Skip to content
EmbedHarborPRODUCT SECURITY
Existing account sign in ↗
FREE TOOL

SBOM Validator

Validate CycloneDX and SPDX files, inspect component quality, and check vulnerability monitoring readiness.

LIVE

Official schema validation runs locally. No SBOM content leaves your browser.

Files stay in your browser. Analysis runs locally with limits of 20 MB per document and 20,000 components. Nothing is uploaded, logged or sent to an API.

Schema validation does not prove CRA compliance. Query readiness is not a vulnerability result.

Strictly necessary

Remember your language and consent choice, and keep your session secure. Always on.

Always on

Analytics

Records anonymous page and tool events in this browser. No third-party analytics provider receives them.

You can change this choice at any time from Cookie settings in the footer.

This prototype implements a consent choice, not a legal certification. Production use still requires a reviewed cookie table, legal bases, retention limits and a working withdrawal path.