Skip to content
EmbedHarborPRODUCT SECURITY
Existing account sign in ↗
FREE TOOL

SBOM Diff

Compare two SBOMs to identify added, removed, and updated components.

LIVE

Files stay in your browser. Comparison runs locally; no SBOM content is uploaded, logged or sent to an API.

Up to 20 MB and 20,000 components per file. Files are never uploaded.

Before SBOM

CycloneDX JSON 1.4–1.6 or SPDX 2.3 JSON

Drag & drop SBOM fileCycloneDX JSON 1.4–1.6 or SPDX 2.3 JSON

After SBOM

CycloneDX JSON 1.4–1.6 or SPDX 2.3 JSON

Drag & drop SBOM fileCycloneDX JSON 1.4–1.6 or SPDX 2.3 JSON

Upload both files to compare. Replacing either file clears the previous result.

Component identity and exact versions only. No vulnerability, license, dependency-edge, VEX or CRA compliance conclusion.

Strictly necessary

Remember your language and consent choice, and keep your session secure. Always on.

Always on

Analytics

Records anonymous page and tool events in this browser. No third-party analytics provider receives them.

You can change this choice at any time from Cookie settings in the footer.

This prototype implements a consent choice, not a legal certification. Production use still requires a reviewed cookie table, legal bases, retention limits and a working withdrawal path.