the component identity fields a usable SBOM should carry, and license data is one of the fields buyers and auditors commonly ask for.
Is this the SBOM the EU Cyber Resilience Act requires?
The CRA's Annex I, Part II expects manufacturers to produce and maintain an SBOM covering top-level dependencies, but does not mandate a specific file format. A CycloneDX or SPDX file opened here is a reasonable starting point; see the linked firmware SBOM guide for how that obligation is scoped.
Can I open an XML CycloneDX file or a tag-value SPDX file?
The viewer reads the JSON serializations of CycloneDX and SPDX; convert an XML or tag-value file to JSON first, then open it here.