SBOM checker
See what your SBOM tells you: inspect the document, understand the gaps and take an evidence-based next step.
Inspect an SBOM
Check a document against its official schema, the content checks below and the CISA 2026 minimum elements. Your file is processed in this browser and is never uploaded by this tool.
Open or drop an SBOM file
CycloneDX 1.5 / 1.6 / 1.7, SPDX 2.3, or SPDX 3.0.1 compact JSON-LD · maximum 2 MiB / 5,000 entries
No file selected.
Or paste the document
Loading the local checker… If this remains visible, refresh the page.
Document quality report
| Check | Result | Evidence & limits |
|---|
CISA 2026 minimum elements
The 17 data fields of 2026 Minimum Elements for a Software Bill of Materials (SBOM) (CISA, NSA, FBI and 15 international partner agencies, published 29 July 2026), as far as one file can show them. Present and well formed is not the same as true or complete.
| Data field | Result | Evidence & limits |
|---|
Practices and processes, which one file cannot show
- Coverage: Needs the shipped artifact or its build: a file cannot show what it leaves out.
- Explicitly Identifying Unknown Information: Partly visible: each field below counts values stated as unknown separately from values that are missing.
- Frequency: Needs the release history: one file cannot show that each release has its own SBOM.
- Distribution and Delivery: Depends on how the SBOM is shared, not on its content.
- Accommodation of Updates to SBOM Data: Depends on the author’s correction process; compare SBOM Version across releases.
- Machine-Processable Data: Satisfied by a supported CycloneDX or SPDX JSON document.
Find and correct the affected entries
Both reports record the input’s SHA-256, size and name, the checker and rule versions and the time of the check, so a report can be tied to the exact file it describes.
What is inspected
- Validity against the official CycloneDX or SPDX JSON schema
- Document identity, timestamp, author and generation tool
- Inventory names, versions, reference IDs and relationships
- Package URLs (ECMA-427) and CPE names
- SPDX license expressions against the SPDX License List 3.29.0
- Hash values: length for the algorithm, and algorithms that are not collision resistant
- Hidden or reordering characters, and member names repeated in one object
- The CISA 2026 minimum elements, including the dependency graph from the root component
- Completeness, which needs evidence from outside the file
Source specifications
Checker 1.0.0, rules 1.0.0. Schemas are the official files, compiled before publication into validators that run in this browser.
- CycloneDX 1.5 JSON schema (CycloneDX specification 1.5.1)
- CycloneDX 1.6 JSON schema (CycloneDX specification 1.6.2)
- CycloneDX 1.7 JSON schema (CycloneDX specification 1.7.2)
- SPDX 2.3 JSON schema (SPDX specification v2.3)
- SPDX 3.0.1 JSON schema (SPDX specification 3.0.1)
- SPDX License List 3.29.0
- ECMA-427 Package-URL (purl) specification
- 2026 Minimum Elements for a Software Bill of Materials (SBOM)
Guides and practice for SBOMs
SBOM guides in Software supply chainGenerate an SBOM for the software you actually release
Define the inventory boundary, compare build and artifact evidence, and connect the resulting SBOM to an immutable release.
Choose SBOM formats and identify components accurately
Separate schema versions, document references and package identities so inventory conversion and advisory matching preserve meaning.
Review SBOM changes between releases
Turn inventory differences into explainable release decisions without confusing generator changes with software changes.
Use VEX without losing vulnerability evidence
Produce and consume precise vulnerability status statements tied to the product, version, justification and evidence.
SBOM completeness lab: Find the dependencies missing from a release SBOM
A release SBOM lists only direct dependencies. The shipped artifact also contains a bundled parser and a transitive helper. Repair the comparison so inventory omissions remain visible.