SBOM Generator
This SBOM generator creates a CycloneDX 1.6 SBOM from your project file, such as package.json, requirements.txt, pom.xml or Cargo.toml. The license, supplier and purl (Package URL) of every dependency are looked up in its public package registry and put together into the SBOM. Everything is processed in your browser, without uploading your files to a server.
Your app (optional)
If you fill in the name and version, the SBOM describes your app as its main component and lists the dependencies under it. The manufacturer goes into the SBOM as the document author and the app's supplier.
Project file
Files are processed in your browser. Only package names and versions are sent to the public npm registry to look up their licenses.
What is an SBOM?
An SBOM (software bill of materials) is a machine-readable list of the components your app is built from, with their versions, licenses, suppliers and identifiers such as purl (Package URL). There are two standard formats, CycloneDX and SPDX. Vulnerability and license tools can usually process both formats.
The NTIA (National Telecommunications and Information Administration) defined the minimum elements of an SBOM and the BSI (Bundesamt für Sicherheit in der Informationstechnik) adds further requirements in its technical guideline TR-03183-2. From December 2027, the EU Cyber Resilience Act requires manufacturers of products with digital elements to draw up an SBOM that covers at least the top-level dependencies.
How the SBOM generator works
The generator reads the dependencies from your project file and looks up each package in its public registry, such as npm, PyPI, NuGet or Maven Central. If you add the lock file, the SBOM contains specific versions and, where available, their hashes. A dependency without an exact version goes into the SBOM without a version.
The SBOM lists the direct dependencies from your project file, which are the top-level dependencies the Cyber Resilience Act sets as the minimum. You can create a full SBOM with transitive dependencies during the build with a tool like cdxgen, syft or Trivy.
Frequently asked questions
How do I generate an SBOM?
Pick your package manager, paste or upload the project file and if you want the exact versions recorded, add the lock file too. Then you download the SBOM as a CycloneDX 1.6 JSON file. Fill in the app name and version as well, so the SBOM describes your app as its main component.
What is the difference between CycloneDX and SPDX?
Both are standard SBOM formats. CycloneDX comes from OWASP (Open Worldwide Application Security Project), is standardized as ECMA-424 and focuses on security, for example vulnerabilities and dependency graphs. SPDX comes from the Linux Foundation, started with license tracking and is standardized as ISO/IEC 5962. This generator creates CycloneDX.
What does an SBOM need to contain?
The minimum elements according to the NTIA (National Telecommunications and Information Administration) are the supplier, component name, version, a unique identifier such as purl (Package URL), dependency relationships, the SBOM author and a timestamp. The BSI (Bundesamt für Sicherheit in der Informationstechnik) TR-03183-2 also asks for licenses and hashes, among other things. The completeness labels in the generator show which elements your SBOM has.
Does an SBOM include transitive dependencies?
A full SBOM does. Our generator lists the direct dependencies from your project file, which the Cyber Resilience Act sets as the minimum. If you want transitive dependencies in your SBOM too, generate it during the build with cdxgen, syft or Trivy.
Is the project file I paste here sent anywhere?
No. The file is processed in your browser. Only package names and versions go to the public registries to look up licenses and suppliers. For Java and Android, Maven Central doesn't allow requests directly from the browser, so those packages are looked up through the AboutTheApp server, without any details about your project.
Can I keep an SBOM for each version of my app?
Yes. In AboutTheApp, each version of your app has its own SBOM, separately for parts like backend, web or mobile app if you need. You create it from project files, upload a CycloneDX file or attach it directly from CI. A new SBOM for the same part replaces the previous one, which stays in the history.
Add your app to AboutTheApp
Create a free account and add your app. Besides an SBOM for each version, AboutTheApp keeps your app's links, its environments and the list of third-party components with their licenses.
Create a free account